Security audit

装修五金选购指南

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a static renovation advice skill, but it needs Review because it advertises hardware-shopping guidance while bundling broader renovation guidance with some under-qualified structural, waterproofing, plumbing, and electrical advice.

Review this skill as a broad home-renovation advice library, not just a hardware buying guide. Do not rely on it alone for structural demolition, waterproofing decisions, electrical faults, plumbing blockages, or second-hand property purchases; require local code checks, building-management approval, and qualified electricians, plumbers, waterproofing contractors, or structural professionals for those topics.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The referenced content is materially misaligned with the skill's declared purpose of hardware purchasing guidance, instead covering broad second-hand housing purchase and renovation pitfalls. This can cause the agent to answer outside its advertised scope, increasing the chance of irrelevant, misleading, or unsafe advice because users may rely on the skill for specialized 五金选购 guidance but receive generalized renovation or property-selection recommendations.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The content gives step-by-step DIY guidance to break up a suspected cement blockage using a steel wire or rebar, but it omits basic safety precautions and professional limits. This can lead users to damage drain pipes, waterproofing, or neighboring units' property, and may also create injury risk from improper tool use in a wet environment.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The content discusses removing wall elements around a balcony and even encourages removing side wall piers where possible, but does not clearly warn that structural conditions vary and that any demolition must be approved by a licensed structural professional and building management. In a home-renovation purchasing/advice skill, users may treat this as actionable guidance, creating a real risk of structural damage, code violations, or injury.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The text repeatedly states that balcony waterproofing is unnecessary if a standpipe drain is used, and frames waterproofing as outdated, without warning about differing building designs, exposure conditions, leakage paths, and code requirements. In renovation guidance, this can directly influence users to omit protective measures, increasing the risk of water intrusion, damage to adjacent interiors or neighbors, mold, and costly repairs.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The content gives DIY corrective actions for installation defects such as reinstallation, cutting, and bathroom fixture adjustment without any safety warning or instruction to involve qualified trades. Users may attempt electrical, plumbing, or structural-adjacent work based on terse instructions, increasing risk of injury, water damage, or code-noncompliant repairs. In this home-improvement purchasing/avoidance skill, the lack of guardrails makes the advice more dangerous because readers may treat it as actionable repair guidance rather than high-level reference material.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The bathroom section recommends waterproofing and drainage remediation steps such as adding barriers, redoing tile, and fixing leaks, but omits warnings that improper intervention can worsen concealed leakage, mold, structural damage, and slip hazards. Because these are wet-area failures with potentially expensive downstream consequences, concise DIY-style wording without professional escalation guidance creates a meaningful safety and property-risk issue.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The section gives users step-by-step guidance for handling an electrical trip fault, including resetting breakers after unplugging appliances, but it lacks a prominent warning that electrical faults can indicate dangerous wiring defects and should not be diagnosed or repeatedly reset by untrained users. In a home-improvement guidance skill, users may over-trust the instructions and attempt unsafe DIY troubleshooting, increasing risk of electric shock, fire, or equipment damage.

Static analysis

No suspicious patterns detected.