Security audit

ThoughtCodec 思维编解码

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent bilingual planning and rule-refinement skill library with disclosed review gates and no hidden execution behavior found.

Before installing, be aware that this skill family is meant to help create or update reusable rules and local skill files. Use it with explicit scope, review generated patches before accepting them, and avoid feeding it private transcripts, secrets, client data, or proprietary material unless you intend that material to inform local-only rules.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (32)

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.en.md (reported line 33)May include surrounding context.
md
| Skill | Type | Use it when you need to | | --- | --- | --- | | [Architecture Scaffolding](skills/architecture-scaffolding/SKILL.md) | Decompression | Convert business logic into architecture, data models, API contracts, and code structure. | | [SOP Instantiation](skills/sop-instantiation/SKILL.md) | Decompression | Convert a broad goal into a concrete operating procedure with milestones and checks. | | [Rule & Prompt Optimizer](skills/rule-prompt-optimizer/SKILL.md) | Compression | Convert feedback, corrections, and conversation traces into reusable prompt rules. | | [Code Abstraction & Encapsulation](skills/code-abstraction-encapsulation/SKILL.md) | Compression | Convert repeated or messy code into reusable components and engineering rules. | | [Personal Methodology Engine](skills/personal-methodology-engine/SKILL.md) | Loop | Combine decompression and compression into a personal working-system loop. |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · catalog/skills.json (reported line 37)May include surrounding context.
json
| Skill | Type | Use it when you need to | | --- | --- | --- | | [Architecture Scaffolding](skills/architecture-scaffolding/SKILL.md) | Decompression | Convert business logic into architecture, data models, API contracts, and code structure. | | [SOP Instantiation](skills/sop-instantiation/SKILL.md) | Decompression | Convert a broad goal into a concrete operating procedure with milestones and checks. | | [Rule & Prompt Optimizer](skills/rule-prompt-optimizer/SKILL.md) | Compression | Convert feedback, corrections, and conversation traces into reusable prompt rules. | | [Code Abstraction & Encapsulation](skills/code-abstraction-encapsulation/SKILL.md) | Compression | Convert repeated or messy code into reusable components and engineering rules. | | [Personal Methodology Engine](skills/personal-methodology-engine/SKILL.md) | Loop | Combine decompression and compression into a personal working-system loop. |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.en.md (reported line 34)May include surrounding context.
md
| --- | --- | --- | | [Architecture Scaffolding](skills/architecture-scaffolding/SKILL.md) | Decompression | Convert business logic into architecture, data models, API contracts, and code structure. | | [SOP Instantiation](skills/sop-instantiation/SKILL.md) | Decompression | Convert a broad goal into a concrete operating procedure with milestones and checks. | | [Rule & Prompt Optimizer](skills/rule-prompt-optimizer/SKILL.md) | Compression | Convert feedback, corrections, and conversation traces into reusable prompt rules. | | [Code Abstraction & Encapsulation](skills/code-abstraction-encapsulation/SKILL.md) | Compression | Convert repeated or messy code into reusable components and engineering rules. | | [Personal Methodology Engine](skills/personal-methodology-engine/SKILL.md) | Loop | Combine decompression and compression into a personal working-system loop. |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · catalog/skills.json (reported line 53)May include surrounding context.
json
| --- | --- | --- | | [Architecture Scaffolding](skills/architecture-scaffolding/SKILL.md) | Decompression | Convert business logic into architecture, data models, API contracts, and code structure. | | [SOP Instantiation](skills/sop-instantiation/SKILL.md) | Decompression | Convert a broad goal into a concrete operating procedure with milestones and checks. | | [Rule & Prompt Optimizer](skills/rule-prompt-optimizer/SKILL.md) | Compression | Convert feedback, corrections, and conversation traces into reusable prompt rules. | | [Code Abstraction & Encapsulation](skills/code-abstraction-encapsulation/SKILL.md) | Compression | Convert repeated or messy code into reusable components and engineering rules. | | [Personal Methodology Engine](skills/personal-methodology-engine/SKILL.md) | Loop | Combine decompression and compression into a personal working-system loop. |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.en.md (reported line 35)May include surrounding context.
md
| [Architecture Scaffolding](skills/architecture-scaffolding/SKILL.md) | Decompression | Convert business logic into architecture, data models, API contracts, and code structure. | | [SOP Instantiation](skills/sop-instantiation/SKILL.md) | Decompression | Convert a broad goal into a concrete operating procedure with milestones and checks. | | [Rule & Prompt Optimizer](skills/rule-prompt-optimizer/SKILL.md) | Compression | Convert feedback, corrections, and conversation traces into reusable prompt rules. | | [Code Abstraction & Encapsulation](skills/code-abstraction-encapsulation/SKILL.md) | Compression | Convert repeated or messy code into reusable components and engineering rules. | | [Personal Methodology Engine](skills/personal-methodology-engine/SKILL.md) | Loop | Combine decompression and compression into a personal working-system loop. | Each skill has an English and Simplified Chinese version:

