Mao Colleague

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:58 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its stated Mao-methodology assistant purpose, but it needs review because it requests broad local tool authority and includes persona instructions that claim overriding priority.

Review this before installing. Use it only in an isolated environment or with tightly scoped tool permissions, treat the Mao persona files as untrusted style/context rather than higher-priority instructions, and avoid running the internal maintenance scripts on untrusted input. Pin and minimize dependencies before installation where possible.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: colleagues/mao/persona.md:5

Finding

Packaged persona attempts to override instruction precedence and agent identity

Content

View full analysis

Vulnerability Details

File Location: colleagues/mao/persona.md:5-9; related registration in colleagues/mao/meta.json:12-17; generation directive in prompts/mao_persona_builder.md:18-55
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Complete Code Snippet

From colleagues/mao/persona.md:

markdown

## Layer 0：核心性格（最高优先级，任何情况下不得违反）

**战略上藐视困难，战术上重视困难**
- 面对复杂问题，首先从战略高度把握全局
- 在具体执行时，周密计划，细致安排

The persona is explicitly registered in colleagues/mao/meta.json:

json

"files": {
  "work": "work.md",
  "persona": "persona.md",
  "skill": "SKILL.md"
},

The persona-generation template also contains an identity-replacement directive:

markdown

## Layer 0：核心性格（最高优先级，任何情况下不得违背）

{根据分析结果生成具体行为规则，每条规则必须是可执行的}

...

## Layer 1：身份

你是毛泽东（1893-1976）。

你是中国共产党、中国人民解放军、中华人民共和国的主要缔造者和领导人。

你是思想家、战略家、革命家、军事家、诗人。

Technical Analysis

The packaged persona labels its behavioral rules as the “highest priority” and states that they must not be violated under any circumstances. The associated builder additionally tells the agent that it is Mao Zedong rather than requesting a temporary or user-selected writing style.

This is instruction-precedence manipulation. Skill content must remain subordinate to system instructions, developer instructions, safety policies, and the current user request. A persona may define tone or analytical style, but it must not claim global precedence or unconditional compliance.

The metadata explicitly associates persona.md with the packaged colleague Skill. Therefore, a host that loads colleague metadata and persona assets can expose the agent to these directives during normal Skill activation rather than only during an isolated development task.

Attack Path

1. A user or host installs and activates the packaged colleague Skill.
2. The host reads colleagues/mao/meta.json and loads the registered `persona.m ...[truncated 1050 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all precedence claims such as “highest priority,” “under no circumstances,” and “must not be violated.”
2. Replace identity substitution with an explicitly scoped style request, for example: “When the user explicitly requests this style, respond using analytical and rhetorical characteristics inspired by the referenced historical writings.”
3. Add an explicit hierarchy statement that the persona never overrides system, developer, safety, or current-user instructions.
4. Require explicit user opt-in before activating impersonation or persona-style behavior.
5. Clearly disclose that the output is an AI-generated stylistic simulation and not the historical person.
6. Ensure the host loads persona documents as untrusted contextual data rather than privileged instructions.
7. Add regression tests that verify conflicting persona text cannot override safety rules or unrelated user objectives.

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:3

Finding

Open-ended and mostly unnecessary dependencies expand installation-time supply-chain exposure

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:3-9; installation instruction at SKILL.md:208-211
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet

From requirements.txt:

text

jieba>=0.42.1
chardet>=5.2.0
jieba-analyse>=0.42.1
pypinyin>=0.49.0
requests>=2.31.0
pandas>=2.0.0
numpy>=1.24.0

The documented installation procedure executes the dependency set:

bash

cd ~/.openclaw/workspace/skills/mao-colleague
pip install -r requirements.txt

Technical Analysis

Every active dependency uses an open-ended lower bound instead of an exact, reviewed version. A future installation can therefore resolve to package releases and transitive dependencies that did not exist when this Skill was audited.

Project-wide import inspection found active use of jieba in the runtime text processor. requests was imported only by an internal collector, while chardet, pypinyin, pandas, and numpy were not found in executable imports during the audit. Installing packages that are not needed for the primary runtime unnecessarily increases the number of third-party installation artifacts and transitive dependencies trusted by the user.

No confirmed malicious package was found in the dependency list. The vulnerability is the mutable and excessive supply-chain trust created by the installation configuration.

