Back to skill

Security audit

瓷砖木地板选购指南

Security checks for vulnerabilities and agentic risk

Overview

This is a static Chinese renovation-advice skill with no code execution, but its advice is broad and should be treated as opinionated guidance.

Install only if you want a Chinese, opinionated renovation reference. For structural changes, waterproofing, electrical work, chemical cleaning, indoor-air concerns, or major spending decisions, treat the skill as a starting point and confirm with local codes and qualified professionals.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (341)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/ref-014.md (reported line 7)May include surrounding context.

md
网友@四口之家:这回相信媳妇了!装修黑白灰,整个深色的地砖说是有高级感,大白天停电,电卡找不着了,这房子你就住吧,一住一个不吱声!
第五、R角瓷砖网友@虎狼之词:瓷砖R角非常严重,尤其是美缝后,想砸了重铺,找卖瓷砖的人家说一分价钱一分货,这个不属于质量问题
网友@敦煌之彩:没有想到亮光瓷砖竟然也有R角问题,越看越难受。
网友@阿骨打:验收的时候也看不出来异样呀,咋一贴上就塌边R角这么明显了,还对不上缝,问商家也只是含糊其词,只能说大家还是要谨慎选择品牌!网友@烟机灶:装修时光顾着大地砖了,没想到墙砖也有这么严重的R角,结果找商家只负责退换货,但是贴了这么多,拆除和重贴的费用需要自己承担。第六、水波纹瓷砖亮面砖的“照妖镜”,光线反射扭曲如水面的波纹一般。鉴别方法:看反光,窗户映照在砖面上会变形凹面或者凸面,当凹变形与凸变形的两个边铺贴在一起时,会导致砖与砖之间的高低落差较大,从而形成水波纹。‌网友@西湖美景:请了保洁打扫了卫生,今天去看了下,水波纹更明显了,每个窗户的倒影都泛了涟漪,在家就能欣赏湖上泛舟的美景……难怪上次我说要铺地膜保护地面,老板说“没必要,说你家又不是多好的砖……网友@余华:高价买来的瓷砖 这波光粼粼的水…地面 让我怎么和自己和解,崩溃真的崩溃啊…第七、辊棒印瓷砖辊棒印比R角更为明显,大多会出现两道以上的平行痕迹。鉴别:自然光下侧视边缘,有并排凹陷即中招。网友@包法利:没想到翻车如此,联系厂家之后过来质检,告诉我砖质量没有问题不予处理。离了大谱网友@释迦牟尼:入住后发现全屋瓷砖都有肉眼可见的R角和棍棒印,第一时间拍照并联系了商家,商家却以符合国标为由敷衍第八、大尺寸瓷砖土豪适合,老百姓后期家具和软配都没有钱,用大规格瓷砖是自己给自己挖的坑,后期一旦没钱搭配好的家具和软配,前期大规格瓷砖的面子钱全部打了水漂。网友@雨下个不停:后悔没有贴柔光砖,全屋亮光砖真的显廉价,更后悔用了大规格瓷砖,结果没有做同色美缝,感觉减少缝隙没有意义,恨不能告诉别人,自己买大砖贵一样,反而更俗气。网友@污水厂:装修没有后悔药,有下一次坚决不用大规格瓷砖,不用灰色瓷砖,不用亮光瓷砖,不做多余吊顶,不做累赘客厅布帘,不要灰色的沙发掏钱铺了1500*750的瓷砖,但是毫无高级感,不论是颜色还是硬装都是浓浓的廉价感,这样的装修除过建材堆积和面子装修,真的看不到任何装修的价值。普通老百姓装修本身没钱,就没有必要学别人用“贫瘠”堆积充面子装修了,采用普通规格瓷砖,同色美缝,省钱也能达到效果,剩余的钱用到家具和软配,这才能让整体更有档次,才能体现品味和装修的价值。也可以采用800*800木纹砖同色美缝达到木地板的效果,更耐用,成本更低,省下钱用来满足后期家具和软配档次的提高,这个才是装修的价值。后记:以上8种瓷砖是大部分人踩坑总结的经验,大家可以不必执着于自己的审美,多看看前人的眼泪,这才是捷径和价值。
※装修课堂10年内容索引,点击阅读※

瓦工避坑,11个瓷砖铺贴要点!

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/ref-048.md (reported line 3)May include surrounding context.

md
# 120㎡通铺大规格木纹砖,没想到效果也这么好

‍‍原木风的主色调为白色➕木色白色作为背景色,占比50%作用于墙面,柜子和门墙面以浅色为主,颜色暖暖的,效果不错!门的颜色可以调色跟柜子颜色做对比,尽量做到颜色统一!木纹砖选择的是平面哑光肌肤釉,普通的拖把就可以拖的很干净客厅双眼皮边吊走一圈,下吊25cm,宽30cm,错层4公分,好看还不压层高客厅的开间是3.5米,把通往阳台的推拉门去掉,拗不过家人包了门套,整体空间看起来宽敞又明亮!600×1200的木纹砖,好多邻居来参观都误以为是木地板 ,大家选择木纹砖一定不要选那种只有一个版面的,版面太少看起来不自然,太多看起来太杂,6到8个比较合适!木纹砖原木风对于刚需房非常友好,能让小空间更温馨,而且可以整体降低造价定制柜主色为暖白色,开放格为木色,房门,踢脚线跟墙面颜色一致,视觉统一和谐没有做复杂的背景墙,简单双眼皮边吊走一圈,乳胶漆墙顶通刷家具选择多以实木成品为主,颜色温润有质感绿色沙发长度2.8米,没有要茶几
5头的棉花吊灯,奶呼呼的很好看,水电阶段没有在床头两边留线所以安了免布线的壁灯!1.8×2米的樱桃实木床+藤编元素床头柜窗帘用的奶油色棉麻布+白色十字纹麻料纱砸掉原本的飘窗改绿植角,放上几盆自己喜欢的花花草草,小房间氛围感满满!樱桃木实木床头简单实用,视觉上不会有压抑感靠窗小书柜满足少量置物,床头壁灯营造氛围感

