Security audit

Zhua Metacognition

Security checks for vulnerabilities and agentic risk

Overview

This skill is a low-risk metacognition prompt framework, though its packaged helper files are placeholders and some referenced files are missing.

Install only if you want a Chinese-language metacognition prompt framework. Expect incomplete helper tooling unless the missing scripts and referenced documents are added later.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个具有明确认知分析与优化用途的技能，但代码块只是一个示例/占位 Python 脚本，唯一行为是输出“This is an example script for zhua-metacognition”。它没有读取输入、分析思维过程、监控状态、应用策略优化，也没有任何与声明用途相符的实现。因此描述与实际行为存在明显的实质性不匹配。

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The manifest description and primary skill content are written entirely in Chinese and framed as the skill's default operating mode, with no indication that users may opt into another language. Under the policy, language-specific behavior should either provide user choice or clearly justify the locale restriction.

Static analysis

No suspicious patterns detected.