Exponential Growth System

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:35 AM UTC
• Version: 1.0.0

Overview

This skill is a Chinese-language knowledge journaling and growth-methodology package that writes local project files, with no evidence of hidden execution, exfiltration, or system persistence.

Install only if you are comfortable with Chinese-language instructions and local workspace files being created or appended. Review the generated knowledge files before sharing, exporting, publishing, or connecting any scheduled automation, because growth logs may contain task history or sensitive user context.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a conceptual methodology/system for AI agent growth, emphasizing processes like tool selection, error pattern libraries, knowledge consolidation, and capability productization. The supplied code does not implement that methodology or any substantive logic related to those areas. Instead, it is a simple utility script for updating a markdown journal file with a daily progress entry. This is a materially different primary purpose: log maintenance rather than an agent-growth framework. The file-system write behavior and CLI-driven logging are also undeclared in the description. Therefore, this is a clear description-behavior mismatch.

Ae1

High

• Category: analysis-evasion

Content

node scripts/update_evolution.js \

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/update_evolution.js \

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The README content is entirely in Chinese and does not indicate that users can choose another language or that the locale restriction is intentional and justified. Per SQP-3, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The script's console messages, generated markdown content, and date labels are all hard-coded in Chinese, including the persisted templates written to disk. This imposes a specific language/locale on all users without opt-in or justification, which matches the natural-language locale policy violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code emits mandatory user-facing CLI errors and usage text only in Chinese, and the rest of the output messages are also Chinese. That creates a natural-language policy concern because the skill enforces a specific language without user opt-in or any documented locale justification.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The natural-language instructions, examples, and descriptions are all presented in Chinese, which effectively forces a specific language for users of the skill. SQP-3 applies to all file types and flags language policy issues when no user opt-in, alternative language, or justified locale constraint is provided.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The export/import workflow encourages moving an accumulated knowledge base between agents without warning that the data may contain secrets, user content, operational history, or environment-specific metadata. This creates a realistic risk of unintentional sensitive-data disclosure or propagation across agents, files, or external systems.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: This section semantically promotes cross-agent transfer of accumulated knowledge, which in practice may bundle prior task data, user-provided inputs, troubleshooting logs, and other sensitive context. In a skill specifically about systematic knowledge capture and reuse, that context makes the transfer path more dangerous because the collected corpus is likely to be broad, persistent, and only weakly filtered.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The package metadata uses Chinese-only natural language in the description and author fields, which can imply a fixed language context without offering users a language choice or documenting that the skill is intentionally region- or language-specific. Under the stated policy, language constraints should be opt-in or clearly justified.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: This markdown file documents an initialization command and then states that it will create several files in the user's project area. Under the markdown-file criteria for SQP-2, behaviors affecting user data or system state should be disclosed with a warning, but the text presents the writes as routine setup without any caution about overwriting or changing local files.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The skill instructs users to run initialization and skill-creation scripts that create directories and files in the workspace, but it does not clearly warn that these commands will modify the local project state. In an agent context, undocumented write behavior can lead to unintended file creation, pollution of repositories, or accidental overwriting when the operator assumes the commands are read-only or advisory.

Static analysis

No suspicious patterns detected.