Security audit

精装修改造避坑指南

Security checks for vulnerabilities and agentic risk

Overview

This is a static Chinese renovation-advice skill, but some reference material gives unsafe or underqualified construction and gas-work guidance that users should not follow without professional review.

Install only if you are comfortable treating this as an unverified Chinese renovation knowledge base, not professional construction advice. Do not rely on it for gas appliances, wall removal, balcony enclosure, waterproofing, electrical work, or structural changes without licensed professionals, permits, property-management approval, and local code checks. Also expect some retained sales language and opinionated phrasing in the references.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (25)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The reference explicitly includes a recommendation phrased as a positive renovation example: '为翻新直接砸掉了承重墙' (directly knocked down a load-bearing wall for renovation). In a skill whose purpose is to help users avoid renovation mistakes, normalizing or promoting structural demolition is dangerous because users may imitate it, creating serious building safety risks, legal violations, and potential injury or death.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The reference content includes explicit shopping prompts and product recommendations such as '点击立即购买', which goes beyond informational renovation guidance and introduces commercial call-to-action behavior. In a renovation-advice skill, this can bias users toward purchases, create undisclosed affiliate or advertising risk, and expand the skill's behavior beyond its stated expert-guidance purpose.

Description-Behavior Mismatch

Low

Confidence: 94% confidence
Finding: This section contains repeated product-promotion and direct purchase prompts such as instructing users to buy via a mini-program, which shifts the skill from informational renovation guidance into commerce-oriented recommendation behavior. In an agent skill, embedded purchase nudges can create undisclosed affiliate marketing, biased advice, or social-engineering pressure that is outside the declared user-help scope.

Description-Behavior Mismatch

Low

Confidence: 95% confidence
Finding: This later section continues the same pattern of encouraging purchases of furnishings and accessories that are not necessary for a renovation pitfall-avoidance guide. While not an exploit in the traditional code-execution sense, it is a policy and trust issue because the skill may steer users toward commercial actions under the guise of expert advice.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The content describes making a DIY light fixture from a hair scrunchie, mesh, and a bare bulb, with only a brief note about heat dissipation. That warning is insufficient because readers may place flammable fabric close to hot bulbs or use the setup as a regular lamp, creating burn or fire risk in a home-improvement skill where users are likely to imitate the idea.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The instructions include cutting a large water container to make a pet bed, but omit clear warnings about sharp cut edges, safe cutting technique, and tool handling. A user could suffer lacerations during construction, and the pet could also be injured if edges are not fully smoothed and secured.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The candle-holder craft encourages assembling stones with wire or glue for use with an open flame but provides no fire-safety warning. Users may employ heat-sensitive adhesives, place the holder on unstable or combustible surfaces, or leave candles unattended, creating a realistic house-fire hazard.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The content gives detailed guidance for repurposing and enclosing air-conditioner exterior-unit spaces, including sealing openings, adding load-bearing platforms, and partially removing or altering structural elements, while providing little consistent warning about building code compliance, waterproofing, ventilation, fall protection, fire safety, or property-management approval. In a home-renovation skill, users may treat this as actionable advice and perform unsafe or unauthorized modifications that create injury risks, water intrusion, façade violations, blocked maintenance access, or hazards to HVAC equipment and neighboring units.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The content explicitly encourages readers to remove walls, balcony doors, and create new wall openings to alter layouts, but it provides no safety caveats about load-bearing structures, waterproofing, ventilation, fire code, permits, or the need for licensed professionals. In the context of a renovation-guidance skill, users may treat these recommendations as actionable instructions, increasing the risk of unsafe structural changes, property damage, and occupant injury.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The content repeatedly instructs readers to perform destructive renovation actions such as removing doors, insulation layers, tiles, walls, railings, and modifying utilities, but provides no safety warnings, permitting guidance, or recommendation to use qualified professionals. In a consumer-facing skill, this omission can encourage unsafe DIY work that may cause injury, structural damage, waterproofing failures, or code violations.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This section recommends demolition and partial wall removal in a home-renovation guidance skill without any warnings about structural limits, permits, utility isolation, waterproofing, or the need for licensed professionals. In this context, users may treat the content as actionable advice and attempt unsafe modifications that can cause injury, property damage, or code violations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The content promotes 'tear it all down and redo it' style renovation as a desirable option while omitting warnings about cost overruns, dust/asbestos risks in older properties, debris handling, and irreversible design consequences. Because the skill is framed as an anti-pitfall guide, this omission is especially risky: users may infer the approach is broadly safe and advisable.

