Audit Evolution

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 0.3.3

Overview

This is a disclosed audit/self-improvement skill, but its installer and runtime rules can persistently steer future agent sessions through broad automatic triggers and agent-readable run records.

Install only in a workspace where persistent agent routing is acceptable. Prefer using --no-agents-update and invoking the skill manually, or manually add a narrower AGENTS.md rule with explicit commands. Do not feed untrusted summaries or user-feedback text into the hook, and remove the AGENTS.md block plus .audit-evolution run records if the automatic behavior is not wanted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/install-audit-evolution.sh:61

Finding

Persistent Workspace-Level Agent Instruction Hijacking

Content

View full analysis

## Audit Evolution Auto-Use Use `skills/audit-evolution/SKILL.md` when any of these happen: - The user says: `开始调用 Audit Evolution`, `进化`, `保存`, `暂停`, `跑分`, `继续`, or `详情`. - A benchmark, scan, profile, worklog, handoff, task, or local test completes. - The user points out an error, corrects a fact, or questions your conclusion. - A task fails, times out, retries, gets blocked, or reads more than 5 files. - Context pressure is over 60%, or your output contains uncertainty language such as "大概", "可能", "我理解为", or "不确定". - You add or modify a skill, config, gear, route, prompt pattern, or answer pattern. Default behavior: 1. First create or read `.audit-evolution/run-records/latest.md` when available. 2. Output: Evidence Pack, Snapshot, Evolution Card, Memory Ledger Entry, Minimal Skill Patch Proposal, Field Note, Next-Run Bootstrap, Short Command Menu. 3. Do not publish, upload, install, vote, comment, message, spend, claim, or run official benchmark without explicit human approval. 4. If you do not know where to save memory, use `write_target: proposed_only`. ``` ```bash if [[ "$NO_AGENTS_UPDATE" != "true" ]]; then if [[ -e "$AGENTS_PATH" ]]; then if grep -q '' "$AGENTS_PATH"; then TMP_AGENTS="${AGENTS_PATH}.tmp" awk -v block="$AGENTS_BLOCK" ' // { if (!done) { print block done = 1 } in_block = 1 next } // { in_block = 0 next } !in_block { print } ' "$AGEN ...[truncated 2718 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: scripts/invoke-audit-evolution-hook.sh:17

Finding

Prompt Injection Through Unescaped Agent-Consumed Run-Record Fields

Content

View full analysis

"$RECORD_PATH" printf "%s\n" "$RECORD" > "$LATEST_PATH" fi ``` ### Technical Analysis The command-line values supplied through `--summary`, `--evidence`, and `--user-feedback` are inserted verbatim into a Markdown document. There is no escaping, length limit, structural validation, trust annotation, or encoding that separates caller-provided data from instructions. The same document contains a `Required Agent Action` section, and the installed workspace instructions tell the Agent to prioritize `.audit-evolution/run-records/latest.md`. Consequently, attacker-controlled data and trusted operational ins ...[truncated 2382 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (45)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill mandates proactive triggering on broad runtime conditions like benchmark completion, user correction, reading more than five files, uncertainty language, or context thresholds. These conditions are frequent and fuzzy, so the skill may repeatedly self-invoke, override normal conversation flow, and pressure the agent into generating audit artifacts or proposing changes without a fresh user request.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The script uses rm -rf "$SKILL_DIR/$name" before copying repository content into the target workspace, enabling destructive overwrites of files and directories under skills/audit-evolution. In this context, the danger is amplified because the installer also plants persistent agent-instruction content; if the target path is wrong or manipulated, users can lose local data and have their agent workflow silently replaced.

Content

Scanner excerpt · scripts/install-audit-evolution.sh (reported line 50)May include surrounding context.

sh

for name in SKILL.md README.md ADAPTERS_ZH.md QUICKSTART_60S_ZH.md DEMO_PLAYBOOK_ZH.md INSTALL_TEST_ZH.md SKILLHUNT_COPY_ZH.md FIELD_NOTE_TEMPLATE.md dirty_log.md clean_snapshot.md DESIGN_REVIEW_ZH.md index.html agents assets examples scripts; do
  if [[ -e "$REPO_ROOT/$name" ]]; then
    rm -rf "$SKILL_DIR/$name"
    cp -R "$REPO_ROOT/$name" "$SKILL_DIR/$name"
  fi
done

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · ADAPTERS_ZH.md (reported line 13)May include surrounding context.

只需要两步：

1. 让 Agent 能读取 skills/audit-evolution/SKILL.md。
2. 把下面的规则加入项目记忆、系统提示、router 或 AGENTS.md：

text

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · ADAPTERS_ZH.md (reported line 28)May include surrounding context.

只需要两步：

1. 让 Agent 能读取 skills/audit-evolution/SKILL.md。
2. 把下面的规则加入项目记忆、系统提示、router 或 AGENTS.md：

text

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · ADAPTERS_ZH.md (reported line 60)May include surrounding context.

只需要两步：

1. 让 Agent 能读取 skills/audit-evolution/SKILL.md。
2. 把下面的规则加入项目记忆、系统提示、router 或 AGENTS.md：

text

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · INSTALL_TEST_ZH.md (reported line 37)May include surrounding context.

