xjev · Agent 决策

• Outcome: Pass
• Latest audit: Sep 21, 2026 · 12:37 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed decision helper that stores local setup and preference data and sends bounded decision context to a fixed Jev API, without hidden persistence or automatic real-world actions.

Install only if you are comfortable storing a TypeSafe API key locally and sending relevant decision context, options, evidence summaries, and scoped preferences to the Jev/TypeSafe API when the skill is invoked. Use XJEV_HOME or --no-setup if you need tighter local control, and periodically review or revoke saved policies if your preferences change.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly requires filesystem access, outbound HTTPS, shell execution, and use of environment variables, but it does not declare any tool scope or permission boundaries in the manifest. This creates an over-privileged, under-specified execution model where the host may grant broad capabilities without clear user-visible constraints, increasing the risk of unintended file access, secret exposure, or arbitrary command execution through the referenced scripts.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 84% confidence

Finding

The skill instructs the agent to automatically initiate setup, resume pending decisions, and avoid repeatedly asking whether to invoke Jev for covered tasks. Although framed as workflow convenience, this enables the agent to make meaningful operational decisions and trigger networked/setup actions with reduced user confirmation, which is risky in a skill that can store credentials locally and influence consequential choices.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

If not configured, say: “要使用 Jev 判断，请在本机配置页填写 API key；不要把 key 发到聊天中。不需要模型的约束检查、反馈和习惯操作可以先继续。” Start `python3 <skill>/scripts/xjev.py setup` in a managed session that can yield while the user fills the form. Present the returned localhost link. Continue independent local work; only the actual Jev call depends on completed setup. The user may defer setup. The form expires after 10 minutes; run setup again if needed. On a remote host, use an already configured `TYPESAFE_API_KEY` or run setup on that host with a local port-forward; never pretend the remote localhost URL is reachable from the user’s browser.

The page tests the key with one small real request and saves it locally with restrictive permissions. After completion, run `status` and resume the pending decision. If the runtime says `http_401`, offer the same setup path. Do not ask users to paste secrets into chat, pass them on command lines, inspect config contents, or change their shell profile. Existing `TYPESAFE_API_KEY` takes precedence over the local file; explain this if an old environment key causes authentication failure.

Installation through the bundled `install.py` launches setup unless already configured. A generic folder installer may not execute it: first-use checking is the portable fallback. Automatic use means the host selects this skill on relevant requests; it is not an always-running background agent. Once configured, do not repeatedly ask whether to call Jev for tasks covered by this skill. Follow the host’s existing network and data-sharing permissions.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The display name, description, and default prompt are written entirely in Chinese, with no indication that users may choose another language or locale. This can violate language or locale policy where user opt-in or explicit locale justification is required.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest allows implicit invocation while pairing it with a broad, open-ended decision prompt, which can cause the skill to be triggered in situations the user did not clearly intend. In a decision-making skill that influences prioritization and next steps, this increases the risk of covert routing, overreach, and unexpected use of stored preferences or external decision logic.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The argument parser description and help text are hard-coded in Chinese, which imposes a specific language on all users. This is a natural-language policy concern because the file provides no option to select language or indicate that the tool is intentionally limited to a Chinese-speaking audience.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · install.py (reported line 32)May include surrounding context.

python

return 2
        shutil.copytree(source,target,ignore=shutil.ignore_patterns("__pycache__","*.pyc",".DS_Store"))
    command = [sys.executable,str(target/"scripts/xjev.py")]
    check = subprocess.run(command+["status"],capture_output=True,text=True)
    if check.returncode:
        print(check.stdout)
        return check.returncode

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · install.py (reported line 41)May include surrounding context.

python

"message":"xjev 已安装。配置 Jev API key 后可在相关决策中自动选用；安装没有常驻后台进程。",
        "setup_command":command+["setup"]},ensure_ascii=False),flush=True)
    if not result["configured"] and not args.no_setup:
        return subprocess.call(command+["setup"])
    return 0

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/runtime.md (reported line 9)May include surrounding context.

md

import uuid

VERSION = "0.1.0"
ENDPOINT = "https://api.typesafe.ai/v1/systemone"
MAX_BYTES = 2_000_000

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/common.py (reported line 16)May include surrounding context.

python

import uuid

VERSION = "0.1.0"
ENDPOINT = "https://api.typesafe.ai/v1/systemone"
MAX_BYTES = 2_000_000

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file includes multiple hard-coded user-facing strings in Chinese, starting at L043, such as validation and setup error messages. A skill that forces a specific language without user choice can violate language/locale policy, and this file provides no indication of opt-in or locale selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file hard-codes user-facing error and status strings in Chinese across input validation and decision handling. Because the skill does not offer a language or locale choice, it imposes a specific language on users, which matches the language/locale policy-violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The HTML page content shown to the user is entirely in Chinese, including the page language declaration and all instructional text. This creates a language/locale policy concern because the skill does not provide user opt-in, alternative language support, or justification that the skill is intended only for a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The user-facing error text is hard-coded in Chinese, and the file contains no indication that language selection is optional or configurable. This can violate language/locale policy when users are not given opt-in or a documented locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The CLI help description is presented in Chinese only, which imposes a specific language on all users. The file does not provide a mechanism for choosing another language or document a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This validation message is shown directly to users in Chinese, but the code does not offer any locale negotiation or opt-in. That makes the interface language-fixed in a way that may conflict with organizational language policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The fallback error response shown to users is Chinese-only, and the code provides no alternative locale path. This is a natural-language policy concern because users are forced into a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The document uses a Chinese feedback example as the canonical input and later prescribes Chinese preference text, which can imply a fixed language expectation. The file does not state that other languages are equally acceptable or that this is a region-specific skill, so it may violate language-choice policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.