Security audit

uibc-race-ops

Security checks for vulnerabilities and agentic risk

Overview

This is a prompt-only contest operations skill with privacy and scope caveats, but I found no hidden code, automatic permissions, or deceptive behavior.

Install only if you want a UIBC-style contest operations prompt. Before using it for a real contest, keep publication, prize logistics, participant data, and sponsorship commitments behind organizer approval, privacy controls, and human review.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: The skill explicitly contemplates self-modification and AI-building/modification workflows, including 'T3 self-modify.' Even though it wraps this in a review process, normalizing self-modification inside a prompt skill can encourage an upstream agent to plan or authorize agent changes without a hard external control boundary, which is risky in systems that support tool use or dynamic agent composition.
Content: Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.
Any action that "builds or modifies AI" (a new member Agent, an auto-scoring script, a duty-boundary change) must first pass the A³ three gates:

text
Trigger classification (T1 build AI / T2 modify AI / T3 self-modify / T4 high-impact autonomy / T5 delegate AI-building) ↓ Pre-action review (four-dimension scorecard: intent legality / impact scope / reversibility / supervision loop) ↓

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file presents all operational guidance in Chinese and does not indicate that users or agents may choose another language. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list contains very broad terms such as '办比赛', '开赛', '评审', and '赞助', which could cause the skill to activate in loosely related or ordinary discussion rather than only in clearly scoped race-operations workflows. In an agent setting, over-broad activation can route unrelated tasks into this skill and lead to inappropriate execution paths, governance actions, or use of bundled scripts without sufficient user intent validation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The document is explicitly structured as bilingual English/Chinese content and describes team members as always declaring identity and outputs in this fixed format, but it does not indicate that users may choose another language or that the language constraint is required for a region-specific purpose. Under the policy rule, forcing a specific language/locale without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This manifest line explicitly defines trigger words, but several are generic terms that can appear in ordinary conversation outside the intended skill context. Without exclusions or tighter scoping, the skill could be invoked for unrelated discussions about reviewing or sponsorships.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Line L072 states that English-language materials are a prerequisite for internationalization and must not be Chinese-only. This imposes a language policy requirement in the skill instructions without offering a user choice or clearly limiting the skill to a region-specific or compliance-driven context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger phrase "开赛" is very generic and could be invoked during ordinary discussion rather than an explicit intent to launch the skill workflow. In a multi-skill or agentic environment, ambiguous activation can cause unintended orchestration actions, premature workflow execution, or disclosure of operational content in the wrong context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The workflow calls for publishing a public feedback summary during pre-release consultation, but it does not require sanitization of submissions or exclusion of sensitive competition details. In a competition context, this can leak participant identities, strategic input, or unreleased problem information that could undermine fairness and confidentiality.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Prize fulfillment, logistics, recordkeeping, and receipt retention inherently involve personal data such as names, addresses, phone numbers, and eligibility records, yet the skill provides no data-handling safeguards. This omission increases the risk of over-collection, unauthorized retention, accidental disclosure, or misuse of winner information.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The natural-language instructions and role description are presented exclusively in Chinese, which effectively forces a specific language for interaction. The file does include bilingual metadata fields, but the substantive operating instructions do not offer opt-in or alternative language behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown skill presents all operational instructions and role behavior in Chinese, while the manifest only provides localized display/profession labels and does not state that the skill is region-specific or Chinese-only. That can amount to a language policy violation because it effectively forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list includes very generic phrases such as '办比赛', '开赛', '评审', '榜单', and '赞助', which can easily appear in ordinary discussion unrelated to invoking this skill. This increases the chance of unintended activation, causing the agent to apply competition-operations behavior in the wrong context and potentially expose governance, scoring, or operational workflows when not requested.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The description covers many contest-related activities, but it does not clarify when the skill should not be used or how it differs from more general project, marketing, or partnership support. For a manifest/markdown skill description, this can create ambiguous activation conditions.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This usage guidance lists a wide range of contest-adjacent tasks but does not define boundaries for when the skill should not activate. The absence of negative examples increases the chance of unintended invocation for generic运营,合作, or争议-handling requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: SQP-3 applies to natural-language policy issues in any file type. The line prescribes a single standard response string in Chinese when asked identity-related questions, and it does not indicate that the response should match the user's preferred language or offer locale choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.