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · catalog/skills.json (reported line 69)May include surrounding context.
json
| [Architecture Scaffolding](skills/architecture-scaffolding/SKILL.md) | Decompression | Convert business logic into architecture, data models, API contracts, and code structure. | | [SOP Instantiation](skills/sop-instantiation/SKILL.md) | Decompression | Convert a broad goal into a concrete operating procedure with milestones and checks. | | [Rule & Prompt Optimizer](skills/rule-prompt-optimizer/SKILL.md) | Compression | Convert feedback, corrections, and conversation traces into reusable prompt rules. | | [Code Abstraction & Encapsulation](skills/code-abstraction-encapsulation/SKILL.md) | Compression | Convert repeated or messy code into reusable components and engineering rules. | | [Personal Methodology Engine](skills/personal-methodology-engine/SKILL.md) | Loop | Combine decompression and compression into a personal working-system loop. | Each skill has an English and Simplified Chinese version:

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.en.md (reported line 36)May include surrounding context.
md
| [SOP Instantiation](skills/sop-instantiation/SKILL.md) | Decompression | Convert a broad goal into a concrete operating procedure with milestones and checks. | | [Rule & Prompt Optimizer](skills/rule-prompt-optimizer/SKILL.md) | Compression | Convert feedback, corrections, and conversation traces into reusable prompt rules. | | [Code Abstraction & Encapsulation](skills/code-abstraction-encapsulation/SKILL.md) | Compression | Convert repeated or messy code into reusable components and engineering rules. | | [Personal Methodology Engine](skills/personal-methodology-engine/SKILL.md) | Loop | Combine decompression and compression into a personal working-system loop. | Each skill has an English and Simplified Chinese version:

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · catalog/skills.json (reported line 85)May include surrounding context.
json
| [SOP Instantiation](skills/sop-instantiation/SKILL.md) | Decompression | Convert a broad goal into a concrete operating procedure with milestones and checks. | | [Rule & Prompt Optimizer](skills/rule-prompt-optimizer/SKILL.md) | Compression | Convert feedback, corrections, and conversation traces into reusable prompt rules. | | [Code Abstraction & Encapsulation](skills/code-abstraction-encapsulation/SKILL.md) | Compression | Convert repeated or messy code into reusable components and engineering rules. | | [Personal Methodology Engine](skills/personal-methodology-engine/SKILL.md) | Loop | Combine decompression and compression into a personal working-system loop. | Each skill has an English and Simplified Chinese version:

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest-like header sets language: zh-CN, which indicates a fixed locale preference. Although the body mentions bilingual availability later, this top-level language constraint is not presented as a user choice or clearly justified as region-specific, so it may violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description uses broad 'convert X into Y' language without any activation boundaries, exclusions, or scope limits. In a skill-routing system, this can cause over-triggering on ordinary user requests and unexpectedly delegate sensitive planning or implementation work to a powerful skill, increasing prompt-injection and unsafe automation risk.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.en.md (reported line 32)May include surrounding context.
md
"description": "Convert business logic into architecture diagrams, data models, API contracts, and implementation scaffolds.", "descriptionZh": "将业务逻辑转化为架构图、数据模型、API 契约和实施脚手架。", "paths": { "en": "skills/architecture-scaffolding/SKILL.md", "zh-CN": "skills/architecture-scaffolding/SKILL.zh-CN.md" }, "examples": ["skills/architecture-scaffolding/examples/basic-usage.md"]

