skill-md-optimizer

• Outcome: Pass
• Latest audit: Oct 16, 2026 · 10:33 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed offline SKILL.md/README optimizer with a local linter; its main risks are ordinary editing and dependency clarity issues, not malicious behavior.

Install only if you want an agent to edit or audit selected SKILL.md/README files and run a local Python linter. Name the target file and mode explicitly, review any generated changelog before accepting edits, and clarify PyYAML installation behavior if your environment forbids package installs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior promises a bounded SKILL.md optimizer, but the described implementation behavior is closer to a linter/publish-gate and does not actually provide the claimed transformation features. This mismatch is dangerous because users and host agents may route tasks, permissions, or trust decisions based on inaccurate declarations, enabling unintended file operations or policy bypass through false expectations.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

md

**Input:** any `SKILL.md` (frontmatter and body). Refuses binaries / pure data /

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/readme_template.md (reported line 1)May include surrounding context.

md

<!--
skill-md-optimizer · assets/readme_template.md
共识模板骨架（依据 §7.0 核心五问 + 固定顺序）。
用法：占位符 {…} 全部替换成真实值；{org}/{repo} 从 git remote 取，别编；

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/readme_template.md (reported line 1)May include surrounding context.

md

<!--
skill-md-optimizer · assets/readme_template.md
共识模板骨架(依据 §7.0 核心五问 + 固定顺序)。
用法:占位符 {...} 全部替换成真实值;{org}/{repo} 从 git remote 取,别编;

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README advertises trigger phrases like "optimize / refactor / slim down this SKILL.md" that are broad enough to overlap with ordinary editing requests. In an agent-skill system, overly broad triggers can cause unintended activation in unrelated contexts, leading the skill to take over workflows or apply its rewrite logic when the user did not explicitly intend to invoke it.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill explicitly instructs the agent to read files and run a local script, but the frontmatter does not declare any tool scope such as file read or shell execution. This creates a permission/behavior mismatch that can cause overbroad execution in permissive hosts or mislead reviewers about what capabilities the skill actually needs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger wording includes broad README-polishing requests that overlap with ordinary editing assistance, making the skill likely to activate outside its narrow intended scope. Over-triggering can cause the agent to apply specialized instructions, file handling, or shell-backed lint flows in benign contexts where they were not requested.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Line L002 sets the document language to "zh-CN", and the visible UI text throughout the page is Chinese-only. For this file type, natural-language policy violations include forcing a specific language without user opt-in; no alternative language selection or justification is provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Several instructions are written as mandatory Chinese-language guidance, including requiring multilingual projects to add language-switch links, but the template does not state that language choice should be based on user preference. This can conflict with a policy requiring user choice on language or locale rather than imposing a default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The template explicitly includes a Language: <auto|zh|en> selector, which can steer output into English or Chinese even when the user has not opted into a language choice or provided locale justification. In this skill context, that creates policy-compliance risk and can cause the auditor output to be generated in an unintended language, reducing usability and potentially bypassing locale-handling requirements the surrounding skill is supposed to enforce.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This is a code file, so only SQP-2 and SQP-3 apply. The module docstring and later CLI/help text are Chinese-only, which can amount to a natural-language locale constraint without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The argparse description/help strings are Chinese-only, and the script’s printed diagnostics elsewhere are also Chinese-facing. The policy allows locale constraints when explicitly justified, but this file does not present a user language choice or rationale for the restriction.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown template gives general usage instructions but does not specify any explicit trigger phrases, activation boundaries, or exclusion conditions. For manifest/markdown guidance, that can make invocation criteria ambiguous and increase the chance of unintended use in broader contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The guidance says to avoid certain wording for 'domestic content review,' imposing a locale-specific language constraint in natural language. While it may reflect platform requirements, the file does not clearly frame this as optional only for those specific China-market targets or offer any user opt-in/choice at the point of instruction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Line L38 prescribes that internationalized projects 'offer a switch' using a fixed English and Chinese example. This can be read as imposing specific language expectations rather than offering locale choice based on user needs, and no justification for those locales is provided in this file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.