达尔文.skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:52 AM UTC
• Version: 1.0.0

Overview

The skill openly optimizes other skills, but it can broadly read and change installed skill files with git commits before final per-change approval.

Install only if you want an agent to inspect and potentially modify other installed skills. Prefer running it on a named skill or reviewed allowlist first, check the generated branch and diffs before accepting changes, and avoid full-scan optimization unless you are comfortable exposing all local skill instructions to the workflow.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (28)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 6)May include surrounding context.

text

<style>
      @import url('https://fonts.googleapis.com/css2?family=Inter:wght@400;700;900&amp;display=swap');
    </style>
    <!-- Gradient for ratchet blocks -->
    <linearGradient id="blockGrad1" x1="0" y1="0" x2="0" y2="1">
      <stop offset="0%" stop-color="#444444"/>
      <stop offset="100%" stop-color="#333333"/>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 64)May include surrounding context.

text

letter-spacing="-2"
  >达尔文.skill</text>

  <!-- Subtitle pipeline -->
  <text
    x="80"
    y="312"

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 143)May include surrounding context.

text

letter-spacing="0.3"
  >Inspired by Karpathy's autoresearch</text>

  <!-- ============================================================ -->
  <!-- RIGHT SIDE: Ratchet visualization                           -->
  <!-- 5 bars of increasing height + score labels, anchored right  -->
  <!-- ============================================================ -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 159)May include surrounding context.

text

<rect x="944" y="252" width="36" height="68" rx="3" fill="url(#blockGrad2)"/>
  <text x="962" y="248" font-family="'Inter', system-ui, sans-serif" font-size="10" font-weight="600" fill="#777777" text-anchor="middle">55</text>

  <!-- Bar 3 — medium, warm brown (score ~68) -->
  <rect x="998" y="220" width="36" height="100" rx="3" fill="url(#blockGrad3)"/>
  <text x="1016" y="216" font-family="'Inter', system-ui, sans-serif" font-size="10" font-weight="600" fill="#8B5E3C" text-anchor="middle">68</text>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 167)May include surrounding context.

text

<rect x="1052" y="188" width="36" height="132" rx="3" fill="url(#blockGrad4)"/>
  <text x="1070" y="184" font-family="'Inter', system-ui, sans-serif" font-size="10" font-weight="600" fill="#C04020" text-anchor="middle">80</text>

  <!-- Bar 5 — tallest, brand orange (score ~92) -->
  <rect x="1106" y="152" width="36" height="168" rx="3" fill="url(#blockGrad5)"/>
  <text x="1124" y="148" font-family="'Inter', system-ui, sans-serif" font-size="12" font-weight="700" fill="#D4532B" text-anchor="middle">92</text>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 174)May include surrounding context.

text

<!-- Baseline for bars -->
  <rect x="880" y="320" width="276" height="1" fill="#FFFFFF" opacity="0.12"/>

  <!-- Label below bars -->
  <text x="1018" y="344" font-family="'Inter', system-ui, sans-serif" font-size="11" font-weight="600" fill="#555555" text-anchor="middle" letter-spacing="2">SCORE PROGRESSION</text>

  <!-- Upward trend arrow on top-right -->

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README states that the system edits SKILL.md files, creates git commits, and performs reverts, but it does not prominently warn users that running the skill may modify repositories. In context, this increases the risk of surprising state changes, accidental commits, or unwanted rollbacks across user-managed skill assets.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 101)May include surrounding context.

bash

# 将 SKILL.md 放入 Claude Code Skills 目录
mkdir -p ~/.claude/skills/darwin-skill
cp SKILL.md ~/.claude/skills/darwin-skill/SKILL.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 101)May include surrounding context.

bash

# 将 SKILL.md 放入 Claude Code Skills 目录
mkdir -p ~/.claude/skills/darwin-skill
cp SKILL.md ~/.claude/skills/darwin-skill/SKILL.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 102)May include surrounding context.

