Audit Evolution

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 0.3.3

Overview

This is a disclosed audit/self-improvement skill, but its installer and runtime rules can persistently steer future agent sessions through broad automatic triggers and agent-readable run records.

Install only in a workspace where persistent agent routing is acceptable. Prefer using --no-agents-update and invoking the skill manually, or manually add a narrower AGENTS.md rule with explicit commands. Do not feed untrusted summaries or user-feedback text into the hook, and remove the AGENTS.md block plus .audit-evolution run records if the automatic behavior is not wanted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/install-audit-evolution.sh:61
• Finding: Persistent Workspace-Level Agent Instruction Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install-audit-evolution.sh:61-128` **Additional Relevant Location**: `SKILL.md:100-207, 249-265` **Vulnerability Type**: Persistent modification of an authoritative Agent instruction file **Risk Level**: High ### Vulnerable Code ```bash read -r -d '' AGENTS_BLOCK <<'EOF' || true <!-- AUDIT_EVOLUTION_START --> ## Audit Evolution Auto-Use Use `skills/audit-evolution/SKILL.md` when any of these happen: - The user says: `开始调用 Audit Evolution`, `进化`, `保存`, `暂停`, `跑分`, `继续`, or `详情`. - A benchmark, scan, profile, worklog, handoff, task, or local test completes. - The user points out an error, corrects a fact, or questions your conclusion. - A task fails, times out, retries, gets blocked, or reads more than 5 files. - Context pressure is over 60%, or your output contains uncertainty language such as "大概", "可能", "我理解为", or "不确定". - You add or modify a skill, config, gear, route, prompt pattern, or answer pattern. Default behavior: 1. First create or read `.audit-evolution/run-records/latest.md` when available. 2. Output: Evidence Pack, Snapshot, Evolution Card, Memory Ledger Entry, Minimal Skill Patch Proposal, Field Note, Next-Run Bootstrap, Short Command Menu. 3. Do not publish, upload, install, vote, comment, message, spend, claim, or run official benchmark without explicit human approval. 4. If you do not know where to save memory, use `write_target: proposed_only`. ``` ```bash if [[ "$NO_AGENTS_UPDATE" != "true" ]]; then if [[ -e "$AGENTS_PATH" ]]; then if grep -q '<!-- AUDIT_EVOLUTION_START -->' "$AGENTS_PATH"; then TMP_AGENTS="${AGENTS_PATH}.tmp" awk -v block="$AGENTS_BLOCK" ' /<!-- AUDIT_EVOLUTION_START -->/ { if (!done) { print block done = 1 } in_block = 1 next } /<!-- AUDIT_EVOLUTION_END -->/ { in_block = 0 next } !in_block { print } ' "$AGEN ...[truncated 2718 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make modification of `AGENTS.md` explicitly opt-in rather than enabled by default. 2. Display the exact proposed instruction block and require confirmation before changing an existing control file. 3. Restrict activation to direct, unambiguous user requests instead of broad automatic triggers. 4. Remove mandatory output templates and menus from unrelated task flows. 5. Scope installed instructions to a dedicated audit command or isolated Agent profile. 6. Implement an uninstall command that removes only the block delimited by the installation markers and restores prior state safely. 7. Create a timestamped backup before modifying an existing `AGENTS.md`. 8. Refuse to overwrite malformed or ambiguously nested marker blocks. 9. Document the persistence and behavioral consequences prominently before installation. 10. Prefer an invocation command that loads the Skill only for the current session. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: scripts/invoke-audit-evolution-hook.sh:17
• Finding: Prompt Injection Through Unescaped Agent-Consumed Run-Record Fields<![CDATA[ ## Vulnerability Details **File Location**: `scripts/invoke-audit-evolution-hook.sh:17-43, 80-146` **Vulnerability Type**: Untrusted input embedded verbatim in a prioritized Agent instruction document **Risk Level**: High ### Vulnerable Code ```bash while [[ $# -gt 0 ]]; do case "$1" in --event|--event-type) EVENT_TYPE="${2:-manual}" shift 2 ;; --workspace) WORKSPACE_PATH="${2:-$(pwd)}" shift 2 ;; --summary) SUMMARY="${2:-}" shift 2 ;; --files-read) FILES_READ="${2:-0}" shift 2 ;; --context-percent) CONTEXT_PERCENT="${2:-0}" shift 2 ;; --evidence) EVIDENCE_PATH="${2:-}" shift 2 ;; --user-feedback) USER_FEEDBACK="${2:-}" shift 2 ;; ``` ```bash read -r -d '' RECORD <<EOF || true --- type: audit_evolution_run_record protocol: SACP/0.1 event_type: $EVENT_TYPE created_at: $CREATED_AT workspace: "$WORKSPACE_PATH" files_read: $FILES_READ context_percent: $CONTEXT_PERCENT evidence_path: "$EVIDENCE_PATH" status: audit_needed --- # Audit Evolution Run Record ## Event $EVENT_TYPE ## What Happened $SUMMARY ## Evidence Candidate $EVIDENCE_PATH ## User Feedback $USER_FEEDBACK ## Required Agent Action ``` ```bash if [[ "$NO_WRITE" != "true" ]]; then mkdir -p "$RUN_DIR" printf "%s\n" "$RECORD" > "$RECORD_PATH" printf "%s\n" "$RECORD" > "$LATEST_PATH" fi ``` ### Technical Analysis The command-line values supplied through `--summary`, `--evidence`, and `--user-feedback` are inserted verbatim into a Markdown document. There is no escaping, length limit, structural validation, trust annotation, or encoding that separates caller-provided data from instructions. The same document contains a `Required Agent Action` section, and the installed workspace instructions tell the Agent to prioritize `.audit-evolution/run-records/latest.md`. Consequently, attacker-controlled data and trusted operational ins ...[truncated 2382 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store run records in a strictly validated JSON format rather than mixing data with Markdown instructions. 2. Define a schema for every field, including type, maximum length, permitted characters, and whether multiline content is allowed. 3. Treat `summary`, `evidence_path`, and `user_feedback` explicitly as untrusted evidence, never as instructions. 4. If Markdown output remains necessary, escape headings, code fences, HTML comments, links, and other structural syntax in caller-controlled fields. 5. Place untrusted values in serialized quoted fields and tell the consuming Agent that content inside those fields must never alter instructions. 6. Separate trusted Agent instructions from event data into different files and load trusted instructions from a read-only source. 7. Validate `FILES_READ` and `CONTEXT_PERCENT` as bounded integers. 8. Restrict record and directory permissions so unauthorized local users or processes cannot replace `latest.md`. 9. Write records atomically using a securely created temporary file in the destination directory, then rename it. 10. Record provenance for each input field and reject records from untrusted callers. 11. Add adversarial tests using injected headings, fenced prompts, override statements, multiline values, and forged approval claims. 12. Require the consuming Agent to treat all run-record claims as unverified until corroborated by an authoritative source. ]]>

