Back to skill

Security audit

Adaptive Problem Solver

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about its goal, but that goal includes automatically turning safety or permission refusals into workaround plans and it stores user prompt excerpts locally.

Review this carefully before installing. It does not appear to execute commands, fetch remote code, or exfiltrate data, but it is designed to intervene after safety or permission refusals and suggest workaround paths, including host commands and privilege-related options. It also keeps local plaintext records of triggering prompt excerpts and learned preferences, so avoid using it with secrets or sensitive operational details unless logging and retention are changed.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
integration-wrapper.js:50
Finding

Automatic Redirection of Safety-Related Assistant Responses

Content
View full analysis
assistantResponse && assistantResponse.includes(keyword) ); // Or detect whether the user explicitly expressed difficulty. const userExpressedDifficulty = this.problemPatterns.some(pattern => pattern.pattern.test(userMessage) ); return containsRigidResponse || userExpressedDifficulty; } /** * Generate alternative solutions and integrate them into the response. */ async generateAdaptiveResponse(userMessage, originalResponse) { console.log('🔍 检测到可能需要变通解决方案的问题'); // Analyze the problem. const analysis = this.solver.analyzeProblem(userMessage); console.log(`📊 问题分析: ${analysis.primaryConstraint} 限制`); // Generate solutions. const solutions = this.solver.generateSolutions( analysis, this.config.maxSolutions ); if (solutions.length === 0) { console.log('⚠️ 未能生成变通解决方案'); return originalResponse; } // Build the enhanced response. const enhancedResponse = this.buildEnhancedResponse( originalResponse, solutions, analysis ); // Record the intervention. this.recordIntervention(userMessage, analysis, solutions); return enhancedResponse; } ``` ### Technical Analysis The integration treats refusal-oriented phrases such as “safety protocol prohibited ...[truncated 2649 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
integration-wrapper.js:174
Finding

Plaintext Logging of User-Provided Message Content

Content
View full analysis
({ id: s.id, name: s.name })), autoDetected: true }; // Save to the log. const logDir = path.join(__dirname, 'logs'); if (!fs.existsSync(logDir)) { fs.mkdirSync(logDir, { recursive: true }); } const logFile = path.join(logDir, 'interventions.jsonl'); fs.appendFileSync(logFile, JSON.stringify(intervention) + '\n'); console.log(`📝 记录干预: ${analysis.primaryConstraint} → ${solutions.length} 个方案`); } ``` ### Technical Analysis The integration persistently stores the first 200 characters of every user message that triggers an intervention. Truncation limits record length but does not provide confidentiality or sanitization. Sensitive values are frequently placed near the beginning of a message, including API keys, access tokens, internal repository names, personal information, filesystem paths, and portions of source code. The log is written as plaintext JSON Lines under `logs/interventions.jsonl`. The reviewed code does not: - Ask for consent before retaining message content. - Redact credentials or personal information. - Set restrictive file or directory permissions. - Define a retention period. - Rotate or cap the log. - Encrypt stored records. - Prevent symbolic-link-based file redirection. - Separate logs belonging to different users. No network transmission or external exfiltration was identified. Exploita ...[truncated 1262 chars]
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (25)

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
85% confidence
Finding

The entire usage guide is written as a Chinese-only operational interface and presents trigger phrases, workflows, and outputs solely in Chinese, with no indication that users may choose another language. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Ssd 1

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guide characterizes safety-constrained responses as 'rigid' and instructs the assistant to generate workaround plans when guardrails block an action. In context, this directly reframes compliance mechanisms as problems to be solved, increasing the likelihood that the assistant will help users circumvent policy boundaries.

Content

No source excerpt is available for this finding.

Ssd 1

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The suggested trigger phrase explicitly asks whether there is a way to get around security protocol blocks. That is a direct semantic invitation to bypass protective controls, and in a skill designed to activate automatically, it materially increases abuse potential.

Content

No source excerpt is available for this finding.

Ssd 4

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is explicitly designed to avoid saying 'cannot do that' and instead produce alternate paths when blocked by safety or permission limits. In security context, that behavior systematically undermines guardrails by converting denied operations into assisted workaround plans, increasing the chance of unauthorized external actions or privilege-boundary bypass.

Content

No source excerpt is available for this finding.

