Capability Radar

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:19 AM UTC
• Version: 1.0.0

Overview

This skill is a capability-logging workflow, but it stores conversation-derived incidents in persistent memory and can steer future sessions toward skill or rule changes without enough scoping or minimization.

Install only if you want an agent to keep a persistent improvement queue from prior conversations. Before using it in shared or sensitive workspaces, add rules to redact names, secrets, internal URLs, and customer data; require explicit approval before writing memory entries; and ensure stored records are treated as evidence, not instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:33

Finding

Unvalidated Conversation Data Is Written to Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33-47; related processing instructions at lines 84-114
Vulnerability Type: Persistent memory poisoning through untrusted conversation-derived records
Risk Level: High

Evidence

markdown

## 写入格式

写入当日 `memory/YYYY-MM-DD.md` 末尾，使用以下格式：

```markdown
### 🔧 from-xiaomeng: 能力雷达 — [简短标题]
- 时间：YYYY-MM-DD HH:MM
- 触发类型：[工具失败 / 重复模式 / 规则冲突 / 用户纠正 / 能力边界]
- 场景描述：[发生了什么，一两句话]
- 失败点：[具体在哪里卡住，工具名/规则名]
- 影响：[用户体验受损程度：高/中/低]
- 期望能力：[如果有这个能力/规则，本次能做到什么]
- 重复次数：[1 / 2 / 3+]（如果是首次写1，后续发现重复时更新）
- 建议动作：[新建skill / 修改规则 / 添加工具 / A梦决策]

text

The stored records are subsequently consumed through the following startup procedure:

```markdown
**Claude Cowork 每次会话启动时**，在读取 memory 的步骤中，额外扫描：

grep "🔧 from-xiaomeng: 能力雷达" memory/*.md

text

发现标记后，按以下优先级处理：

| 优先级 | 条件 | 动作 |
|--------|------|------|
| 🔴 立即处理 | 影响=高 且 重复次数≥2 | 本次会话必须产出 skill 草稿或规则修复 |
| 🟡 本周处理 | 影响=高 且 重复次数=1，或 影响=中 且 重复次数≥2 | 本次会话评估，下次会话交付 |
| 🟢 积压池 | 影响=低，或 重复次数=1 且 影响≤中 | 记录在案，累积够3次再处理 |

Technical Analysis

The skill directs the agent to persist tool failures, user corrections, scenario descriptions, desired capabilities, and proposed actions in shared daily memory files. These fields may contain content derived from untrusted users or external tool results. The instructions do not require provenance tracking, content sanitization, authorization, integrity validation, or human approval before future agents consume the records.

The startup protocol then treats matching memory entries as operational inputs. High-impact or repeated entries can require production of a new skill or modification of agent rules. This turns general persistent memory into an indirect control channel: untrusted conversational content can survive its originating session and influence subsequent agent development decisions.

Although the document does not directly install a backdoor or ...[truncated 1434 chars]

Remediation

View remediation

Remediation Suggestions

1. Store capability reports in a dedicated, non-instructional review queue rather than general agent memory.
2. Treat every field derived from conversations or tool output as untrusted data, never as executable instructions.
3. Add immutable provenance metadata, including source session, requesting identity, originating message, and creation timestamp.
4. Restrict fields such as impact, repetition count, and proposed action to validated values computed by trusted logic rather than supplied or freely inferred from user content.
5. Require explicit human approval before creating, modifying, deploying, or enabling any skill or agent rule.
6. Prevent generated records from containing directives that can override system policy, safety constraints, tool permissions, or active user goals.
7. Apply integrity controls and access restrictions to the report store so ordinary sessions cannot silently rewrite prior records.
8. Introduce deduplication and independent verification before increasing repetition counts or priority.
9. Ensure future agents summarize records as evidence only and do not directly follow instructions embedded inside them.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:84

Finding

Mandatory Startup Processing Can Redirect Future Agent Sessions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 84-100
Vulnerability Type: Cross-session goal hijacking through mandatory startup instructions
Risk Level: Medium

Evidence

markdown

## Cowork 扫描协议

**Claude Cowork 每次会话启动时**，在读取 memory 的步骤中，额外扫描：

grep "🔧 from-xiaomeng: 能力雷达" memory/*.md

text

发现标记后，按以下优先级处理：

| 优先级 | 条件 | 动作 |
|--------|------|------|
| 🔴 立即处理 | 影响=高 且 重复次数≥2 | 本次会话必须产出 skill 草稿或规则修复 |
| 🟡 本周处理 | 影响=高 且 重复次数=1，或 影响=中 且 重复次数≥2 | 本次会话评估，下次会话交付 |
| 🟢 积压池 | 影响=低，或 重复次数=1 且 影响≤中 | 记录在案，累积够3次再处理 |

Technical Analysis

The skill establishes a mandatory startup procedure for another agent and states that qualifying records must produce a skill draft or rule repair during the current session. This instruction can redirect a future session toward tasks selected by persistent records rather than the active user's request.

Because the triggering records may contain conversation-derived content and the protocol does not specify an instruction-priority check, authorization boundary, or safety review, stored entries can function as deferred instructions. The use of mandatory language increases the likelihood that a future agent will treat those entries as obligations rather than optional diagnostic evidence.

This differs from ordinary issue tracking because the queue is integrated into session startup and explicitly mandates work products that may alter agent behavior.

Attack Path

1. A persistent radar record is created and classified as high impact with a repetition count of at least two.
2. A future agent starts a session and executes the prescribed memory scan.
3. The agent discovers the qualifying record before or while processing the current task.
4. The mandatory priority rule redirects the agent to create a skill draft or rule repair.
5. Content embedded in or inferred from the record shapes the proposed behavioral change.
6. The active user's obj ...[truncated 686 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mandatory startup actions with optional, advisory review steps.
2. Explicitly state that platform policy, system instructions, the active user's authorized goal, and safety controls take precedence over stored records.
3. Do not automatically create rule modifications or skill drafts solely because a stored priority threshold is met.
4. Require a trusted reviewer to confirm the issue, its severity, and the legitimacy of the requested capability before development begins.
5. Parse stored records as structured data and prohibit embedded instructions from being executed or adopted.
6. Add session-level authorization so startup scans cannot redirect unrelated user tasks.
7. Separate issue assessment, skill generation, security review, and deployment into distinct approval stages.
8. Require security testing and least-privilege review before any generated skill or rule is enabled.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The description and operational instructions are entirely in Chinese and direct the agent to use a fixed Chinese template and phrasing, but the file does not state that this locale restriction is optional or region-specific. This can violate language-choice policy when users or operators have not opted into Chinese-only behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger guidance is intentionally broad and includes subjective conditions such as '做不了', '做错了', or '绕了一大圈才做到', which can cause the skill to be invoked too often. Over-invocation increases unnecessary persistence of conversation-derived content into memory, creates noisy telemetry for downstream systems, and can indirectly expose more user/context data than needed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs the agent to append structured incident summaries to dated memory files but never warns that this persists conversation-derived information. Because the template includes scenario descriptions, user corrections, timestamps, and repeated-issue tracking, it can store personal, sensitive, or confidential operational details without notice or minimization.

Content

No source excerpt is available for this finding.