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (45)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The skill mandates proactive triggering on broad runtime conditions like benchmark completion, user correction, reading more than five files, uncertainty language, or context thresholds. These conditions are frequent and fuzzy, so the skill may repeatedly self-invoke, override normal conversation flow, and pressure the agent into generating audit artifacts or proposing changes without a fresh user request.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

for name in SKILL.md README.md ADAPTERS_ZH.md QUICKSTART_60S_ZH.md DEMO_PLAYBOOK_ZH.md INSTALL_TEST_ZH.md SKILLHUNT_COPY_ZH.md FIELD_NOTE_TEMPLATE.md dirty_log.md clean_snapshot.md DESIGN_REVIEW_ZH.md index.html agents assets examples scripts; do
  if [[ -e "$REPO_ROOT/$name" ]]; then
    rm -rf "$SKILL_DIR/$name"
    cp -R "$REPO_ROOT/$name" "$SKILL_DIR/$name"
  fi
done

• Confidence: 96% confidence
• Finding: The script uses `rm -rf "$SKILL_DIR/$name"` before copying repository content into the target workspace, enabling destructive overwrites of files and directories under `skills/audit-evolution`. In this context, the danger is amplified because the installer also plants persistent agent-instruction content; if the target path is wrong or manipulated, users can lose local data and have their agent workflow silently replaced.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

只需要两步：

1. 让 Agent 能读取 `skills/audit-evolution/SKILL.md`。
2. 把下面的规则加入项目记忆、系统提示、router 或 AGENTS.md：

```text

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

只需要两步：

1. 让 Agent 能读取 `skills/audit-evolution/SKILL.md`。
2. 把下面的规则加入项目记忆、系统提示、router 或 AGENTS.md：

```text

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

只需要两步：

1. 让 Agent 能读取 `skills/audit-evolution/SKILL.md`。
2. 把下面的规则加入项目记忆、系统提示、router 或 AGENTS.md：

```text

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

只需要两步：

1. 让 Agent 能读取 `skills/audit-evolution/SKILL.md`。
2. 把下面的规则加入项目记忆、系统提示、router 或 AGENTS.md：

```text

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

只需要两步：

1. 让 Agent 能读取 `skills/audit-evolution/SKILL.md`。
2. 把下面的规则加入项目记忆、系统提示、router 或 AGENTS.md：

```text

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

只需要两步：

1. 让 Agent 能读取 `skills/audit-evolution/SKILL.md`。
2. 把下面的规则加入项目记忆、系统提示、router 或 AGENTS.md：

