Back to skill

Security audit

三省吾身 - 深度自我审视与进化系统

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate reflection workflow, but it can auto-start and push lasting changes into agent or workflow files without clear approval controls.

Install only if you want this Chinese-oriented deep reflection workflow and are prepared to keep it user-directed. Require explicit invocation before using it, review any proposed file edits before they are made, and do not allow it to modify SOUL.md, SKILL.md, other skills, or shared workflow standards unless you deliberately approve the exact path and diff.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:604
Finding

Reflection Content Can Be Persisted into Agent Identity Files and Other Skills

Content
View full analysis
progress" | SOUL.md / personal notes | ### 5.2 Update Processes **Solidify new practices as processes** | New practice | Process to solidify | Documents involved | |--------------|---------------------|--------------------| | ... | Run the checklist before acceptance | SKILL.md / work standards | ``` The mandatory persistence requirements at `SKILL.md:716-718` state: ```markdown ### Solidification Principles 1. **Must be solidified** — Changes must become documents or habits and cannot remain only in the mind. 2. **Must be propagated** — Valuable changes must be communicated to relevant parties. 3. **Must be reviewed** — Periodically review whether the solidified content is being followed. ``` The bundled example explicitly demonstrates mutation of persistent identity and Skill files: ```markdown | Tester = implementer | Modify the test-design Skill and require adversarial testing | | Mindset: progress > quality | Establish the "quality > progress" principle | Write to SOUL.md | | P0 | Upgrade SOUL.md because changing oneself is the prerequisite | | P1 | Modify the test-design Skill | ``` ### Technical Analysis The Skill does not limit the solidification phase to a dedicated reflection report. It directs the agent to convert conclusions derived from feedback and reflection context into persistent principles, personal notes, ...[truncated 2028 chars]
Remediation
View remediation

T01 · Skill Instruction Hijacking

Note
Location
SKILL.md:30
Finding

Broad Automatic Activation Can Redirect the Current Task into a Mandatory Multi-Stage Workflow

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README advertises very broad trigger phrases such as 'Reflect on...', 'Review...', and 'Post-mortem...', which are common natural-language requests a user might make in many contexts. That can cause the skill to activate unintentionally, overriding more appropriate behaviors or injecting its reflection workflow into unrelated conversations without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The quick-start section emphasizes Chinese-language invocation phrases without offering an equivalent language-choice or opt-in mechanism for other users. This can create ambiguous activation behavior, surprise users who did not intend to invoke the skill, and reduce transparency around when the skill is taking control.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

All user-facing instructions, examples, and descriptions in the README are presented only in Chinese, which can amount to forcing a specific language without user opt-in. There is no indication that the skill is intentionally limited to a Chinese-speaking audience or that alternative language support is unavailable by design.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are very generic everyday language such as asking to reflect or review something, which can cause the skill to activate in many unrelated conversations. Overbroad activation increases the chance of unintended context capture, response hijacking, or interference with other skills and normal assistant behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

All user-facing instructions, triggers, examples, and outputs are presented only in Chinese, which effectively imposes a specific language on users. The file does not offer an opt-in language selection or explain that the skill is intentionally restricted to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation rules are broad and include vague automatic triggers such as detecting negative feedback keywords or quality-problem patterns. That can cause unintended invocation in unrelated contexts, leading the agent to enter a reflection workflow, ask intrusive questions, or perform downstream actions like generating reports when the user did not intend to use this skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs updating persistent files such as SOUL.md, SKILL.md, and other documents as part of 'solidification,' which can cause unintended modification of workspace state beyond reflection assistance. This is dangerous because broad, weakly scoped file-write guidance may overwrite important documents, alter agent behavior, or create durable changes without clear user authorization.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file uses Chinese throughout, including headings, instructions, and examples, but does not indicate that the skill is Chinese-only or provide any user opt-in for language selection. Under the policy rule, forcing a specific language without user choice can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description claims applicability to essentially any scenario needing deep reflection, which can cause the skill to be surfaced or invoked in many ordinary contexts without clear scoping boundaries. This is not inherently malicious, but broad trigger language increases the chance of unintended activation, user confusion, or overreach into contexts where the skill may not be appropriate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The description is written only in Chinese and presents the skill in a way that may implicitly constrain interaction language without indicating that language choice is optional or user-driven. In multilingual environments, this can lead to poor transparency, misrouting, or unexpected user experience issues rather than a direct security compromise.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file contains user-facing natural language that implicitly forces a specific language/locale for skill use. The policy allows locale constraints only when the skill offers opt-in choice or clearly documents a justified regional limitation, neither of which is present here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The manifest describes a deep self-reflection and improvement system, which naturally covers guided analysis and planning, but these lines add autonomous detection and scheduled reminder capabilities. Reminder scheduling and automatic triggering are ancillary automation features rather than core reflection behavior, and they are not disclosed in the manifest description itself.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The configuration states that reports are stored under the current docs/ directory, but the top-level description does not warn users that the skill may create or update files. Hidden persistence is risky because users may assume the interaction is ephemeral while the skill leaves artifacts in the workspace.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown template forces a specific language/locale for all users through its headings and field labels. Under the policy, a fixed language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The entire markdown template is written in Chinese and all headings, prompts, and placeholders require a Chinese-language reflection report. Under the policy rules, a skill should not force a specific language or locale unless it offers opt-in or clearly documents a justified regional constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.