Polanyi Perspective

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:10 AM UTC
• Version: 2.0.3

Overview

This is a mostly Chinese-language philosophical perspective skill with no runtime code, persistence, or data access, though its README install examples should be treated as mutable supply-chain commands.

Before installing, prefer a pinned or reviewed installer/source revision and avoid running the README npx commands with elevated privileges. Expect Chinese-first responses unless you explicitly ask the agent to answer in another language.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:144

Finding

Unpinned npx installation executes mutable third-party supply-chain content

Content

View full analysis

Vulnerability Details

File Location: README.md, line 144. The same unsafe installation pattern also appears at lines 236 and 273–274.
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code at line 144:

bash

npx skills add 0xenzyme/polanyi-skill

Additional occurrences:

bash

npx skills add alchaincyf/nuwa-skill

bash

npx skills add alchaincyf/steve-jobs-skill
npx skills add alchaincyf/elon-musk-skill

Technical Analysis

The documented installation procedure invokes npx without pinning the skills CLI to an exact, reviewed version. If the CLI is not already available locally, npx may retrieve and execute its current package release. The repository arguments also identify mutable upstream repositories without an immutable commit hash or integrity checksum.

This creates two supply-chain trust boundaries:

1. The package registry controls which implementation of the unpinned skills CLI is executed.
2. The remote repository owner controls the content installed from the mutable repository reference.

A compromised package publisher, registry account, upstream repository, or future malicious release could therefore change the effective installation behavior after this audit. The reviewed repository contains no evidence that these dependencies are currently malicious; the issue is that the documented process executes or installs content whose identity and integrity are not fixed.

Attack Path

1. An attacker compromises the publisher account, package release process, or referenced repository.
2. The attacker publishes a malicious CLI version or modifies content at the mutable repository reference.
3. A user follows the README and runs the documented npx skills add ... command.
4. npx resolves the package available at execution time and may download and run it.
5. The CLI retrieves the repository content available at that t ...[truncated 884 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills CLI to an exact reviewed version rather than allowing npx to resolve the latest release:

   bash

   npx --yes skills@<reviewed-version> add ...
   

2. Pin every source repository to an immutable commit or signed release tag supported by the installer.
3. Publish and verify cryptographic checksums or signatures for downloaded Skill artifacts.
4. Use a lockfile or equivalent dependency manifest with integrity metadata where supported.
5. Prefer an installation process that downloads and inspects declarative Skill content without executing package lifecycle scripts.
6. Document the expected package publisher, repository owner, version, commit identifier, and verification procedure.
7. Run installation with an unprivileged account in an isolated environment, and explicitly warn users not to invoke the command with sudo or administrative privileges.
8. Remove unrelated third-party installation commands from the primary project documentation or clearly mark them as unaudited external projects.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is presented as 'Michael Polanyi 的认知操作系统' and the README consistently demonstrates Chinese-only interaction, without offering any language choice or stating that responses can follow the user's preferred language. Under the policy for natural-language violations, a skill that appears to require a specific language without opt-in should be flagged.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx skills add 0xenzyme/polanyi-skill without pinning an exact package version. This creates a supply-chain risk: a later compromised or malicious package release could be fetched and executed at install time, and README-driven copy/paste makes exploitation more likely.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This invocation again references npx skills add alchaincyf/nuwa-skill without an exact version, exposing users to unreviewed future package changes. If the upstream package or dependency chain is hijacked, users following the README could execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README advertises another unpinned npx skills add command for a related skill, which has the same mutable-package execution risk. Because the file serves as installation guidance, readers may trust and execute it directly, amplifying supply-chain exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This unpinned npx skills add example repeats the same pattern of executing the latest available package code. Even though it is only documentation, security-sensitive users often execute README commands verbatim, so mutable references are a practical supply-chain weakness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill mandates a fixed response persona and specific phrasing, and the surrounding document consistently instructs output in Chinese with some English terms. This creates a locale/language constraint without giving the user an explicit choice to continue in their preferred language, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file is written entirely in Chinese and presents the content as a reference for a role skill, but it does not indicate that the language choice is optional or limited to a Chinese-only context. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file is written entirely in Chinese and provides no indication that the language is optional, user-selected, or justified by a region-specific purpose. Under the language/locale policy criterion, content that effectively forces a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file is written entirely in Chinese and provides no indication that language selection is optional or that the locale constraint is required for a region-specific purpose. The policy specifically calls for flagging language or locale constraints when the skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill description is presented in Chinese on L3 while the default prompt on L4 is in English, and the file does not indicate whether the user can choose their preferred language. This can create a language-policy issue if the skill implicitly assumes or forces a locale without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file is entirely Chinese-language content, and there is no indication that the user opted into Chinese or that the document is intended for a specific locale or region. Under the policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file is written entirely in Chinese, including headings, analysis, and recommendations, with no indication that the user can choose another language or that the locale restriction is intentional. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.