Ssd 4

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The solution catalog normalizes circumvention patterns by organizing them as reusable options with success rates, time estimates, and implementation labels. This operationalizes policy evasion and makes the skill more dangerous because it systematically recommends and prioritizes bypass tactics rather than treating them as prohibited.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill documentation begins and continues in Chinese, and there is no indication that users may choose another language or that the skill is limited to a Chinese-language context. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill claims to cooperate with safety controls, but elsewhere recommends alternatives such as host-level execution and temporary privilege elevation when container restrictions block an action. That creates a policy-confusion risk: an agent may interpret environmental safeguards as obstacles to route around rather than boundaries to preserve, increasing the chance of unsafe execution outside the intended sandbox.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The automatic activation logic uses ambiguous concepts like 'rigid response' and 'safety conflict,' which can cause the skill to engage whenever a safety policy blocks an action. This makes the system more dangerous because policy enforcement itself becomes the trigger for workaround generation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manual trigger phrases are so broad that ordinary user frustration or generic help-seeking could activate the skill's workaround behavior. In a security-sensitive assistant, broad activation increases the chance of unintended escalation from a normal refusal into alternate-action planning around constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The guide says the system records user choices, feedback, preferences, and execution history, but it does not explain retention, minimization, consent, or privacy safeguards. This creates unnecessary collection and profiling risk, especially when the data could reveal user capabilities, habits, or sensitive operational context.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The optimization design directs the system to store choices, feedback, preferences, and usage history without clear minimization or boundary controls. Over time this can create a detailed behavioral profile that may be unnecessary for the skill's purpose and increases privacy and misuse risk.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The workflow formalizes a pattern of analyzing restrictions and then producing workaround options whenever limits are encountered. This proceduralizes boundary-pushing behavior, making unsafe escalation systematic rather than incidental.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide explicitly claims it will not bypass protocols, but later introduces a trigger phrase asking whether there is a way to 'bypass' security restrictions. That contradiction weakens safety boundaries and can prime the assistant to reinterpret guardrails as obstacles to work around rather than constraints to honor.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module description states its goal is to provide alternative ways to proceed under security-protocol restrictions instead of stopping. That framing is dangerous because it instructs the skill to treat safeguards as obstacles to work around, which can lead to generation of evasive instructions for actions the system is supposed to block.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file’s natural-language title, description, CLI usage, and all user-facing guidance are written exclusively in Chinese, which implies a fixed language/locale experience. There is no indication that users may choose another language or that the Chinese-only scope is a documented, justified regional constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This section explicitly catalogs workaround mechanisms such as host-machine commands, container-executed scripts, and environment-variable passing for situations framed as permission constraints. In an agent skill, those capabilities can be used to shift restricted actions onto the user or another execution context, effectively enabling policy circumvention rather than safely degrading functionality.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The problem-analysis logic classifies security protocols and inability to operate external systems as constraints to detect and then feed into solution generation. This is dangerous because it automates the identification of guarded scenarios and routes them toward workaround recommendations, increasing the reliability of policy bypass behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill's natural-language identifiers, comments, status messages, and CLI usage strings are written in Chinese throughout the file, with no indication that users can choose another language. Under the stated policy, forcing a specific language without opt-in is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The wrapper persistently stores user message excerpts, intervention metadata, and profile attributes to local disk without any visible consent, retention policy, minimization, or documented justification. This creates a privacy and data-governance risk because potentially sensitive user content and inferred preferences can accumulate in plaintext and be exposed to other local users, backups, or later tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

User messages are written to a plaintext JSONL log without any user-facing warning or consent mechanism. Because the content is derived directly from user input, it may contain secrets, internal URLs, credentials, or sensitive operational context that become recoverable from disk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The intervention logger stores plain-language user message snippets in workflow logs, directly increasing the chance that sensitive prompt content is exposed through filesystem access, log collection, support bundles, or backups. In this skill's context, the tool specifically reacts to user constraints and operational difficulties, so the logged text may include security, permission, or environment details that are particularly sensitive.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This JavaScript file uses Chinese for the doc comment, test case names, problem text, and all user-facing console output, with no indication that the skill supports other languages or that Chinese is an intentional, documented locale restriction. That creates a natural-language policy concern because the skill effectively enforces a specific language without offering the user a choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The safety section promises '完整记录所有变通决策过程', but the only concrete recording logic shown logs outcomes, feedback, timing, and timestamps after execution rather than the full decision process, alternatives considered, or risk reasoning. This is not merely incomplete implementation detail because the documentation makes a strong, explicit intent claim about comprehensive auditing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The JSON includes user-facing text values in Chinese such as "8分钟", "12分钟", and feedback text like "太复杂". Because this file provides locale-specific natural-language content without any indication of user choice or documented regional scope, it may violate the requirement not to force a specific language/locale without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The reset function clears history and the intervention log but leaves the persisted user profile file intact, which can mislead users or operators into believing all learned data was removed. This is dangerous primarily as a privacy and trust issue because residual preference and skill data remains on disk after a reset action.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.