Strict Father

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 1.0.0

Overview

The skill’s core self-analysis purpose is coherent, but its installer can run mutable remote code and it asks to save and reuse sensitive birth-profile data without enough user control.

Review this skill carefully before installing. Do not run the one-line curl-to-bash installer unless you are willing to execute whatever is currently on that GitHub branch; prefer installing only reviewed local files and pinning dependencies. Also consider whether you are comfortable giving and storing birth details and receiving recurring or third-party-platform reminders based on that profile.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:8

Finding

Execution of Mutable Remote Installation Payloads

Content

View full analysis

/dev/null && [ "$TARGET" != "openclaw" ]; then cd "$SKILL_DIR" && npm init -y --quiet 2>/dev/null && npm install iztro --quiet 2>/dev/null fi ``` ### Technical Analysis The installation command downloads a shell program from the mutable `main` branch of a personal GitHub repository and passes it directly to Bash. The user has no opportunity to inspect the downloaded content, and the command performs no checksum validation, signature verification, or immutable commit pinning. Even if the repository currently contains the reviewed installer, the payload executed by a future user is determined at installation time rather than audit time. A repository owner, compromised maintainer account, compromised upstream repository, or malicious future commit could replace the installer after this package has been reviewed. The installer compounds this exposure by downloading mutable cop ...[truncated 1870 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:383

Finding

Mandatory Third-Party Promotion in Agent and Scheduled Outputs

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: install.sh:44

Finding

Unpinned npm Dependency Installation with Lifecycle Scripts Enabled

Content

View full analysis

/dev/null && [ "$TARGET" != "openclaw" ]; then cd "$SKILL_DIR" && npm init -y --quiet 2>/dev/null && npm install iztro --quiet 2>/dev/null fi ``` The package manifests use a version range: ```json "dependencies": { "iztro": "^2.5.8" } ``` Other installation instructions also use an unpinned command: ```bash cd ~/.hermes/skills/strict-father && npm init -y && npm install iztro ``` ### Technical Analysis The `iztro` dependency is legitimately used by `scripts/calculate.js`, but its installation is not reproducible. The caret range permits npm to select later compatible releases, and no reviewed lockfile is included to pin the complete transitive dependency graph and integrity hashes. The installer dynamically creates a new package manifest with `npm init` and then resolves packages against the registry at installation time. npm lifecycle scripts are not disabled. Consequently, package or transitive-dependency lifecycle code can execute during installation with the invoking user's privileges. There is no evidence in the reviewed project that the current `iztro` package is malicious. The vulnerability is the unsafe and mutable supply-chain installation process. ### Attack Path 1. A user runs the project installer or follows the manual npm command. 2. npm resolves `iztro` and its transitive dependencies using current registry metadata. 3. The resolved versions may differ from those reviewed by the project author because the manifest uses a caret range and there is no lockfile. 4. If an accepted package version or transitive dependency is compromised, npm downloads it. 5. Any perm ...[truncated 764 chars]

Remediation

View remediation

/dev/null`. 7. Consider bundling the reviewed dependency or calculator artifact if licensing permits, thereby avoiding registry resolution during Skill installation. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (38)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The installation instructions explicitly tell users to pipe a remote script to bash with no warning, provenance verification, or opportunity to inspect the code first. This is a well-known dangerous pattern because any compromise of the upstream content or hosting account can immediately translate into arbitrary command execution on the user's machine.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The use of '| bash' chains remote content directly into a shell interpreter, eliminating the user's chance to inspect the script and greatly increasing the blast radius of any malicious modification. This is especially dangerous because the prompt normalizes the pattern as a recommended installation command, making social engineering and silent code execution more likely.

Content

Scanner excerpt · INSTALL_PROMPT.md (reported line 19)May include surrounding context.

md

然后以"严厉的父亲"角色说出你自己看不到的盲区。

安装方式：
  curl -fsSL https://raw.githubusercontent.com/0xcii/strict-father/main/install.sh | bash

装好后在对话中跟我说：
  /skill strict-father

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The installation instructions tell users to execute a remote script directly with curl piped into bash, which bypasses inspection and executes arbitrary code from a network source on the user's machine. If the remote content, repository, or delivery path is compromised, users can suffer immediate system-level compromise.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Piping downloaded content directly into bash is a classic command-chaining abuse pattern that removes user review and makes arbitrary command execution one step away from a malicious or tampered script. In the context of an AI skill install command, this is especially risky because users may trust and paste it without understanding the privilege and persistence implications.

Content

Scanner excerpt · INTRO.md (reported line 92)May include surrounding context.