简单双眼皮走一圈+窗帘盒衣柜没有要一门到顶,做的分段式衣柜+同色拉手地面600✖️1200木纹砖通铺

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/ref-388.md (reported line 66)May include surrounding context.

md
# 120㎡通铺大规格木纹砖,没想到效果也这么好

‍‍原木风的主色调为白色➕木色白色作为背景色,占比50%作用于墙面,柜子和门墙面以浅色为主,颜色暖暖的,效果不错!门的颜色可以调色跟柜子颜色做对比,尽量做到颜色统一!木纹砖选择的是平面哑光肌肤釉,普通的拖把就可以拖的很干净客厅双眼皮边吊走一圈,下吊25cm,宽30cm,错层4公分,好看还不压层高客厅的开间是3.5米,把通往阳台的推拉门去掉,拗不过家人包了门套,整体空间看起来宽敞又明亮!600×1200的木纹砖,好多邻居来参观都误以为是木地板 ,大家选择木纹砖一定不要选那种只有一个版面的,版面太少看起来不自然,太多看起来太杂,6到8个比较合适!木纹砖原木风对于刚需房非常友好,能让小空间更温馨,而且可以整体降低造价定制柜主色为暖白色,开放格为木色,房门,踢脚线跟墙面颜色一致,视觉统一和谐没有做复杂的背景墙,简单双眼皮边吊走一圈,乳胶漆墙顶通刷家具选择多以实木成品为主,颜色温润有质感绿色沙发长度2.8米,没有要茶几
5头的棉花吊灯,奶呼呼的很好看,水电阶段没有在床头两边留线所以安了免布线的壁灯!1.8×2米的樱桃实木床+藤编元素床头柜窗帘用的奶油色棉麻布+白色十字纹麻料纱砸掉原本的飘窗改绿植角,放上几盆自己喜欢的花花草草,小房间氛围感满满!樱桃木实木床头简单实用,视觉上不会有压抑感靠窗小书柜满足少量置物,床头壁灯营造氛围感

简单双眼皮走一圈+窗帘盒衣柜没有要一门到顶,做的分段式衣柜+同色拉手地面600✖️1200木纹砖通铺

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The referenced file is materially outside the declared scope of the skill: it discusses home-buying decisions and old-apartment tradeoffs rather than tile and wood-floor purchasing guidance. This creates a context-integrity problem where the agent may retrieve and present irrelevant or misleading advice to users, reducing trust and potentially causing harmful decisions if users rely on the skill for specialized renovation guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file explicitly instructs the skill to avoid an AI tone and use the voice of '西安装修课堂' in colloquial Chinese. This imposes a language/locale style on all responses rather than offering the user a choice, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The usage section repeats that outputs should use the '西安装修课堂' everyday-living tone, which effectively hard-codes a locale-specific natural-language style. Because the file does not state that users can opt into another language or register, this is a policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file contains user-facing natural language that forces a specific language/locale experience. Under the policy, language constraints should either provide user opt-in or be clearly documented as region-specific and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This markdown file is written entirely in Chinese and provides no indication that the skill offers language selection, translation, or an opt-in for Chinese-only operation. Under the stated policy, forcing a specific language without user choice or clear region-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file presents all instructions and guidance exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into this language. Under the policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The entire skill file is written exclusively in Chinese and does not offer any language or locale choice. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The entire skill file is written in Chinese and does not indicate that language selection is optional or that the content is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The entire skill reference content is written exclusively in Chinese and provides no indication that language choice is optional or constrained by a documented regional purpose. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

This markdown file is entirely written in Chinese and presents the skill/content in a single fixed language with no indication of language choice, translation option, or user opt-in. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The entire skill file content is written exclusively in Chinese and presents its guidance in that language without any indication of user language selection or opt-in. Under the policy, a file can be flagged when it imposes a specific language or locale without giving the user a choice or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file presents all user-facing content in a single language and does not provide any opt-in, alternative locale, or justification for restricting the skill content to Chinese. Under the policy rule, forcing a specific language without user choice is a natural-language locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The entire file is written in Chinese and provides no indication that language selection is optional or that the content is intentionally restricted to a Chinese-speaking audience. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown content forces a specific language/locale presentation throughout the file and does not offer any user choice, translation note, or documented region-specific justification. Under the policy, language-specific content without opt-in can constitute a natural-language locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This markdown file presents all user-facing content exclusively in Chinese and does not offer any language selection, fallback, or indication that the skill is intentionally limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file presents all user-facing content in a single forced language and does not indicate that the user can choose another language or locale. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is reportable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This markdown file presents all user-facing content in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire skill content is written in Chinese and provides no indication that language selection is optional or that the skill is intentionally restricted to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file is entirely written in Chinese and provides no indication that language selection is optional or that the locale restriction is justified. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The entire skill content is written in Chinese and presents its guidance only in that language, with no indication of language choice, translation option, or justified region-specific scope. This can violate language/locale policy when a skill implicitly requires one language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file presents all user-facing natural-language content exclusively in Chinese and does not offer any language selection, translation note, or opt-in. For a general reference skill, forcing a single language without documented justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The entire skill content is written in Chinese and provides no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.