Security audit

Private Domain Operator

Security checks for vulnerabilities and agentic risk

Overview

This is a WeCom marketing operations guidance skill with privacy-sensitive advice, but it is disclosed, non-executable, and aligned with its stated purpose.

Before installing, confirm that your intended use involves WeCom/private-domain marketing and that any customer ID linking, tagging, messaging, and analytics are covered by clear user notice, explicit consent or another lawful basis, retention limits, and role-based access controls.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly promotes linking WeCom user IDs with Mini Program OpenIDs to create unified customer profiles, but it does not mention notice, consent, purpose limitation, retention controls, or access restrictions. In a private-domain marketing context, this kind of cross-system identity stitching enables detailed behavioral profiling and can violate privacy expectations or regulatory requirements if implemented without transparent disclosure and governance.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The activation guidance is extremely generic: 'Reference this agent by name or specialty when you need its expertise.' In agent-routing systems, such broad trigger language can cause unintended invocation from ordinary requests about WeCom, private-domain operations, or lifecycle management, increasing the chance of overreach, prompt collisions, or unauthorized use of the skill outside a clearly scoped context.

Natural-Language Policy Violations

Low

Confidence: 76% confidence
Finding: The description explicitly centers the skill on building a 'WeChat private traffic empire,' which presumes a specific platform and associated locale context. Because the text does not indicate user choice, opt-in, or a documented region-specific justification, it may conflict with language/locale policy expectations.

Static analysis

No suspicious patterns detected.