掌眼小助理

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:15 AM UTC
• Version: 1.0.0

Overview

This is a Chinese antiques-appraisal helper with bounded advice and no evidence of hidden execution, data theft, persistence, or destructive behavior.

Install this if you want a Chinese-language preliminary antiques and collectibles appraisal assistant. Treat its conclusions as educational risk guidance only, especially before purchases; it should not be used as an official authentication, legal, customs, or guaranteed valuation service.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
AIGC:
    ContentProducer: Minimax Agent AI
    ContentPropagator: Minimax Agent AI
    Label: AIGC
    ProduceID: 66de6c4862e929014779ea67512f7808
    PropagateID: 66de6c4862e929014779ea67512f7808
    ReservedCode1: 3045022100e9f2a13e6503cef83887dac7977035bb3d3fcf35c9dbbfbcff186e719ce80b2302205e6cb371e63c93fbc8c0d427da05dbd41d0ea6ebe0b59bad6979eab77a1ae374
    ReservedCode2: 30440220138babf0f149fa13a7faed4dc17cf280a49875a02839986c3cc59a2ae0e23aee02207ac969bdf5f69e838d61c51bda752e5f590ef6419c45bb3d0afd4edc70c1521c
description: 专注文物、书画、瓷器、玉器与古董收藏领域的智能鉴定助手，帮助用户进行初步分析、风险识别、收藏建议与鉴定思路讲解。
metadata:
    openclaw:
        emoji: "\U0001F3FA︎"
        requires:
            bins: []
name: zhangyan-assist

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

prompt += f"- {item}\n"
    
    prompt += "\n图不全时，结论只能非常保守。"
    return prompt

if __name__ == "__main__":
    # 示例用法

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

prompt += f"- {item}\n"
    
    prompt += "\n图不全时，结论只能非常保守。"
    return prompt

if __name__ == "__main__":
    # 示例用法

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

prompt += f"- {item}\n"
    
    prompt += "\n图不全时，结论只能非常保守。"
    return prompt

if __name__ == "__main__":
    # 示例用法

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

prompt += f"- {item}\n"
    
    prompt += "\n图不全时，结论只能非常保守。"
    return prompt

if __name__ == "__main__":
    # 示例用法

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The usage examples include generic phrases such as “帮我看看这件东西有没有问题” and “拍前帮我看一下风险,” which are common conversational requests and are not tightly scoped to a specific invocation context. The file does not provide explicit trigger constraints, exclusion conditions, or negative examples to distinguish when this skill should activate versus ordinary chat about objects or risk.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The entire reply template is written as a fixed Chinese-language response and provides no indication that the user can choose another language or locale. This can violate a language/locale policy when skills are expected to respect user preference rather than enforce a single language by default.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The entire document prescribes responses exclusively in Chinese, including required phrasing and style, but does not mention any user opt-in, language selection, or region-specific limitation. Under the language/locale policy rule, forcing a specific language without user choice is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The welcome message is entirely in Chinese and introduces the assistant in a way that presumes Chinese-language use by default. Because there is no statement offering alternative languages or asking for the user's preference, this creates a language/locale policy concern under the natural-language policy rule.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The manifest sets the locale to "zh-CN", and the surrounding examples and labels are entirely Chinese, but there is no indication that users can opt into another language or that the restriction is required for a region-specific compliance reason. This creates a natural-language policy concern because the skill appears to enforce a language/locale by default without user choice.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrase "帮我看看这件东西" is extremely broad and conversational, so it could match many ordinary user requests that are unrelated to antiques or appraisal. That raises the risk of unintended invocation, causing the assistant to respond in the wrong domain and potentially give misleading collection or authenticity guidance without the user explicitly asking for it.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The example "掌眼一下" is ambiguous shorthand that may be meaningful in antiques circles but is not self-scoping in general conversation. Because it lacks object type or appraisal context, an intent matcher could over-trigger on short casual input and launch specialized analysis when the user intent is unclear.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The phrase "能不能买" is a generic purchase-advice request that commonly appears outside the antiques context. If mapped directly to a collection-advice intent, it can cause accidental invocation during unrelated shopping conversations and produce unsuitable guidance that users may over-trust for financial decisions.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The entire skill file is written as mandatory guidance for responses in Chinese, with no indication that the user can choose another language or that the Chinese-only constraint is required for a region-specific use case. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s docstrings, comments, checklist labels, prompts, and example input/output are all exclusively in Chinese, indicating the skill is designed to operate in a single language without any user opt-in or language-selection mechanism. Under the policy, forcing a specific language is a natural-language policy violation unless the locale constraint is explicitly justified or optional.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This Python file contains natural-language instructions stating the function's purpose is to format responses in a specific Chinese professional style, and the generated output sections are all hard-coded in Chinese. That imposes a language/locale choice without offering the user any option to select another language, which matches the language-policy violation criterion.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This Python file contains natural-language descriptions and outputs exclusively in Chinese, including the module docstring and function docstring, with no indication that the user can opt into another language. Under the policy, forcing a specific language without user choice is a locale-policy violation unless clearly documented as region-specific.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list contains several broad natural-language phrases such as '鉴定', '看看真假', and '帮我看看这件东西' that can plausibly appear in ordinary conversation outside an explicit request to invoke this skill. That increases the chance of accidental activation, which can lead to unintended collection or processing of user-provided text/images in a sensitive appraisal context.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: This markdown file contains user-facing natural-language instructions entirely in Chinese, and there is no indication that the skill offers alternative language options or that the Chinese-only constraint is intentionally limited to a specific audience or region. Under the policy rule for language or locale constraints, forcing a specific language without opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This markdown file consists entirely of Chinese-language instructions and checklist items, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This markdown template hardcodes a single language/locale for all user-facing content. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This code file contains user-facing strings and docstrings exclusively in Chinese, including the generated prompts returned to users. Under the policy rule for language/locale, forcing a specific language without opt-in can be a natural-language policy violation when no choice or justification is provided.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The manifest sets the skill language to "zh-CN", which indicates a fixed locale, but there is no accompanying indication that users may choose another language or explicitly opt into Chinese-only interaction. Under the policy, fixed language behavior can be a natural-language policy issue unless justified or presented as an explicit user choice.

Static analysis

No suspicious patterns detected.