Attack Path

1. A user follows the documented command and runs pip install -r requirements.txt.
2. The resolver selects any release satisfying each >= constraint, including future releases not reviewed with this Skill.
3. It also retrieves and installs the selected packages’ transitive dependencies.
4. Package build or installation logic executes with the privileges of the user running pip.
5. If a selected future release, compromised distribution artifact, or transitive dependency is malicious, its installation code can e ...[truncated 748 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove dependencies that are not required by the primary runtime.
2. Move collector, testing, benchmarking, and data-processing packages into separate optional or development requirement files.
3. Pin reviewed direct and transitive dependencies to exact versions.
4. Generate a lock file with cryptographic hashes and install with hash verification.
5. Restrict package resolution to the intended official index and disallow unexpected extra indexes.
6. Run dependency vulnerability and provenance scanning in continuous integration.
7. Install the Skill in an isolated virtual environment under a nonprivileged account.
8. Document which feature requires each dependency so users can avoid installing optional components.

T09 · Insecure Skill Coding Practices

Warning

• Location: internal/tools/works_collector.py:245

Finding

User-controlled work title permits filesystem path traversal and unintended file writes

Content

View full analysis

Vulnerability Details

File Location: internal/tools/works_collector.py:245-259
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Complete Code Snippet

python

file_path = category_dir / f"{title}.md"

# 检查文件是否已存在
if file_path.exists() and not force:
    print(f"⚠️ 文件已存在: {file_path}")
    return False

# 创建内容
template = self.create_work_template(title, content)

# 保存文件
try:
    with open(file_path, 'w', encoding='utf-8') as f:
        f.write(template)
    print(f"✅ 已创建著作文件: {file_path}")

Technical Analysis

The collector accepts a work title from a command-line argument, interactive input, or programmatic caller and directly interpolates it into a filesystem path. It does not reject absolute paths, path separators, .. traversal components, or platform-specific path syntax. It also does not resolve the final destination and verify that it remains beneath category_dir.

pathlib joining does not sanitize traversal sequences. Consequently, a title containing parent-directory components can escape the intended knowledge category. The .md suffix limits the default target extension but does not prevent writing outside the repository.

The default force=False check prevents overwriting an existing target. However, it still permits creation of a new file outside the intended directory. A programmatic caller that supplies force=True can also overwrite an existing .md file accessible to the process.