bash

# 将 SKILL.md 放入 Claude Code Skills 目录
mkdir -p ~/.claude/skills/darwin-skill
cp SKILL.md ~/.claude/skills/darwin-skill/SKILL.md

使用

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The example trigger phrase for full optimization is broad enough to overlap with ordinary user requests, which can cause the skill to activate in situations where the user did not intend repository-wide optimization. In this skill’s context, unintended activation is more dangerous because the documented behavior includes autonomous evaluation and modification of many SKILL.md files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description/frontmatter includes many broad trigger phrases such as general requests to improve, review, or score a skill. This can cause the skill to activate in situations where the user did not explicitly ask for autonomous optimization, leading to unintended file edits, git operations, and broad evaluation workflows on local skills.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 86% confidence

Finding

The skill instructs the agent to scan .claude/skills/*/SKILL.md when optimizing all skills, which is a form of broad local skill enumeration. In context, this can expose unrelated skill contents, expand access beyond the user's immediate request, and increase the blast radius before explicit per-target confirmation.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

text

1. 确认优化范围：
   - 全部skills → 扫描 .claude/skills/*/SKILL.md
   - 指定skills → 用户指定列表
2. 创建 git 分支：auto-optimize/YYYYMMDD-HHMM
3. 初始化 results.tsv（如不存在）

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The rule '中文为主、简洁为上' imposes a Chinese-first output/style constraint regardless of the user's language preference. While not a direct security exploit, it can override user intent and degrade reliability or transparency during sensitive review/editing tasks, especially if users expect English or another language for auditability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The banner hard-codes prominent user-facing text in Chinese, including the title and subtitle pipeline, without indicating that the skill is region-specific or offering a language choice. This creates a natural-language locale policy issue because the asset imposes a specific language on users by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document declares lang="en" and uses English UI text, but the round labels are hard-coded in Chinese ("轮次 0" through "轮次 4"). This creates an inconsistent forced-language experience without user opt-in or documented locale justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file sets lang="en" at L002, but the visible title and multiple rubric labels are in Chinese at L223 and throughout the body. That creates a natural-language locale policy issue because the skill output forces a specific mixed-language presentation without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document declares lang="zh-CN", and the visible content throughout the page is written primarily in Simplified Chinese. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern unless the restriction is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation claims no change becomes effective without explicit human confirmation, yet other sections describe committing modifications before that confirmation. In the context of an autonomous skill optimizer with git automation, this ambiguity can weaken approval boundaries and lead operators to assume a stronger human-in-the-loop safeguard than actually exists.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document declares lang="zh-CN", and the visible content is written primarily in Simplified Chinese, which effectively fixes the skill presentation to a specific language/locale. The file does not offer an opt-in language choice or explain why a China-specific locale is required.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The SVG imports a remote font from Google Fonts, which causes network access when the asset is rendered in some contexts. Even in a static branding asset, this can leak usage metadata, break offline operation, and introduce dependency on third-party content delivery.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document declares lang="en" even though the content includes Chinese text, and there is no indication that the language choice is optional or region-specific. This is a natural-language locale constraint that may violate policy requiring language or locale choice unless justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code makes network requests to fonts.googleapis.com and fonts.gstatic.com, which transmits client metadata as part of loading the page. The file contains no visible warning, comment, or other user disclosure indicating that external network access occurs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This file sets the document language to en on L002, but the user-facing text in the body is predominantly Chinese. That is a natural-language locale mismatch and effectively forces a specific locale without opt-in or documented reason.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The page imports Google Fonts from fonts.googleapis.com, which causes the client to make an external network request and disclose metadata such as IP address, user agent, and timing information to a third party. In a local/offline-oriented skill asset this is an unnecessary privacy and supply-chain dependency, though it is not direct code execution and the overall severity remains low.

Content

No source excerpt is available for this finding.