只需要两步：

1. 让 Agent 能读取 skills/audit-evolution/SKILL.md。
2. 把下面的规则加入项目记忆、系统提示、router 或 AGENTS.md：

text

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 108)May include surrounding context.

只需要两步：

1. 让 Agent 能读取 skills/audit-evolution/SKILL.md。
2. 把下面的规则加入项目记忆、系统提示、router 或 AGENTS.md：

text

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/install-audit-evolution.sh (reported line 67)May include surrounding context.

sh

只需要两步：

1. 让 Agent 能读取 `skills/audit-evolution/SKILL.md`。
2. 把下面的规则加入项目记忆、系统提示、router 或 AGENTS.md：

```text

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/install-audit-evolution.sh (reported line 146)May include surrounding context.

sh

只需要两步：

1. 让 Agent 能读取 `skills/audit-evolution/SKILL.md`。
2. 把下面的规则加入项目记忆、系统提示、router 或 AGENTS.md：

```text

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document instructs integrators to invoke the skill on a wide set of runtime conditions such as task completion, failure, timeout, context growth, and file-read thresholds. These broad triggers can cause the skill to activate without clear user intent, creating over-broad routing and increasing the chance of unintended behavior, especially if the skill has access to sensitive context or can influence future agent actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The suggested routing phrases are short, generic words like 'save', 'pause', and 'details' that commonly appear in normal conversation. This makes accidental invocation likely and can let unrelated user messages trigger the audit skill, causing context leakage into the skill or incorrect task routing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file is entirely written as a Chinese demo script and includes user-facing trigger/response phrasing such as “只要回一句：进化” and canned answers only in Chinese. There is no indication that the skill supports language selection or that the Chinese-only constraint is explicitly documented as an intentional region- or audience-specific limitation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The phrase described here indicates the skill can be invoked by very short, generic user language, which creates ambiguous activation conditions. In an agent setting, broad triggers can cause the skill to run unintentionally during unrelated tasks, potentially changing behavior, generating patches, or writing memory artifacts without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The additional examples use short commands like '进化 / 保存 / 暂停 / 跑分 / 详情' without binding them to a specific skill context. These are common conversational terms, so another workflow or ordinary user message could accidentally trigger privileged skill behavior, especially in agents that inspect recent text for activation cues.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The demo recommendation explicitly endorses extremely broad triggers like '开始' or '进化', which are among the most collision-prone phrases possible. In this skill's context, accidental activation is more dangerous because the skill is designed to audit prior runs, create memory ledger entries, and propose or stage changes for future execution, so unintended invocation can alter agent state or workflow direction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Windows test instructions delete a target directory and execute PowerShell scripts with ExecutionPolicy Bypass, but the document does not explicitly warn users that it will remove files under the chosen path and run local code. In a setup guide this is likely operationally intended, but it still creates real risk of accidental data loss or execution of unreviewed scripts if a user changes the target path or runs from an untrusted repository copy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The acceptance criteria state that the short instruction 进化 should route to Audit Evolution, and the document is written as a general install test rather than a clearly China-specific or Chinese-only tool. This imposes a language-specific invocation without user opt-in or documented locale justification, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The macOS/Linux acceptance criteria also require the short instruction 进化 to trigger the skill, again enforcing a specific language in a broadly applicable installation test. The file does not provide an opt-in language selection or explain a region-specific reason for this constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase 进化 is extremely generic and likely to appear in ordinary Chinese conversation, making accidental invocation plausible. In this skill, that accidental trigger can cause the agent to begin auditing local context and files automatically, which expands the impact beyond a harmless keyword collision.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README promotes the single word '进化' as the shortest entry command, which is highly ambiguous and likely to appear in ordinary discussion. In an agent environment, such a broad trigger can unintentionally activate the skill during unrelated conversations, causing unsanctioned context scanning or workflow changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill states it will proactively search task outputs, logs, handoff notes, feedback, and recently modified files, but the privacy warning is minimal and appears much later. In practice this encourages broad inspection of potentially sensitive project context without upfront consent boundaries, creating a real risk of over-collection and exposure of confidential information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The automatic trigger rules are very broad, including common conditions such as reading more than 5 files, context pressure over 60%, uncertain phrasing, or user correction. These conditions are likely to occur in normal operation and could repeatedly invoke the skill without clear user intent, increasing the chance of unnecessary data collection, prompt interference, or workflow disruption.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill content immediately directs behavior in Chinese and the operational prompts, menus, approval question, and required output wording are written as fixed Chinese-language instructions. There is no indication that the user may choose another language or opt into Chinese, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to invoke itself on common workflow events such as task completion, feedback, failure, timeout, or drift-like conditions, which can cause unsolicited activation outside clear user intent. In a prompt skill that can influence subsequent behavior and write audit artifacts, broad activation increases the risk of unexpected state changes, noisy outputs, and consent boundary erosion.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger word '继续' ('continue') is a normal conversational term and is mapped to an action, so ordinary user replies may be misinterpreted as authorization to perform workflow steps. Even though the skill says external actions still need approval, ambiguous command routing can still cause unintended local actions, file writes, or state transitions.

Content

No source excerpt is available for this finding.