三省吾身 - 深度自我审视与进化系统

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:57 PM UTC
• Version: 2.0.0

Overview

This is a legitimate reflection workflow, but it can auto-start and push lasting changes into agent or workflow files without clear approval controls.

Install only if you want this Chinese-oriented deep reflection workflow and are prepared to keep it user-directed. Require explicit invocation before using it, review any proposed file edits before they are made, and do not allow it to modify SOUL.md, SKILL.md, other skills, or shared workflow standards unless you deliberately approve the exact path and diff.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:604
• Finding: Reflection Content Can Be Persisted into Agent Identity Files and Other Skills<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:604-617`, `SKILL.md:716-718`; supporting example in `examples/cognitive-war-room-case.md:118-157` **Vulnerability Type**: Persistent agent-state poisoning and modification of other Skills **Risk Level**: Medium ### Vulnerable Code Snippet The following is an English translation of the complete relevant source segment at `SKILL.md:604-617`: ```markdown ### 5.1 Update Principles **Solidify new understanding as principles** | New understanding | Principle to solidify | Write location | |-------------------|-----------------------|----------------| | ... | "Quality > progress" | SOUL.md / personal notes | ### 5.2 Update Processes **Solidify new practices as processes** | New practice | Process to solidify | Documents involved | |--------------|---------------------|--------------------| | ... | Run the checklist before acceptance | SKILL.md / work standards | ``` The mandatory persistence requirements at `SKILL.md:716-718` state: ```markdown ### Solidification Principles 1. **Must be solidified** — Changes must become documents or habits and cannot remain only in the mind. 2. **Must be propagated** — Valuable changes must be communicated to relevant parties. 3. **Must be reviewed** — Periodically review whether the solidified content is being followed. ``` The bundled example explicitly demonstrates mutation of persistent identity and Skill files: ```markdown | Tester = implementer | Modify the test-design Skill and require adversarial testing | | Mindset: progress > quality | Establish the "quality > progress" principle | Write to SOUL.md | | P0 | Upgrade SOUL.md because changing oneself is the prerequisite | | P1 | Modify the test-design Skill | ``` ### Technical Analysis The Skill does not limit the solidification phase to a dedicated reflection report. It directs the agent to convert conclusions derived from feedback and reflection context into persistent principles, personal notes, ...[truncated 2028 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make the default output a proposed change report rather than directly modifying persistent files. 2. Require explicit, informed user approval before writing to persistent state or modifying another Skill. 3. Prohibit writes to identity and policy files such as `SOUL.md`. 4. Restrict generated artifacts to an allowlisted directory such as `docs/reflections/`. 5. Treat feedback, project files, and retrieved records as untrusted data rather than executable instructions. 6. Never propagate instructions found inside reflection evidence into persistent agent rules without independent validation. 7. Display an exact diff, destination path, and expected behavioral effect before any approved modification. 8. Create a backup and provide a tested rollback procedure for every approved persistent change. 9. Require separate authorization for changes to Skills, tools, policies, or shared workflow standards. 10. Remove mandatory language requiring all changes to be solidified; persistence should be optional and proportionate to the user's request. ]]>

