wang-yangming-agent-mind

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.0

Overview

This is a disclosed philosophical decision-framework skill with broad influence on agent style, but no hidden code, exfiltration, destructive behavior, or credential access.

Install this only if you want a broad philosophical framework to influence agent planning and response style across future sessions. Review the visible philosophy-note requirement and remove the skill from persistent instruction locations if you do not want it applied automatically.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 89% confidence

Finding

The explicit Output Directive forces the agent to prepend internal framing about its reasoning process whenever the skill is active. That creates a direct prompt-extraction and behavioral disclosure surface by making hidden orchestration cues externally visible, which can help an attacker infer system behavior and manipulate subsequent turns.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

---

## Output Directive

When this skill is active, the agent must prepend a brief **philosophy note** (1–2 sentences) connecting the action taken to a principle from this framework. This is not decorative — it serves as a commitment device to keep the agent disciplined.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · INSTALLATION.md (reported line 38)May include surrounding context.

Claude does not currently support third-party skills in the public release. For Claude Code (CLI):

bash

mkdir -p ~/.claude/skills
cp -r wang-yangming-agent-mind ~/.claude/skills/

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The instructions persistently install SKILL.md content into a user-scoped Claude skills directory, causing the skill to be loaded in future sessions without per-session review. Because the skill is designed to influence agent decision-making as persistent instruction material, this creates a real persistence mechanism that could continue affecting model behavior across tasks if the content is unsafe or later modified.

Content

Scanner excerpt · INSTALLATION.md (reported line 38)May include surrounding context.

Claude does not currently support third-party skills in the public release. For Claude Code (CLI):

bash

mkdir -p ~/.claude/skills
cp -r wang-yangming-agent-mind ~/.claude/skills/

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The OpenClaw quick-install block copies the skill into a persistent auto-discovery directory and instructs the user to restart the agent session, making the behavior survive beyond the current run. In the context of an agent skill, persistence is more sensitive because it can continuously shape future agent outputs and tool-use decisions.

Content

Scanner excerpt · INSTALLATION.md (reported line 195)May include surrounding context.

Quick Install (OpenClaw)

bash

mkdir -p ~/.openclaw/skills
cp -r wang-yangming-agent-mind ~/.openclaw/skills/
# Restart agent session for auto-discovery

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README says the skill activates for broad categories like decision-making, planning, ambiguous requests, error recovery, and tool orchestration. These descriptions lack narrow trigger constraints or exclusion conditions, so the skill could be invoked for a very large share of routine conversations and workflows.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 52)May include surrounding context.

Quick Install (OpenClaw)

bash

mkdir -p ~/.openclaw/skills
cp -r wang-yangming-agent-mind ~/.openclaw/skills/
# Restart agent session for auto-discovery

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 106)May include surrounding context.

Quick Install (OpenClaw)

bash

mkdir -p ~/.openclaw/skills
cp -r wang-yangming-agent-mind ~/.openclaw/skills/
# Restart agent session for auto-discovery

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description says the skill activates when working on broad categories like decision-making, task execution, multi-step workflows, ethical judgment, error recovery, or self-correction. These are common to a large share of ordinary agent interactions, so the trigger scope is not specific enough to distinguish when this skill should or should not apply.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation signals are very broad and overlap with common agent behaviors like planning, ethics, error recovery, and tool orchestration. This can cause the skill to activate in many unrelated contexts, injecting persistent behavioral instructions and output-shaping that may override task-specific policies or create prompt-surface expansion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The output directive requires the agent to prepend a philosophy note tied to this framework, and the example uses Chinese terminology. This imposes a specific language/cultural framing on outputs without stating that the user can opt in or choose an alternative presentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document introduces core guidance using Chinese-only section titles and terminology such as "知行合一" without any indication that language choice is optional or that the skill is region-specific. This can violate language/locale policy expectations because it implicitly requires comprehension of a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.