Security audit

装修增项避雷

Security checks for vulnerabilities and agentic risk

Overview

This is a renovation cost-avoidance advice skill with static reference text and no executable, network, credential, or persistence behavior.

Installers should expect opinionated Chinese renovation advice and should treat contract, legal, safety, and product-health claims as practical guidance to verify against local professionals or official consumer-protection sources. The broad triggers may make the skill appear in some general renovation cost discussions.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list contains broad, common phrases such as “费用”, “值不值”, and “装修公司”, which can cause the skill to activate in conversations that are only loosely related to quotation traps or renovation overcharges. This increases the chance of unintended invocation, response hijacking, or irrelevant advice being inserted into general discussions about home renovation.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: The statement 'AI不会独立思考，整合的资料90%不靠谱' is a broad, unsupported dismissal of AI outputs. While not a traditional security exploit, it can bias users against legitimate safety-oriented AI guidance and encourages them to rely on inflammatory search terms instead, which may skew decision-making with unreliable or defamatory sources.

Static analysis

No suspicious patterns detected.