T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/喂料包模板.md:13- Finding
Unbounded Inspection of Raw Agent History
- Content
View full analysis
- Remediation
View remediation
Security audit
喂料专家五步投喂工作流
Security checks for vulnerabilities and agentic risk
Overview
This documentation-only skill is coherent, but it needs Review because it encourages raw agent-history inspection and unattributed third-party content ingestion without enough boundaries.
Install only with operational guardrails: verify outputs from a task-scoped, redacted export instead of broad history logs, preserve source/provenance metadata for third-party material, and require explicit approval before any cloud ingestion, publication, or external sharing.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instruction '品牌署名统一用「注册老炮」' imposes a fixed naming/locale choice in natural language. Under the policy, forcing a specific language or locale without offering user choice or documenting a justified regional constraint is a reportable natural-language policy issue.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The suggested invocation "盘点现有知识库缺口，出一份喂料清单" is a broad natural-language request rather than a narrowly scoped trigger. In everyday knowledge-management contexts, similar phrasing could overlap with ordinary assistance requests, and the file does not provide exclusion conditions or negative examples to clarify when this skill should or should not activate.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The entire skill template is written only in Chinese and provides no indication that users may choose another language or that the Chinese-only requirement is intentional for a region-specific workflow. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to rewrite third-party content and explicitly omit third-party attribution creates a provenance gap and conflicts with the document's own requirement to include source information for factual values, limits, and clauses. In a knowledge-ingestion workflow, this can enable unattributed reuse of external material, make verification harder, and increase legal/compliance risk around copyright, licensing, and auditability.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Telling operators not to attribute third-party sources is a policy-risk instruction because it encourages storage and downstream use of external content without the transparency typically required by organizational content-use, procurement, or publication rules. In this skill, the instruction is global and operational, so it can systematically propagate non-compliant practices across the knowledge base.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Rewriting third-party content before storage while omitting attribution can function as provenance laundering: the material appears original inside the repository even though it originated externally. This is especially risky in a feeding/ingestion discipline document because it governs how content enters shared knowledge systems, making the loss of traceability more dangerous than an isolated note.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file is written entirely in Chinese and presents the audit/reporting content as if Chinese is the required language, without any indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest uses Chinese-only natural-language values for the package and author fields, which indicates a fixed language/locale presentation. In this file there is no accompanying opt-in, language choice, or explicit justification that the skill is intended only for a Chinese-language or region-specific context.
- Content