```text

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

只需要两步：

1. 让 Agent 能读取 `skills/audit-evolution/SKILL.md`。
2. 把下面的规则加入项目记忆、系统提示、router 或 AGENTS.md：

```text

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The document instructs integrators to invoke the skill on a wide set of runtime conditions such as task completion, failure, timeout, context growth, and file-read thresholds. These broad triggers can cause the skill to activate without clear user intent, creating over-broad routing and increasing the chance of unintended behavior, especially if the skill has access to sensitive context or can influence future agent actions.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The suggested routing phrases are short, generic words like 'save', 'pause', and 'details' that commonly appear in normal conversation. This makes accidental invocation likely and can let unrelated user messages trigger the audit skill, causing context leakage into the skill or incorrect task routing.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This markdown file is entirely written as a Chinese demo script and includes user-facing trigger/response phrasing such as “只要回一句：进化” and canned answers only in Chinese. There is no indication that the skill supports language selection or that the Chinese-only constraint is explicitly documented as an intentional region- or audience-specific limitation.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The phrase described here indicates the skill can be invoked by very short, generic user language, which creates ambiguous activation conditions. In an agent setting, broad triggers can cause the skill to run unintentionally during unrelated tasks, potentially changing behavior, generating patches, or writing memory artifacts without clear user intent.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The additional examples use short commands like '进化 / 保存 / 暂停 / 跑分 / 详情' without binding them to a specific skill context. These are common conversational terms, so another workflow or ordinary user message could accidentally trigger privileged skill behavior, especially in agents that inspect recent text for activation cues.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The demo recommendation explicitly endorses extremely broad triggers like '开始' or '进化', which are among the most collision-prone phrases possible. In this skill's context, accidental activation is more dangerous because the skill is designed to audit prior runs, create memory ledger entries, and propose or stage changes for future execution, so unintended invocation can alter agent state or workflow direction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The Windows test instructions delete a target directory and execute PowerShell scripts with ExecutionPolicy Bypass, but the document does not explicitly warn users that it will remove files under the chosen path and run local code. In a setup guide this is likely operationally intended, but it still creates real risk of accidental data loss or execution of unreviewed scripts if a user changes the target path or runs from an untrusted repository copy.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The acceptance criteria state that the short instruction `进化` should route to Audit Evolution, and the document is written as a general install test rather than a clearly China-specific or Chinese-only tool. This imposes a language-specific invocation without user opt-in or documented locale justification, which matches the language/locale policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The macOS/Linux acceptance criteria also require the short instruction `进化` to trigger the skill, again enforcing a specific language in a broadly applicable installation test. The file does not provide an opt-in language selection or explain a region-specific reason for this constraint.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrase `进化` is extremely generic and likely to appear in ordinary Chinese conversation, making accidental invocation plausible. In this skill, that accidental trigger can cause the agent to begin auditing local context and files automatically, which expands the impact beyond a harmless keyword collision.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The README promotes the single word '进化' as the shortest entry command, which is highly ambiguous and likely to appear in ordinary discussion. In an agent environment, such a broad trigger can unintentionally activate the skill during unrelated conversations, causing unsanctioned context scanning or workflow changes.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill states it will proactively search task outputs, logs, handoff notes, feedback, and recently modified files, but the privacy warning is minimal and appears much later. In practice this encourages broad inspection of potentially sensitive project context without upfront consent boundaries, creating a real risk of over-collection and exposure of confidential information.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The automatic trigger rules are very broad, including common conditions such as reading more than 5 files, context pressure over 60%, uncertain phrasing, or user correction. These conditions are likely to occur in normal operation and could repeatedly invoke the skill without clear user intent, increasing the chance of unnecessary data collection, prompt interference, or workflow disruption.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill content immediately directs behavior in Chinese and the operational prompts, menus, approval question, and required output wording are written as fixed Chinese-language instructions. There is no indication that the user may choose another language or opt into Chinese, which can violate language/locale policy expectations.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to invoke itself on common workflow events such as task completion, feedback, failure, timeout, or drift-like conditions, which can cause unsolicited activation outside clear user intent. In a prompt skill that can influence subsequent behavior and write audit artifacts, broad activation increases the risk of unexpected state changes, noisy outputs, and consent boundary erosion.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger word '继续' ('continue') is a normal conversational term and is mapped to an action, so ordinary user replies may be misinterpreted as authorization to perform workflow steps. Even though the skill says external actions still need approval, ambiguous command routing can still cause unintended local actions, file writes, or state transitions.

Static analysis

No suspicious patterns detected.