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · catalog/skills.json (reported line 21)May include surrounding context.
json
"description": "Convert business logic into architecture diagrams, data models, API contracts, and implementation scaffolds.", "descriptionZh": "将业务逻辑转化为架构图、数据模型、API 契约和实施脚手架。", "paths": { "en": "skills/architecture-scaffolding/SKILL.md", "zh-CN": "skills/architecture-scaffolding/SKILL.zh-CN.md" }, "examples": ["skills/architecture-scaffolding/examples/basic-usage.md"]

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill descriptions are ambiguous enough to overlap with common planning, editing, and workflow requests, which can cause unintended skill activation. That increases the chance that normal conversation content is treated as authorization to generate operational procedures or persistent rules, creating unsafe or privacy-impacting behavior in agentic environments.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The 'personal-methodology' skill is especially broad because it describes a closed-loop system that transforms intent into execution and feedback into reusable methodology. In context, that can capture a wide range of self-improvement, work management, or personal data flows, making accidental activation and persistence of sensitive user behavior more dangerous than the other entries.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The line states that skills must maintain both English and Simplified Chinese versions as a blanket requirement. This imposes a language/locale policy in natural language without mentioning user preference, opt-in, or a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest sets language: zh-CN, and the document content is entirely Chinese, which imposes a specific language/locale. Under the stated policy, locale constraints should either be optional for the user or clearly justified as region-specific; this file does not provide such justification or opt-in language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file declares language: zh-CN, and all instructions are written only in Simplified Chinese, which imposes a specific language/locale on users. The document does not mention any opt-in, alternative language support, or region-specific justification for this constraint.
Content: No source excerpt is available for this finding.

Persistent Context Injection

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.
Content: Scanner excerpt · skills/personal-methodology-engine/examples/basic-usage.md (reported line 45)May include surrounding context.
md
## Review Checks - The system can explain why each rule exists. - Corrections become draft patches before becoming permanent rules. - Private examples are not stored in public skills. - High-level logic changes require review.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest-style header sets language: zh-CN, and the entire skill content is written as a fixed Chinese-language instruction set. There is no indication that users may choose another language or that this locale restriction is required for a region-specific purpose, which can violate language-choice policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The file presents the skill package description entirely in Chinese and does not indicate that users may choose another language. This can violate a language/locale policy when a skill forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The SVG includes Chinese text and explicitly describes the project as a bilingual library, but there is no accompanying language-selection or opt-in mechanism in the natural-language content. Under the stated policy, forcing or assuming a specific language presentation without user choice can be a locale-policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The text states that SKILL.zh-CN.md is the Simplified Chinese version, and elsewhere requires Chinese documentation to use zh-CN, which imposes a specific locale in the project documentation structure. The file does not explain whether this locale requirement is optional, user-selected, or justified as a region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The sentence states that this directory stores Simplified Chinese documentation, which imposes a specific language/locale in the document content without mentioning any user opt-in or alternative within this file. Under the policy rule for language or locale constraints, this can be interpreted as a locale-specific requirement that is not justified in-file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: 该 markdown 文件包含自然语言规则“中文文档路径或文件名中使用 zh-CN”，对语言/区域设置作了固定要求。按规则 SQP-3，若未提供用户选择或未明确说明这是受区域/兼容性约束的必要限制，则可视为语言/locale 策略问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown guidance includes a natural-language requirement that skills be maintained in English and Simplified Chinese, which can be read as enforcing specific languages by policy. Under the stated rule, forcing a language or locale without user opt-in is a policy concern unless the constraint is explicitly justified or optional.
Content: No source excerpt is available for this finding.