吊顶装修指南

• Outcome: Review
• Latest audit: Sep 6, 2026 · 3:27 AM UTC
• Version: 1.0.0

Overview

This skill is not malware, but its ceiling guide includes broad renovation advice, risky physical-modification tips, and internal budget examples that should be reviewed before installation.

Install only if you are comfortable with a ceiling guide that may answer broader home-renovation questions. Treat structural, balcony, HVAC, electrical, plumbing, waterproofing, and exterior-facade suggestions as planning notes only, and require licensed professionals plus local property/code approval before acting. The publisher should narrow the corpus or relabel the skill as a broader renovation guide and redact the named budget examples.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The referenced content is materially misaligned with the skill’s declared purpose of ceiling decoration guidance, instead focusing on wall-mounted air conditioner installation. This creates a scope-integrity problem: users or downstream agents may retrieve irrelevant advice, causing unsafe or low-quality renovation decisions when they rely on the skill as an authoritative ceiling-design resource.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The reference file is materially misaligned with the skill’s declared domain of ceiling-decoration guidance and instead contains promotional content about kitchen air-conditioning. This can contaminate retrieval or grounding behavior, causing the agent to answer users with irrelevant or unsafe renovation advice, especially where ceiling design, HVAC routing, and kitchen electrical/workmanship decisions intersect.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The referenced content is about kitchen cabinet customization, while the skill manifest claims the skill is dedicated to ceiling renovation guidance. This mismatch can cause the agent to retrieve and present irrelevant guidance, reducing trustworthiness and potentially leading users to make wrong renovation decisions based on unrelated material.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The reference content is about bedroom cost-saving tips, while the skill is declared as a suspended-ceiling renovation guide. This domain mismatch can cause the agent to retrieve and present irrelevant guidance, leading users to make inappropriate renovation decisions and reducing trust in the skill’s outputs.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file content is about balcony renovation and usage ideas, while the skill manifest says the skill is specifically for ceiling-decoration guidance. This mismatch can cause the agent to retrieve and present irrelevant advice, reducing reliability and potentially misleading users making renovation decisions in a specialized domain.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The file content is about whole-home customization workflows, cabinetry planning, and renovation sequencing rather than the declared ceiling-decoration-specific scope. This scope drift can cause the agent to provide irrelevant or overbroad renovation guidance, increasing the chance of misleading users, violating least-privilege/content-minimization expectations, and weakening trust boundaries around what the skill is supposed to handle.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file’s content is materially out of scope for a skill declared as a ceiling-decoration guide, covering wardrobes, cabinets, sofas, appliances, curtains, lighting, and soft furnishings instead. This creates instruction-integrity risk: the agent may answer outside its advertised domain, undermining least-privilege/scoped-behavior expectations and increasing the chance of unsafe or low-quality guidance in unrelated areas.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This reference file materially exceeds the declared吊顶装修指南 scope by embedding a broad full-home pricing and budgeting knowledge base, including water/electrical work, demolition, custom cabinetry, and whole-project totals. In a user-facing skill, this can cause unauthorized domain expansion, mislead users about the skill’s intended use, and increase the chance that sensitive internal business knowledge is exposed through responses.

Context-Inappropriate Capability

Low

• Confidence: 94% confidence
• Finding: The file contains identifiable case-study community names tied to internal budget samples, even while the content itself warns they should not appear in user outputs. This creates a real data exposure risk because retrieval or prompt leakage could reveal internal client/project references, which may disclose proprietary business intelligence or customer-associated information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The content gives detailed, actionable guidance for modifying air-conditioner exterior-unit spaces, including enclosing areas, adding platforms, changing windows, storage conversions, pet enclosures, and laundry installations, but it provides no meaningful safety, code-compliance, structural-load, fire, ventilation, drainage, waterproofing, or property-management disclaimer. Readers could interpret these examples as generally safe DIY recommendations and perform unsafe alterations that affect building façades, egress, equipment servicing, or exterior-unit operation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This section gives actionable electrical and plumbing modification advice such as reversing outlet orientation, using outlet relocation connectors, extending/altering drain connections, removing drain cores, and rerouting wiring, but provides no safety warning or recommendation to use a licensed electrician or plumber. In a home-renovation guidance skill, users may treat these as DIY instructions and attempt unsafe work that can cause shock, fire, leaks, sewer gas ingress, water damage, or code violations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The content explicitly advises users to remove balcony sliding doors to make the living room look larger, but gives no structural, waterproofing, thermal, fire-safety, or property-management compliance warning. In a home-renovation skill, users may act directly on this guidance; if the balcony is part of the building envelope or subject to code/property restrictions, the advice can lead to safety hazards, water intrusion, HVAC inefficiency, and regulatory violations.

Static analysis

No suspicious patterns detected.