道家战略顾问

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent Taoist strategy-advice prompt, but it requests broad command, file-write, network, and skill-loading powers that are not needed for that purpose.

Review the requested tool permissions before installing. The content itself appears to be philosophical strategy guidance, but the skill should not need shell commands, file editing, web access, or loading other skills; prefer a version with no tools or only tightly scoped Read access.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Excessive Tool Permissions Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Excessive tool authorization
Risk Level: Medium

Vulnerable Code Snippet

yaml

allowed-tools: Read, Write, Edit, Bash, WebSearch, WebFetch, Glob, Grep, Skill

Technical Analysis

The skill is a text-based Taoist strategy adviser whose documented behavior consists of analyzing user scenarios and generating recommendations. This functionality does not require shell execution, filesystem modification, arbitrary network access, or loading additional skills.

Nevertheless, the configuration authorizes Write, Edit, Bash, WebSearch, WebFetch, and Skill. These capabilities exceed the skill's legitimate operational requirements and violate the principle of least privilege. In an agent environment where declared tools become available while the skill is active, malicious user input or indirect prompt injection could attempt to induce actions unrelated to strategic advice.

The permission declaration alone does not prove that commands are executed automatically, and no malicious command or payload was found in the project. The risk arises from the unnecessary capabilities exposed to an influenced agent.

Attack Path

1. A user loads or triggers the strategy-adviser skill.
2. The agent receives the broad tool set declared on line 4.
3. The user supplies malicious instructions, or the agent processes attacker-controlled content containing indirect prompt injection.
4. The injected instructions attempt to invoke an unnecessary privileged tool:
   • Bash for local command execution;
   • Write or Edit for filesystem modification;
   • WebFetch or WebSearch for external communication;
   • Skill for loading additional behavior.
5. If the host relies on this allowlist without independent authorization controls, the agent may perform actions outside the advisory task's intended scope.

Impact Assessment

Successful exploitation could permit op ...[truncated 607 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove every tool that is not essential to the declared advisory function.
2. Prefer an empty tool allowlist when the skill can answer entirely from its embedded instructions.
3. If packaged reference files are added and must be consulted, authorize only Read and constrain it to the skill directory.
4. Remove Bash, Write, Edit, WebSearch, WebFetch, and Skill unless a documented, reviewed use case requires each capability.
5. Enforce runtime controls independently of skill metadata:
   • Require explicit user confirmation for shell, write, and network operations;
   • Restrict filesystem access to a dedicated sandbox;
   • Apply outbound network allowlists;
   • Prevent recursive or untrusted skill loading;
   • Log and audit privileged tool invocations.
6. Add automated validation that rejects skill manifests whose permissions exceed the capabilities required by their documented workflows.

A hardened configuration would use no tools, or at most:

yaml

allowed-tools: Read

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

文件整体以中文定义技能名称、描述、触发词和输出规范，但未说明是否支持其他语言，也未给出用户语言选择机制。根据规则，强制特定语言而无用户 opt-in 或明确地域/合规理由，属于自然语言层面的语言/locale 政策问题。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are broad enough to activate on generic topics like strategy, management, life decisions, and adversity, which can cause the skill to engage outside clearly user-intended Taoist/philosophical contexts. In an agent with powerful tools enabled, unintended activation increases the chance that restrictive, domain-specific instructions override a more appropriate baseline behavior or user preference.

Content

No source excerpt is available for this finding.