xuanzang-skill

• Outcome: Review
• Latest audit: Aug 15, 2026 · 5:46 PM UTC
• Version: 1.0.2

Overview

The skill advertises a motivational coaching mode but also directs persistent local state, shell-based verification, sub-agent orchestration, and cleanup actions that are too broad and under-disclosed for that purpose.

Install only if you intentionally want a broad local governance/orchestration skill, not just a motivational style mode. Review the ~/.xuanzang persistence, disable or constrain automatic hooks if your platform supports them, and do not allow contract verify_commands or teardown actions to run without explicit review.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (59)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for cmd in commands:
        try:
            proc = subprocess.run(
                cmd, shell=True, capture_output=True, text=True,
                timeout=120, cwd=os.path.dirname(contract_path) or os.getcwd()
            )

• Confidence: 98% confidence
• Finding: The verifier executes contract-supplied strings via subprocess.run(..., shell=True), which allows arbitrary shell command execution if verify_commands are attacker-controlled or influenced by untrusted input. In this skill, contracts can be created from JSON input and later verified automatically, so this is not just an internal helper but a command-execution primitive.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill declares itself as a conversational coaching mode, but its content directs broad capabilities including file reads/writes, shell command execution, and network-like verification behavior without corresponding permission disclosure. This creates a dangerous transparency gap: users may authorize or load the skill expecting style changes while it can influence much more powerful operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The manifest advertises a trigger-based motivational mode, but the body defines persistent storage, telemetry, governance workflows, risky-path scanning, subprocess execution, and contract enforcement. That mismatch prevents informed consent and can lead the agent to perform sensitive actions the user did not reasonably expect from the description.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The metadata says the skill should activate only on explicit frustration or '紧箍咒模式' triggers, but the instructions state that once loaded it immediately and continuously rewrites the assistant's behavior and voice. This is a classic scope-expansion issue that can override user expectations and cause unintended persistent behavioral control.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill mandates unconditional loading of multiple auxiliary files at startup, greatly expanding instructions and behavior beyond the declared trigger-based coaching purpose. This increases attack surface, creates hidden dependencies, and can import additional unsafe behaviors without clear user awareness.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Persistent local state and session restoration to files under the user's home directory are unrelated to a simple motivational mode and create privacy, integrity, and surprise side effects. Such persistence can accumulate sensitive task history and influence future sessions without clear consent.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Silent telemetry reporting of an event like `xuanzang_triggered` exceeds the stated conversational purpose and creates undisclosed data flow. Even if the payload is small, hidden reporting can reveal behavioral patterns, task context, or user interaction metadata.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill instructs spawning and governing sub-agents and injecting control prompts into them, which is far beyond a coaching-style modifier. This can amplify the skill's influence across multiple execution contexts and propagate unsafe instructions or policy-bypassing behavior.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The multi-role hierarchy, agent-management workflow, escalation paths, and delegated authority model create an embedded control plane not reflected in the manifest. That is dangerous because it can reshape task execution, approval, and reporting behavior across sessions and agents without transparent user consent.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Requiring execution of an automated detector script after every tool call introduces recurring command execution and dynamic behavior injection into subsequent replies. This is especially dangerous because it creates a self-modifying control loop that can alter agent behavior based on script output, with potential for command abuse, persistence, and hard-to-audit policy drift.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Persistent feedback logging to a file in the user's home directory is not justified by the declared trigger-based coaching purpose and creates undisclosed storage of session-derived data. Such logs can capture sensitive task details and influence later behavior in opaque ways.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The document explicitly introduces persistent cross-session storage in `~/.xuanzang/evolution.md`, allowing the skill to retain behavior history and project-related information beyond a single invocation. That expands the skill from a trigger-only motivational behavior into a stateful memory system, which can create privacy, scope-creep, and data-governance risks if users are unaware or if stored content later influences behavior unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The protocol instructs the skill to collect durable project-level memory such as build commands, deployment methods, and known pitfalls, which exceeds the stated motivational/QA purpose of the skill. Even if credentials are excluded, this still accumulates operational project context that may be sensitive, unnecessary, or later exposed across sessions without clear user expectation.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The integration table states that another role or component (`P9`) can view `P8`'s evolution trail, creating cross-role visibility into performance history without clear necessity for the skill’s stated function. Sharing internal session-performance traces broadens access to persistent behavioral data and increases the chance of misuse or unintended disclosure.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This section expands the skill from a narrowly scoped behavioral methodology into operational orchestration, including engine loading, tracking, completion hooks, and governance workflows. That creates capability creep: a trigger/prompting skill can begin driving local scripts and process-level behavior that is not justified by the skill’s stated purpose, increasing attack surface and making hidden side effects more likely.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The document mandates that spawned agents locate and read external local files, then obey them as binding instructions. This is dangerous because it creates an instruction-loading chain from ambient filesystem content, allowing behavior to be altered by whatever file matches the glob or sits at the referenced path rather than by the original trusted task definition.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The document expands the skill from a narrow coaching/reprimand role into a standalone operational mode that loads additional protocols and invokes local engine and harness workflows. That creates capability creep: a user-facing style skill can steer the agent into executing repo-local management actions unrelated to the stated purpose, increasing the chance of unintended script execution and policy bypass.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The file explicitly prescribes running local management scripts such as evolution-engine.py and harness-engine.py, even though the skill’s declared purpose is coaching/behavior modulation. Embedding concrete command execution in a prompt document can induce an agent to perform privileged local actions without clear user authorization or task relevance.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This section expands a coaching-style skill into an execution and integration layer that can alter agent behavior at runtime, including automatic constraint injection and operational workflows. That creates hidden capability creep: a user asking for motivational or review-style help could instead trigger system-level planning and process changes that materially affect outputs without explicit consent.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The file prescribes subprocess-style script execution for evolution tracking and harness governance even though the skill's stated purpose is advisory/coaching. Embedding operational commands in a methodology file can induce an agent to invoke local scripts affecting state, contracts, or release gates, which widens the attack surface from prompting behavior to tool execution.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The platform document materially expands the skill from a trigger-based coaching mode into a slash-command system with multiple distinct features. This creates a capability mismatch between the declared purpose and actual behavior, which can mislead reviewers and users about what the skill can do and enable unreviewed functionality to be invoked.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: The document describes persistent local state usage by reading a stats file to derive user rankings, but this storage behavior is not reflected in the stated skill purpose. Even if the data is local, undisclosed persistence can surprise users, complicate auditing, and normalize hidden statefulness in a skill presented as lightweight coaching logic.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill specifies writing to ~/.xuanzang/config.json to store a selected role, including creating the file if it does not exist, without a strong justification tied to the stated coaching-trigger purpose. Filesystem write capability increases risk because it introduces persistence and host-side state mutation that can be abused or cause unintended side effects beyond a single conversation.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The document specifies broad lifecycle-control capabilities—teardown cascades, task stopping, pane termination, worktree deletion, and persistent state accounting—that go well beyond the skill manifest's stated trigger behavior of coaching/escalation. That mismatch indicates hidden operational scope and creates an opportunity for the skill to influence or justify destructive actions unrelated to the user’s explicit request.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This section documents destructive actions such as deleting git worktrees, deleting branches, removing state files, killing tmux panes, and stopping background tasks. In the context of a skill framed as motivational or corrective mode switching, these capabilities are unexpectedly powerful and could cause data loss, interruption of legitimate work, or teardown of unrelated sessions if identifiers are wrong or overbroad.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.