Missing User Warnings

High

Confidence: 97% confidence
Finding: This section repeatedly endorses knocking down balcony walls, removing sliding doors, altering insulation walls, changing ceilings, adding HVAC equipment, and modifying room openings without any safety disclosures. In a renovation skill, these statements can directly normalize unsafe structural or building-system modifications, creating elevated risk of collapse, water intrusion, fire/electrical issues, HVAC hazards, and illegal construction.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The content uses sweeping derogatory language about a '中式审美' and frames it as uniformly ugly, which goes beyond design critique into disparagement of a cultural/national aesthetic. In a consumer-facing home-renovation skill, this can normalize biased or inflammatory language and damage trust, brand safety, and user experience.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The line escalates from criticizing装修 choices to insulting '上层领导,' introducing politically charged and demeaning commentary unrelated to the instructional purpose. This increases the risk of offensive output, reputational harm, and unsafe tone propagation if the skill surfaces or paraphrases the material.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The statement links criticism of a room's appearance to '祖国的花朵' and '自己的国度,' shifting from interior-design discussion into disparaging national commentary. In this skill context, that language is unnecessary to the task and can cause offense or biased responses without adding instructional value.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The content explicitly advises bypassing gas safety and utility controls by building a fake wall to pass inspection and removing it afterward, and it also normalizes installation practices that may ignore enclosure requirements. This can enable unsafe gas appliance use, defeat inspection safeguards, and increase the risk of gas leaks, carbon monoxide exposure, fire, explosion, and regulatory violations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guidance explicitly advises that a balcony does not need any waterproofing if tiles are run through and a vertical drainpipe is used, without caveats about climate, exposure, slab conditions, drainage failures, plumbing leaks, or building-code requirements. In a home-renovation skill, users may rely on this as actionable construction advice, which can lead to concealed water intrusion, damage to adjacent interior spaces, mold, and costly remediation.

Missing User Warnings

High

Confidence: 92% confidence
Finding: The document states that balcony side wall piers should be removed when possible to enlarge space, while only briefly protecting the '配重墙' below the window. This encourages readers to alter potentially structural elements without engineering review or code-compliance checks, creating a risk of reduced load capacity, façade instability, safety hazards, and illegal construction.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The file content is entirely written in Chinese and the skill metadata also targets a Chinese-language audience, with no indication that the skill adapts to the user's preferred language or locale. This can create usability and safety issues if a user cannot fully understand renovation guidance, especially for cost, contract, and construction-risk advice.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This section recommends multiple demolition and reconfiguration actions such as removing walls, externalizing wet areas, and enlarging spaces, but it does so in a how-to style without clear repeated safety gating around structural review, waterproofing, plumbing, ventilation, fire code, or local permit requirements. In a renovation guidance skill, users may treat these suggestions as actionable advice and attempt unsafe or noncompliant changes, creating risks of structural damage, leaks, or injury.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The text implies that many layout defects are acceptable because '装修可改都可以入手,' which can overstate the remediability of serious design, code, or building-system limitations. Users may rely on this advice when purchasing or planning renovations without understanding that some problems cannot be safely, legally, or cost-effectively fixed.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The content explicitly advises users to remove balcony sliding doors to make the living room feel larger, but provides no warning to verify whether the doors are part of a regulated facade, thermal envelope, waterproofing system, or subject to property-management and code restrictions. In a home-renovation skill, omission of those checks can lead users to perform or commission unsafe or noncompliant work, causing structural, safety, drainage, insulation, or legal problems.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The referenced section recommends demolition and layout-altering renovation steps such as removing doors, insulation walls, and enlarging spaces without any warning about structural limits, waterproofing, HVAC/electrical risks, property-management approval, or the need for licensed professionals. In a home-renovation skill, users may reasonably act on this guidance directly, creating a real safety risk of damaging building systems or violating code.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The content recommends multiple destructive renovation actions such as demolishing walls, changing kitchen entry layout, and modifying gas-separation arrangements, but only gives a minimal warning about confirming non-load-bearing walls. In a home-renovation skill, users may treat this as actionable guidance; without explicit requirements for structural review, building-code compliance, ventilation, fire safety, and licensed contractor involvement, it could lead to structural damage, unsafe gas setups, or injury.

Static analysis

No suspicious patterns detected.