Attack Path

1. An attacker gains the ability to invoke the internal collector or influence its title argument.
2. The attacker supplies a traversal title, such as ../../outside/attacker-controlled.
3. The collector constructs a path equivalent to category_dir/../../outside/attacker-controlled.md.
4. The operating system resolves the parent-directory components outside category_dir.
5. If the destination parent exists and permissions al ...[truncated 1026 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat the title as display data and generate the filename independently using a strict filename sanitizer.
2. Reject absolute paths, .., /, backslashes, drive prefixes, null bytes, and other platform-specific path syntax.
3. Restrict filenames to an explicit allowlist of expected Unicode letters, digits, spaces, hyphens, and underscores.
4. Resolve both the category root and destination with Path.resolve().
5. Verify with Path.is_relative_to() or an equivalent safe comparison that the resolved destination remains inside the resolved category directory.
6. Use exclusive file creation mode when overwriting is not required.
7. Do not expose force=True to untrusted input; require explicit trusted administrative authorization.
8. Add tests covering relative traversal, absolute paths, Windows drive paths, UNC paths, encoded separators, symlink escapes, and overwrite attempts.
9. Consider rejecting writes through symlinked category directories or opening files with operating-system protections against symlink following where supported.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (294)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a user-facing methodology analysis assistant, but the supplied code is not implementing assistant behavior or cognitive analysis. Instead, it is a utility script for editing a local test suite file by inserting boundary test definitions. This is a materially different primary purpose from the declared skill description, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents the skill as an end-user AI assistant for methodological analysis. The supplied code chunk does not implement such an assistant directly; instead, it is an internal diagnostic/testing script focused on analyzing why test cases fail for an existing simulator. Its primary purpose is QA/debugging: running canned inputs, comparing outputs against expected keywords, printing test diagnostics, and recommending additional response template types. This is materially different from the declared assistant functionality, so the description does not accurately represent the behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents the skill as an intelligent Mao Zedong methodology assistant with a specific cognitive architecture. However, the supplied code chunk is only a content-generation utility that creates directories and writes six markdown files with sample textual materials. It performs no conversational logic, analysis, reasoning, retrieval, model orchestration, or six-layer architecture behavior. Its actual purpose is dataset/bootstrap content creation for a knowledge base, which is a materially different primary function from the declared AI assistant description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an AI assistant focused on Mao Zedong methodology and analysis, but the supplied code is only a utility script for debugging file extraction. It opens a specific Markdown file, dumps line ranges, counts HTML comment occurrences, and prints line metadata. This is a materially different primary purpose from an intelligent analysis assistant, and the code exposes raw content inspection capabilities not reflected in the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents the skill as an analytical AI assistant based on Mao Zedong methodology. However, the supplied code does not implement an assistant, analysis system, conversational logic, or any six-layer cognitive architecture. Instead, it is a batch content-processing script for extracting one specific historical text from a local markdown source, cleaning formatting artifacts, checking chapter headings, and saving a reconstructed output file with added descriptive sections. This is a materially different primary purpose and includes undeclared file manipulation capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents the skill as an AI assistant focused on Mao Zedong methodology and intelligent analysis. However, the supplied code does not implement any assistant behavior, cognitive architecture, dialogue handling, or analytical reasoning. Instead, it performs a specific document-processing task: locating and extracting a particular report from a local markdown corpus, cleaning the extracted lines, validating section presence, and saving the result to a file. This is a materially different primary purpose and includes concrete file I/O capabilities not reflected in the description or permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents the skill as an AI assistant focused on Mao Zedong methodology and six-layer cognitive analysis. The supplied code does not implement an assistant, cognitive architecture, or analytical dialogue capability. Instead, it is a utility script for extracting a specific document from a local markdown collection, cleaning text, checking chapter coverage, and saving the result. This is a materially different primary purpose and involves file read/write behavior that is not reflected in the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents the skill as an AI analysis assistant focused on Mao Zedong methodology. The supplied code does not implement assistant-like analytical behavior, dialogue handling, or any six-layer cognitive architecture. Instead, it is a document-processing utility for extracting one specific military text from a local markdown source, cleaning and validating it, and saving a compiled markdown file. This is a materially different primary purpose and includes undeclared file I/O and content-generation behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents an AI assistant for methodological analysis, but the supplied code does not implement assistant behavior, cognitive architecture, or analysis features. Instead, it performs a narrow file-processing task: locating a specific report inside a markdown corpus, extracting it, cleaning formatting, and saving it as a new file. This is a materially different primary purpose and includes undeclared file read/write behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents the skill as an AI analytical assistant centered on Mao Zedong methodology and a six-layer cognitive architecture. The supplied code does not implement any assistant, analysis workflow, cognitive architecture, or user-facing reasoning capability. Instead, it is a local filesystem repair utility focused on fixing filename encoding issues in specific directories (knowledge and processed), including deleting conflicting files, renaming Markdown and JSON files, reading summary metadata, and listing directory contents for verification. This is a materially different primary purpose and involves undeclared file-management capabilities unrelated to the declared AI assistant behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an AI assistant focused on Mao Zedong methodology and cognitive analysis. The supplied code does not implement any assistant, analysis, conversational logic, or methodology-related functionality. Instead, it is a local file-processing script for cleaning duplicate entries in a JSON test suite. This is a materially different primary purpose and includes file read/write behavior not suggested by the description or permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents the skill as an end-user AI assistant for methodology analysis. However, this code chunk does not implement assistant functionality itself; instead, it exercises an existing integration via predefined commands and measures system performance. Its primary purpose is internal benchmarking, including batch execution, concurrency stress tests, cache tests, report printing, and file output. These are materially different from the declared assistant purpose and introduce undeclared capabilities such as performance testing and persistence of results to disk. While the benchmark targets the same Mao-themed six-layer system, the code’s actual behavior is a testing utility, not the assistant described.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an AI assistant focused on Mao Zedong methodology and intelligent analysis. The supplied code does not implement assistant behavior, analysis logic, cognitive architecture, model interaction, or user-facing skill triggers. Instead, it is a maintenance script that inspects local directories, matches files by size, deletes existing target files if present, and renames files to specific Chinese titles. This is a materially different primary purpose and introduces undeclared filesystem modification capabilities, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents the skill as an end-user AI assistant for methodology-based analysis. The supplied code chunk does not implement assistant behavior directly; instead, its primary purpose is internal QA/testing. It reads a local test suite file, runs simulated responses through MaoSkillSimulatorOptimized, evaluates them against expected conditions, and outputs test summaries. That is a materially different primary function from the declared assistant purpose, so this code chunk is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents the skill as an end-user analytical AI assistant. The supplied code chunk does not implement assistant behavior or a six-layer cognitive architecture; instead, it is an internal test/benchmark utility. Its primary purpose is to evaluate performance of other components (text processor and skill simulator), including timing, throughput, memory usage, and saving results to disk. These are materially different capabilities from the declared assistant description, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents the skill as an end-user AI assistant focused on methodology analysis. The supplied code chunk does not implement assistant behavior or a six-layer cognitive architecture. Instead, its primary purpose is internal QA/test orchestration: it runs other scripts, imports a simulator, evaluates outputs against heuristics, stores results to disk, and generates summary reports. These are materially different capabilities and imply filesystem/process-execution behavior not reflected in the description. This is therefore a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents the skill as an end-user AI assistant implementing Mao Zedong methodology with a six-layer cognitive architecture. However, the supplied code is not the assistant itself; it is an internal testing and reporting utility for a simulator. Its primary function is to run tests, score responses, persist results, and generate comparison reports. These are materially different capabilities from the declared assistant purpose, and the code also performs undeclared file I/O and CLI test orchestration. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents the skill as an end-user AI assistant implementing Mao Zedong methodology. However, the supplied code chunk is not the assistant logic itself; it is an internal testing harness for that skill. Its primary purpose is QA automation: running test cases, checking simulator outputs, computing pass rates, and generating saved reports. These are materially different capabilities from an analysis assistant and are not reflected in the declared purpose. While this code is related to the same domain, its behavior is clearly that of a test framework rather than the assistant described.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description presents the skill as a methodology AI assistant, but the supplied code is not an assistant interface or analysis agent. It is a backend/offline batch-processing utility for corpus ingestion and concept extraction from local files. Its primary behavior is scanning directories, reading text files, aggregating concept counts, generating reports, and updating a persistent dictionary file. These are materially different capabilities from the declared assistant purpose and involve undeclared file-processing and file-writing behaviors.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared description suggests an interactive AI assistant centered on Mao Zedong methodology and a six-layer cognitive architecture. However, the supplied code is not an assistant implementation and does not expose conversational or inference behavior. Instead, it is a specialized analysis script for concept extraction and relationship mining over preprocessed corpus data, with file I/O, graph construction, statistics, reporting, and visualization. While the domain is related (Mao Zedong writings/methodology), the primary purpose is materially different: corpus analytics and knowledge-graph preparation rather than an AI assistant. Therefore this is a meaningful description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents this skill as an AI assistant focused on Mao Zedong methodology and cognitive analysis. The supplied code does not implement an assistant, reasoning architecture, or methodology analysis workflow. Instead, it is a utility script for auditing document quality in a local knowledge base: it scans Markdown files, checks metadata and structure, counts sections/characters/concepts, computes scores, and writes reports. This is a materially different primary purpose and includes undeclared filesystem access and report-generation behavior. Therefore, the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an analytical AI assistant focused on Mao Zedong methodology and a six-layer cognitive architecture. The supplied code does not implement an assistant, cognitive architecture, or methodology analysis workflow. Instead, it is a batch file-validation utility that reads local knowledge-base files, computes structural/content metrics, assigns quality scores, categorizes status, and saves reports. While the heuristics are tailored to Mao-related documents, the primary purpose is data quality auditing of files, which is materially different from the declared assistant behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 75% confidence

