Back to skill

Security audit

家具软装选购与搭配

Security checks for vulnerabilities and agentic risk

Overview

This is a static Chinese furniture and soft-furnishing advice skill with no code execution, credential use, persistence, or hidden agent-control behavior.

Install this if you want Chinese-language furniture and soft-furnishing selection guidance. Treat it as renovation and shopping advice, not a substitute for professional design, electrical, gas, structural, waterproofing, child-safety, or furniture-restoration assessment.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (19)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file is entirely written in Chinese and presents the skill content in a single fixed language, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking or China-specific audience. Under the natural-language policy rule, forcing a specific language without user opt-in is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file contains only Chinese-language user-facing content and provides no indication that the skill is region-specific or that users can opt into this locale. Under the policy, forcing a specific language without user choice or justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown content appears to assume and enforce a single language/locale for all users. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The entire skill content is presented exclusively in Chinese and does not indicate any user choice of language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The content recommends using abrasive steel wool and applying oils/wax to repair heat and burn marks on finished wood furniture without warning about finish compatibility, abrasion risk, or the possibility of worsening the damage. In a consumer guidance skill, users may follow these steps directly and unintentionally strip finishes, discolor surfaces, or create secondary safety issues if inappropriate materials are used.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file contains user-facing natural language content exclusively in Chinese and does not offer an alternative language or indicate that the skill is intentionally region- or locale-specific. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file presents all instructions and guidance exclusively in Chinese, with no indication that users can choose another language or that the locale restriction is intentional. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The entire file is written in Chinese and does not indicate that the skill is region-specific or that users may choose another language. Under the policy rule for language/locale constraints, this is a natural-language policy concern because the content implicitly enforces a single language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file is natural-language content, so policy checks apply. The content is entirely Chinese while not indicating that the skill is intentionally region- or language-specific, which can violate a language/locale policy if users are not given an opt-in or alternative.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This markdown file is predominantly written in Chinese, but includes standalone English phrases such as "Golden Age of inspirations" and "MAGAZINF" without context or any indication that mixed-language output is intended. That can violate a language-consistency policy when no user opt-in or documented locale justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file contains user-facing natural-language content only in Chinese, and there is no indication that the skill offers alternate language support or that it is intentionally limited to a Chinese-speaking region or audience. Under the language/locale policy rule, forcing a single language without opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file presents all user-facing content in a single language without any opt-in, alternative language option, or justification for the locale restriction. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This markdown file is predominantly written in Chinese, but line L21 abruptly switches to English phrases without any user opt-in or documented reason. That creates a natural-language policy concern under locale consistency because the content forces a different language unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file presents all substantive instructions and descriptions in Chinese, and does not offer any alternative language, translation note, or user choice. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be considered a locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file presents all user-facing content in a single language and does not offer an explicit language or locale choice. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file consists entirely of Chinese-language user-facing content and provides no indication that other languages are supported or that Chinese is an intentional user-selected option. Under the stated policy, forcing a specific language without opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

This markdown content presents all instructions in a single language and does not indicate that Chinese is optional or required for a justified regional use case. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all user-facing content only in Chinese and does not provide any opt-in, alternative language, or justification for a Chinese-only constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file contains user-facing natural language exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into this locale. Under the policy criteria, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.