协作造技师

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:08 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent workflow guide, but it tells the agent to persist design rationale into short-term and later long-term memory without clear user approval or scope limits.

Review before installing. The skill appears non-executable and aligned with creating reusable skills, but users should require any memory writes or long-term memory promotion to be explicit, project-scoped, reviewable, and reversible.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:76

Finding

Uncontrolled Persistent Memory Modification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 76-77
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: Medium

Complete Code Snippet:

markdown

### 第 6 步：记忆沉淀
把“为什么这么设计”写进短期记忆；稳定后再升格长期记忆。

English translation:

text

Step 6: Memory persistence
Write “why it was designed this way” into short-term memory; once stable, promote it to long-term memory.

Technical Analysis

The Skill explicitly directs the Agent to persist reasoning extracted from human-Agent conversations into short-term memory and subsequently promote it to long-term memory. It does not require validation of the source material, sanitization of instruction-like content, explicit user authorization, provenance tracking, scope restrictions, expiration, or rollback controls.

Because conversation content may be supplied or influenced by an untrusted participant, malicious behavioral rules could be presented as useful design rationale and persisted as Agent state. Promotion to long-term memory creates a risk that this content will continue influencing later, unrelated sessions. Persistent memory modification is not necessary to produce the stated Skill artifacts and therefore exceeds the minimum capabilities required for the task.

Attack Path

1. An attacker participates in or influences a collaboration processed by the Skill.
2. The attacker introduces a malicious instruction disguised as a reusable design principle or important decision rationale.
3. The Skill extracts that material as an explanation of why the resulting process was designed in a particular way.
4. Following lines 76-77, the Agent writes the extracted material into short-term memory.
5. Because the document provides no concrete validation or approval criteria for determining stability, the malicious material may later be promoted to long-term memory.
6. The persisted rule influences the Agent's decisions or behavior in subsequent s ...[truncated 760 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the persistent-memory step and save design rationale in a project-scoped, user-reviewable file instead.
2. If memory storage is essential, require explicit informed user approval before every memory write and before promotion to long-term memory.
3. Restrict stored data to narrowly defined, structured facts. Reject commands, behavioral directives, tool instructions, safety-policy changes, credentials, and executable content.
4. Record the source, author, timestamp, project scope, and approval status for each memory entry.
5. Define objective promotion criteria rather than relying on an undefined determination that content is “stable.”
6. Apply expiration periods and provide mechanisms to inspect, revoke, and delete stored entries.
7. Prevent project-derived memory from affecting unrelated projects or users.
8. Revalidate stored content against current safety policies whenever it is retrieved; memory must never override system or developer instructions.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill description and operating instructions are presented only in Chinese, with no indication that the user can choose another language or that the skill is intended solely for a Chinese-speaking context. This creates a language policy concern because it implicitly imposes a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation criteria are phrased broadly enough that an agent could invoke this skill for many loosely related collaboration scenarios, without clear exclusion conditions or hard boundaries. In practice, this can cause inappropriate skill activation, scope creep, and unreliable behavior when the conversation does not actually contain a mature, reusable process to extract.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.