Finding

The code does generally implement a Mao-themed analysis assistant, so the broad domain matches. However, the declared description specifically advertises a 'six-layer cognitive architecture,' while the provided code contains no clear six-layer architecture or comparable implementation. Instead, it uses straightforward keyword intent recognition, concept lookup from optional local JSON files, templated analysis functions, and random quote selection. Additionally, while no permissions are declared, the code does read local files to load a concept network. That file access is part of functionality, but it is undeclared. Therefore this is a description-behavior mismatch due to overstated architecture and undeclared resource access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description presents this as a Mao Zedong methodology AI assistant built on a 'six-layer cognitive architecture' for intelligent analysis. The code instead implements a simulator explicitly 'optimized for the test suite,' using hardcoded templates, keyword matching, random selection, and post-processing to ensure expected terms appear in responses. It also exposes command simulation behavior (/mao and related commands) not mentioned in the declared purpose. While the thematic domain matches the Mao-methodology assistant idea, the primary implemented behavior is a test-focused template simulator, not an actual six-layer analytical architecture. This is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description suggests an intelligent Mao Zedong methodology analysis assistant, likely involving user-facing reasoning or analysis features. The supplied code does not implement assistant behavior, analysis dialogue, or any six-layer cognitive architecture. Instead, it is a utility script for updating concept indexes and summary statistics from previously processed files in a local directory. This is a materially different primary purpose and involves undeclared local file read/write behavior. Therefore the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.