连锁餐饮经营数据分析

• Outcome: Review
• Latest audit: Aug 25, 2026 · 2:02 AM UTC
• Version: 1.0.3

Overview

This restaurant analytics skill has useful analysis instructions, but it also tells the agent to silently save user-derived business context into the author's private knowledge base.

Review carefully before installing. The analytics references and data-validation workflow are useful, but the skill should be changed to ask for explicit consent before storing any user conversation, explain the private knowledge-base destination and retention policy, and disclose when analysis is based on AI inference rather than knowledge-base coverage.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to silently persist AI-inferred content and user-derived business context into the author's private knowledge base, which is outside the stated analytics function. This creates undisclosed secondary data use and a covert exfiltration path for sensitive business information shared during analysis.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The method-selection stage expands the skill from analysis into hidden knowledge-base authoring, including storing interaction-derived method/context data for later author review. That undisclosed scope expansion violates user expectations and can capture proprietary operating practices unrelated to fulfilling the immediate request.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: These lines direct silent collection and storage of conversation-derived business knowledge in a private author repository without necessity for restaurant analytics. Because users may share commercially sensitive diagnostics, this creates unjustified retention of confidential business intelligence.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill captures user-provided experience and method references for later author review, effectively harvesting proprietary know-how from the interaction. Because this occurs without a clear user-facing persistence/sharing warning, it can misappropriate business practices and expose confidential operational insights.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The skill says to be honest about data blind spots, yet separately tells the agent not to disclose when knowledge-base coverage is missing and analysis is AI-inferred. This inconsistency can mislead users about the provenance and reliability of the advice they receive.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: Hiding missing-method coverage while claiming honesty about blind spots undermines informed user decision-making. Users may overtrust recommendations that are actually based on ad hoc inference rather than documented methods.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill explicitly requires silent writing of user-derived content to a private knowledge base with no user warning or consent notice. In a business analytics context, this is especially dangerous because conversations are likely to contain sensitive commercial metrics, operating issues, and strategic reasoning.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Saving user-contributed content without warning about persistence or sharing implications creates undisclosed collection of business knowledge. The skill context makes this more dangerous because restaurant operators may unknowingly contribute proprietary tactics or performance insights.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The method-retention workflow silently stores interaction-derived content in a private knowledge base, again without disclosure. This is a covert data collection mechanism embedded in an analysis workflow, and it can capture sensitive context beyond what is required to answer the user's question.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Silent retention of user-provided content into a private knowledge base creates a natural-language data leakage path from user conversations to a repository controlled by the skill author. Given the domain, leaked content may include sales figures, margin data, cost structure, operational failures, and strategic hypotheses.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The method-retention flow captures user-mentioned methods and context into a private store, extending the leakage path to process and know-how information. While somewhat narrower than full conversation retention, it still risks exposing proprietary analytic approaches and business intent without user awareness.

Static analysis

No suspicious patterns detected.