多 Agent 混合层级隔离架构 1.0

• Outcome: Review
• Latest audit: May 29, 2026 · 9:23 PM UTC
• Version: 1.0.0

Overview

This is a mostly coherent multi-agent workflow skill, but it gives a media agent broad public-posting/tool authority and persistent memory duties without enough confirmation or privacy controls.

Review before installing. Back up and diff existing SOUL.md files, narrow the media agent's baoyu-* permissions to only the tools you actually need, require an explicit confirmation before any public post, and set rules for what may be written to memory files and how those records can be deleted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documented architecture claims layered and isolated task routing, but the decision rules explicitly allow users to bypass the coordinator and send work directly to the specialized agent. That weakens separation-of-duties and review guarantees, creating a path for unreviewed actions or prompt injection to reach a higher-privilege or tool-capable agent without the intended mediation.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The file presents the system as using physical/logical isolation and authority constraints, yet later permits direct @小媒 invocation and explicit bypass of normal process for urgent tasks. This mismatch is dangerous because operators may rely on stated isolation properties that are not actually enforced, leading to incorrect trust assumptions and easier cross-boundary task execution.

Description-Behavior Mismatch

Low

• Confidence: 91% confidence
• Finding: The skill instructs the agent to persist per-task records into local memory files, which creates a retention channel for user prompts, operational details, and potentially sensitive data. In a purportedly isolated multi-agent architecture, undocumented persistent storage weakens isolation guarantees and increases the risk of cross-task data leakage or unintended reuse.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README instructs users to back up and then replace SOUL.md files and restart the gateway, but it does not require users to review the new policy content or confirm that the overwrite is safe for their environment. In an agent system, SOUL.md appears to define behavioral and permission constraints, so replacing it wholesale can silently change trust boundaries, delegation rules, or access to sensitive skills.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The documented workflow includes publishing content to a public WeChat account without clearly warning that this may send data to an external service or expose user/business content. That can lead to unintended disclosure, accidental publication, or privacy/compliance issues if users treat the example as a harmless local workflow.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation keywords are broad, generic terms such as '架构设计', '任务分配', and '为什么', which can match ordinary conversation and unintentionally trigger the skill. This can cause the agent to enter an unexpected workflow, route tasks incorrectly, or apply persistent behaviors without the user explicitly opting in.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs agents to persist task data to local files such as `memory/YYYY-MM-DD.md` and `MEMORY.md` without any clear user notice, consent flow, data minimization rule, or retention policy. This creates privacy and data leakage risk because sensitive prompts, outputs, or metadata may be stored durably beyond the user's expectations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The architecture explicitly permits "紧急 bypass" and grants the Media agent direct image-generation and publishing capabilities, but it does not define hard technical guardrails, approval criteria, or user-visible warnings for when those powers may be used. In an agent system, vague emergency exceptions are a common path to policy bypass, unauthorized actions, and unintended disclosure or publication, especially because the same document emphasizes flexible routing and direct execution under urgent conditions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly authorizes direct posting to external social platforms, but it does not require a clear warning that these actions are externally visible, may affect linked accounts, and can be difficult or impossible to fully undo. In an agent setting, this creates a real risk of accidental unauthorized publication, reputational harm, privacy leakage, or misuse of connected credentials.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The template allows the agent to immediately execute urgent, simple, or directly addressed publishing tasks without a confirmation gate. Because social-media posting is an irreversible external side effect, removing a required review/approval step materially increases the chance of accidental posts, prompt-injection-driven misuse, or attacker-triggered publication through ambiguous user phrasing.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The prompt requires persistent task logging without any user-facing notice or consent mechanism. This can cause silent storage of user content, including sensitive requests or identifiers, creating privacy and compliance risks even if the logging was intended for quality improvement.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Recording each task execution without sensitivity limits or minimization can capture secrets, personal data, confidential business information, and internal workflow context. Persistent accumulation of such records materially increases exposure in the event of unauthorized access, model reuse, or cross-agent/context leakage.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.