👇 现在就装

bash

curl -fsSL https://raw.githubusercontent.com/0xcii/strict-father/main/install.sh | bash

装好后跟 AI 说：/skill strict-father

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Piping downloaded content directly into bash removes the user's opportunity to inspect what will run and turns a network fetch into immediate code execution. In a skill-installation context, this is especially dangerous because users expect convenience and may run the command with their normal account permissions, enabling full compromise of local files, credentials, and agent configuration.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

一键安装

bash

curl -fsSL https://raw.githubusercontent.com/0xcii/strict-father/main/install.sh | bash

手动安装（Hermes）

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: strict-father
description: "严厉的父亲 — 基于紫微斗数12宫框架的残酷真相诊断器。结合AI对你的记忆，用命盘12宫做结构化分析，说出你自己意识不到的盲区。"
version: 1.1.0
author: @yongzhuan_bot
license: MIT
tags:
  - 紫微斗数
  - 个人成长
  - 命理
  - 自我认知
  - AI诊断
triggers:
  - 用户请求深度自我分析
  - 用户想了解自己的盲区
  - 用户需要"残酷真相"
  - 用户反复问同一个方向性问题
  - 用户想知道自己为什么困在原地
---

# 严厉的父亲 · Strict Father

> 你不需要安慰。你需要�

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill requests full birth date, time, and location, which are highly sensitive personal attributes, yet provides no clear notice about privacy, retention, sharing, or deletion. Users may disclose information that can be used for profiling or identity correlation without understanding how it will be handled.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs the system to retain and later recall a user's chart data across conversations, but does not warn the user that sensitive derived data will persist. Persistent storage of intimate profile data without explicit consent materially increases privacy and misuse risk.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Using 'curl ... | bash' executes remote code immediately without inspection, creating a classic supply-chain and remote code execution risk. If the repository, network path, or hosting account is compromised, users can run arbitrary commands on their machine.

Content

Scanner excerpt · SKILL.md (reported line 441)May include surrounding context.

bash

# 一键安装
curl -fsSL https://raw.githubusercontent.com/0xcii/strict-father/main/install.sh | bash

# 或手动安装
mkdir -p ~/.hermes/skills/strict-father

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The prompt instructs users to install the skill by piping a remotely hosted script directly into bash, which enables arbitrary code execution from a mutable external source without review, pinning, or integrity verification. That is unjustified by the stated astrology/self-diagnosis purpose and creates a supply-chain compromise path if the repository, account, or network path is tampered with.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The prompt directs the assistant to collect full birth date, time, and location, then explicitly says later uses should work “without re-entering” that information, implying retention and reuse of sensitive personal data. While not the most sensitive category in all jurisdictions, birth details are personal data that can contribute to profiling, identity verification abuse, and privacy harms if stored or reused without clear consent and data handling limits.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The follow-up trigger phrases are broad and conversational, especially phrases like “爸爸在吗？” or “严厉父亲模式”, which may accidentally activate the skill in normal discussion. Unintended invocation can cause surprising behavior and, in this context, may lead to reuse of previously collected sensitive birth data without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly asks users to submit full birth date, birth time, and city, which is sensitive personal data that can enable profiling and identity correlation. There is no privacy notice, data handling explanation, retention policy, or consent language, so users are encouraged to disclose sensitive information without understanding how it will be used or stored.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README directs users to execute a remotely fetched shell script via curl ... | bash without any integrity verification, pinning, review step, or warning. This creates a direct remote-code-execution path where a compromised GitHub account, modified branch, CDN/intermediary issue, or malicious script update can execute arbitrary commands on the user's system.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 31)May include surrounding context.

bash

# 安装技能
mkdir -p ~/.hermes/skills/strict-father
cp SKILL.md ~/.hermes/skills/strict-father/

# 安装排盘脚本（可选）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 31)May include surrounding context.

bash

# 安装技能
mkdir -p ~/.hermes/skills/strict-father
cp SKILL.md ~/.hermes/skills/strict-father/

# 安装排盘脚本(可选)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 43)May include surrounding context.

手动安装（Open Claw）

bash

mkdir -p ~/.claude/skills
cp SKILL.md ~/.claude/skills/strict-father.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 459)May include surrounding context.

手动安装（Open Claw）

bash

mkdir -p ~/.claude/skills
cp SKILL.md ~/.claude/skills/strict-father.md

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill requires users to provide birth date, birth time, and sex, which are sensitive personal attributes that can increase identifiability and enable profiling. The README does not disclose how this data is processed, stored, transmitted, or retained, leaving users without informed consent about privacy risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The entire skill is written to operate in Chinese, including trigger phrases, prompts, and output examples, with no indication that the user may choose another language. This is a natural-language policy concern because the skill effectively forces a specific language experience without opt-in or justification of a region-specific requirement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad natural-language conditions like asking for self-analysis or wanting to know blind spots. Such vague triggers can cause accidental activation in unrelated conversations, leading the agent to switch into a harsh diagnostic mode and solicit sensitive information without clear user intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill states that no analysis should be performed without accurate birth data, but later introduces a fallback that infers palace mappings from behavior alone. This inconsistency can mislead users about the basis and reliability of the analysis, weakening informed consent and making the system behave unpredictably.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The follow-up guidance allows activation from very broad cues, including arbitrary topic discussion with a prefixed token and recall of prior chart data. This increases the chance of unintended re-entry into a sensitive mode and reuse of stored personal data without fresh consent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction to persist and recall prior chart data across future conversations creates a stateful memory of sensitive personal and inferred psychological data. Without explicit lifecycle controls, this can expose users to unauthorized reuse, over-collection, and privacy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The daily reminder feature proposes ongoing delivery of personalized chart-based analysis to platforms like Telegram or Discord without a clear warning about exposure, platform privacy, or notification leakage. Sensitive inferences could be pushed to insecure or shared channels and seen by unintended parties.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.