Nova Skill Evolution Tracker — 技能进化追踪系统

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:21 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed skill-version tracking/reporting helper, with some overbroad wording and unfinished monitoring claims but no evidence of deception, exfiltration, persistence, or destructive behavior.

Before installing, expect this skill to maintain local skill-version history and reports, and review the broad activation phrases if accidental invocation would be disruptive. Do not rely on it for real monthly web monitoring, LLM diffing, or enterprise WeChat notifications unless those features are implemented and explicitly approved in your environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring says the tool performs monthly checks of experts' official sources and detects updates, and helper code such as generate_diff_prompt reinforces that claimed behavior. In actual execution, check_single_skill only iterates over configured URLs, marks them as "checked" in a local result object, and updates version metadata without any network retrieval, diffing, or LLM analysis.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/skill_monitor.py (reported line 212)May include surrounding context.

python

请只输出JSON，不要有其他文字。
"""
    return prompt


def check_single_skill(skill_id):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill describes shell execution, file reads, and persistent file writes, but declares no explicit tool scope or permission boundary. That creates an authorization gap where an agent may invoke this skill with broader-than-intended capabilities, enabling unintended filesystem changes, script execution, or data exposure in the workspace.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger terms are vague and overlap with common requests like '监测' or '技能进化', making accidental invocation likely. Because this skill performs external monitoring, persistent storage, and notifications, overly permissive triggers raise the risk of unintended side effects from normal conversation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation condition is broad enough to match generic requests about updates, version management, or expert news, which can cause the skill to activate outside its intended context. In practice, this increases the chance of unnecessary monitoring, report generation, persistent writes, or shell/script execution being triggered by unrelated user tasks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill performs ongoing external-source monitoring and sends reports/notifications about experts, but the description does not clearly warn users about that behavior. This weakens informed consent and transparency, and can lead to unexpected collection, processing, and dissemination of external content about individuals.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description is written entirely in Chinese and presents the skill in that language without any indication of language choice or opt-in. This can violate language/locale policy when a skill implicitly requires or defaults users to a specific language without documenting flexibility or regional scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This is a natural-language policy issue because the file forces one language for instructions, usage text, and operator-facing output. The policy allows locale constraints only when the skill offers language choice or clearly documents a justified region-specific limitation, which is not present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The usage text distinguishes --report-only as 'only generate report (do not call LLM)', which implies other modes perform LLM-backed analysis. However, no execution path invokes an LLM or even uses the diff prompt generator, so the documentation actively misrepresents the behavior difference between modes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill persistently stores version history and generated reports in the workspace without clearly warning users. Even if the data is operational rather than highly sensitive, undisclosed persistence can create retention, audit, and privacy risks, especially when records accumulate over time.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The invocation examples are generic and may train downstream systems or users to invoke the skill with ambiguous phrases. On their own they are low severity, but in this skill's context they contribute to accidental activation of workflows that write files and send notifications.

Content

No source excerpt is available for this finding.