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:30
• Finding: Broad Automatic Activation Can Redirect the Current Task into a Mandatory Multi-Stage Workflow<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:30-39`, with mandatory behavior at `SKILL.md:710-718` and default configuration at `SKILL.md:739` **Vulnerability Type**: Automatic instruction activation and current-session goal redirection **Risk Level**: Low ### Vulnerable Code Snippet The following is an English translation of the complete activation segment at `SKILL.md:30-39`: ```markdown User says: - "Reflect on..." - "Examine myself" - "Review [something]" - "Conduct a post-mortem" Automatic activation: - Detect negative-feedback keywords - Detect quality-problem patterns - Periodic reminders, if periodic self-checking is configured ``` The action requirements at `SKILL.md:710-718` state: ```markdown ### Action Principles 1. **Must have action** — Reflection without action is wasted reflection. 2. **Must be executable** — Actions must be specific, operable, and have acceptance criteria. 3. **Must have a deadline** — Every action must have an estimated completion time. ### Solidification Principles 1. **Must be solidified** — Changes must become documents or habits and cannot remain only in the mind. 2. **Must be propagated** — Valuable changes must be communicated to relevant parties. 3. **Must be reviewed** — Periodically review whether the solidified content is being followed. ``` The default configuration at `SKILL.md:739` is: ```markdown | Deep mode | Whether the complete five-stage process is mandatory | Yes | ``` ### Technical Analysis The Skill claims automatic activation based on broad semantic patterns such as negative feedback and quality problems. These patterns commonly occur during ordinary development, review, support, and troubleshooting conversations and do not necessarily indicate that the user wants to enter a separate reflection workflow. Once activated, the Skill defaults to the complete five-stage process and uses mandatory language requiring actions, deadlines, persistence, propagation, and review. This ...[truncated 1469 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user invocation or confirmation before entering the reflection workflow. 2. Treat negative feedback and quality-problem detection only as a suggestion to offer reflection, not as authorization to activate it. 3. Keep the current task active until the user confirms the scope and desired workflow. 4. Default deep mode to disabled and allow users to select only the required stages. 5. Separate analysis from execution: generating a report must not authorize actions, file writes, propagation, or scheduling. 6. Add a clear cancellation point before each stage. 7. Prevent text inside documents, logs, issue reports, or other untrusted artifacts from activating the Skill. 8. Require renewed confirmation before any action that changes persistent state or affects third parties. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The README advertises very broad trigger phrases such as 'Reflect on...', 'Review...', and 'Post-mortem...', which are common natural-language requests a user might make in many contexts. That can cause the skill to activate unintentionally, overriding more appropriate behaviors or injecting its reflection workflow into unrelated conversations without clear user intent.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The quick-start section emphasizes Chinese-language invocation phrases without offering an equivalent language-choice or opt-in mechanism for other users. This can create ambiguous activation behavior, surprise users who did not intend to invoke the skill, and reduce transparency around when the skill is taking control.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: All user-facing instructions, examples, and descriptions in the README are presented only in Chinese, which can amount to forcing a specific language without user opt-in. There is no indication that the skill is intentionally limited to a Chinese-speaking audience or that alternative language support is unavailable by design.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are very generic everyday language such as asking to reflect or review something, which can cause the skill to activate in many unrelated conversations. Overbroad activation increases the chance of unintended context capture, response hijacking, or interference with other skills and normal assistant behavior.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: All user-facing instructions, triggers, examples, and outputs are presented only in Chinese, which effectively imposes a specific language on users. The file does not offer an opt-in language selection or explain that the skill is intentionally restricted to a Chinese-speaking context.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation rules are broad and include vague automatic triggers such as detecting negative feedback keywords or quality-problem patterns. That can cause unintended invocation in unrelated contexts, leading the agent to enter a reflection workflow, ask intrusive questions, or perform downstream actions like generating reports when the user did not intend to use this skill.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill instructs updating persistent files such as SOUL.md, SKILL.md, and other documents as part of 'solidification,' which can cause unintended modification of workspace state beyond reflection assistance. This is dangerous because broad, weakly scoped file-write guidance may overwrite important documents, alter agent behavior, or create durable changes without clear user authorization.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file uses Chinese throughout, including headings, instructions, and examples, but does not indicate that the skill is Chinese-only or provide any user opt-in for language selection. Under the policy rule, forcing a specific language without user choice can be a locale-policy violation.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description claims applicability to essentially any scenario needing deep reflection, which can cause the skill to be surfaced or invoked in many ordinary contexts without clear scoping boundaries. This is not inherently malicious, but broad trigger language increases the chance of unintended activation, user confusion, or overreach into contexts where the skill may not be appropriate.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The description is written only in Chinese and presents the skill in a way that may implicitly constrain interaction language without indicating that language choice is optional or user-driven. In multilingual environments, this can lead to poor transparency, misrouting, or unexpected user experience issues rather than a direct security compromise.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This markdown file contains user-facing natural language that implicitly forces a specific language/locale for skill use. The policy allows locale constraints only when the skill offers opt-in choice or clearly documents a justified regional limitation, neither of which is present here.

Context-Inappropriate Capability

Low

• Confidence: 81% confidence
• Finding: The manifest describes a deep self-reflection and improvement system, which naturally covers guided analysis and planning, but these lines add autonomous detection and scheduled reminder capabilities. Reminder scheduling and automatic triggering are ancillary automation features rather than core reflection behavior, and they are not disclosed in the manifest description itself.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The configuration states that reports are stored under the current docs/ directory, but the top-level description does not warn users that the skill may create or update files. Hidden persistence is risky because users may assume the interaction is ephemeral while the skill leaves artifacts in the workspace.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This markdown template forces a specific language/locale for all users through its headings and field labels. Under the policy, a fixed language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The entire markdown template is written in Chinese and all headings, prompts, and placeholders require a Chinese-language reflection report. Under the policy rules, a skill should not force a specific language or locale unless it offers opt-in or clearly documents a justified regional constraint.

Static analysis

No suspicious patterns detected.