Security audit

Catalyst Design

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed catalyst-design guidance skill with no executable code, but users should be careful with its optional self-update workflow because it can persistently change the skill's own methodology files.

Install only if you want a bilingual catalyst-design guidance skill. Leave the methodology read-only during normal use, and enable updates only after reviewing the exact proposed entries, sources, confidence labels, and whether they will be pending or active.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

Location: references/design_methodology.md:5
Finding: Inconsistent Consent Controls Permit Persistent Methodology Poisoning
Content: View full analysis
Each entry is tagged with **source + confidence + update date** for audit and evolution. When generating advice, prefer high-confidence, well-sourced entries; if the user supplies a catalyst-search matrix, follow its specific systems/metrics and backfill this base. ``` The unconditional backfill instruction is repeated in the usage rules: ```markdown 4. **回填机制 | Backfill**：若本次用到用户新提供的文献产生了新规律，按 `methodology_update_protocol.md` 回填本库与 `methodology_registry.md`。 - If new user literature yields new rules, backfill this base and `methodology_registry.md` per the protocol. ``` The update protocol authorizes persistent modification of the trusted methodology files: ```markdown 4. **入库(Commit)**： - 写入 `design_methodology.md` 对应层级表格（含来源标签、置信度、更新日期）。 - Write to the matching layer table in `design_methodology.md` (source tag, confidence, update date). - 同步在 `methodology_registry.md` 追加一行 ...[truncated 3750 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: The skill explicitly allows a runtime-triggered self-update path that can write to files inside the skill (references/design_methodology.md and references/methodology_registry.md). Even though it is framed as opt-in and limited to the skill directory, this creates a persistence and prompt-injection risk: untrusted user-provided or tool-fetched content could be incorporated into future behavior, poisoning the methodology base and altering later outputs.
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
md
- Advice must be grounded in the built-in methodology or supplied literature; no ungrounded claims. - Clearly distinguish "literature-confirmed" from "empirical guess". - Advice must include an actionable validation path (characterization, testing) for user verification. - **Safety and permissions**: by default this skill only *reads* its own `references/` and `templates/`; it runs no system commands and makes no network requests beyond optional WebSearch / WebFetch; it collects or exfiltrates no user data. **Optional self-update**: step 4 ("Dynamic backfill") can *write* to the skill's own `references/design_methodology.md` and `references/methodology_registry.md` — but **only when you explicitly enable it** (e.g., "update your methodology"). It never writes to your own files or project directories. ## Example

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file presents the primary heading and instructional content in Chinese first, with bilingual support, but gives no indication that language choice is optional or that Chinese is required for a justified region-specific purpose. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file states the skill is a "bilingual" guidance skill, but it does not specify how the user can choose their preferred language or whether language selection is optional. Under the policy for natural-language constraints, locale or language behavior should be opt-in or clearly user-selectable rather than implied by the skill description alone.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. The file consistently requires bilingual labeling in generated advice under 'Must label' usage rules, but does not indicate that users may choose their preferred language or that bilingual output is optional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The template explicitly requires references in "GB/T 7714 format," which is a locale-specific standard. The file does not offer an alternative citation style or state that the skill is limited to a China-specific compliance or publication context, so this is a natural-language locale policy issue.
Content: No source excerpt is available for this finding.