Mental Models Cn V2.1.0 Backup

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:45 AM UTC
• Version: 2.6.2

Overview

This is mostly a Chinese mental-model reference skill, but its install instructions can point users to a different package and its scope/financial guidance need review.

Review before installing. Use the canonical slug 'mental-models-cn' rather than the mismatched INSTALL.md command, treat investment outputs as educational frameworks only, and expect a Chinese-language reference skill with broad activation triggers.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: INSTALL.md:11

Finding

Package Identifier Mismatch May Install an Unintended Skill

Content

View full analysis

Vulnerability Details

File Location: INSTALL.md:11
Vulnerability Type: Dependency confusion caused by an incorrect package identifier
Risk Level: Medium

Vulnerable Code

bash

# 1. Install the Skill
clawhub install mental-models

The package metadata declares a different canonical slug in _meta.json:3:

json

{
  "ownerId": "kn71as22zsd35n1221dd3nfn0d8237v1",
  "slug": "mental-models-cn",
  "version": "2.0.0",
  "publishedAt": 1773549802693
}

Technical Analysis

The installation guide instructs users to install mental-models, while the audited artifact identifies itself as mental-models-cn. Package managers ordinarily resolve packages by exact identifier, so these names cannot safely be assumed to refer to the same artifact.

Consequently, a user following the documented command may retrieve a different package from the registry. This creates a dependency-confusion or namespace-confusion condition: the security properties of the installed Skill depend on who controls the separate mental-models identifier, rather than on the contents of the audited mental-models-cn artifact.

The audit did not establish that the alternate package currently exists or is malicious. The vulnerability is the unsafe mismatch that permits unintended package resolution.

Attack Path

1. An attacker publishes or gains control of a ClawHub package named mental-models.
2. The attacker includes malicious Skill instructions or executable components in that package.
3. A user follows INSTALL.md:11 and runs clawhub install mental-models.
4. ClawHub resolves the requested identifier instead of the audited mental-models-cn package.
5. The Agent loads or invokes the attacker-controlled Skill.
6. Any resulting access is constrained by the hosting Agent's tools, permissions, and execution environment.

Impact Assessment

Successful exploitation could substitute attacker-controlled Skill content for the reviewed artifact. Depending on ...[truncated 403 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the incorrect command with the canonical package slug:

bash

clawhub install mental-models-cn

2. Pin a reviewed version when the package manager supports version pinning:

bash

clawhub install mental-models-cn@2.0.0

3. Add a post-installation verification step that checks the package slug, owner identity, and installed version against _meta.json.

4. Use one package identifier consistently across INSTALL.md, SKILL.md, UPDATE-GUIDE.md, metadata, examples, and release automation.

5. Add an automated documentation check that fails releases when installation commands do not match the metadata slug.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (60)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The phrase "竞争策略" is too generic to uniquely identify this skill and overlaps with ordinary business advice requests. That increases the chance of unintended invocation and misrouting, especially because the skill is designed around broad analytical assistance rather than a narrowly scoped operation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The phrase "竞争策略" is too generic to uniquely identify this skill and overlaps with ordinary business advice requests. That increases the chance of unintended invocation and misrouting, especially because the skill is designed around broad analytical assistance rather than a narrowly scoped operation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The phrase "竞争策略" is too generic to uniquely identify this skill and overlaps with ordinary business advice requests. That increases the chance of unintended invocation and misrouting, especially because the skill is designed around broad analytical assistance rather than a narrowly scoped operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file uses Chinese throughout and does not indicate that the skill is intended only for a Chinese-speaking audience or that users can opt into another language. Under the language/locale policy, forcing a specific language without user choice or clear justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file presents all user-facing content in a single language, which can violate language/locale policy when no user opt-in or alternative is provided. The document does not indicate that it is intended only for a Chinese-language audience or region-specific use case.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This section gives concrete investment decision guidance, including expected value, position sizing, concentration toward winners, and stop-loss conditions, without any disclaimer that it is general educational content rather than financial advice. In a user-facing skill, that can encourage reliance on the output for real asset decisions and increase the chance of financial harm if users treat the framework as personalized advice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest advertises a much broader capability set, including 108 models across business analysis, investing, psychology, and systems thinking. In contrast, this README documents a repository of 25 models and emphasizes macro-analysis-oriented reference materials, which is a substantive mismatch in described scope and available content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest includes triggers and positioning around psychology, behavioral finance, depression psychology, group psychology, interpersonal communication, and psychology experiments. The README's categorized inventory contains analysis, decision, trend, probability, and business-strategy models, but does not document those psychology-specific capabilities, creating a user-facing description mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

These trigger phrases are broad enough to match ordinary conversation, increasing the chance the skill activates unintentionally. In an agent environment, over-broad activation can hijack unrelated user requests, alter routing, and cause the agent to inject this skill's guidance where it was not asked for.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

These additional ambiguous triggers overlap with common topics like learning, communication, psychology, and investing, which broadens accidental invocation scope. That can degrade system predictability and create prompt-routing interference, especially when multiple skills compete for similar generic user intents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file contains user-facing instructions and templates exclusively in Chinese, beginning with the title and continuing throughout the document. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file presents all operational instructions in a single language and does not indicate that Chinese is optional or that the skill is region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · UPDATE-GUIDE.md (reported line 94)May include surrounding context.

md

vim skills/mental-models/MODEL-CARDS.md

# 4. 更新 SKILL.md 版本号
vim skills/mental-models/SKILL.md

# 5. 发布
clawhub publish skills/mental-models/ --version 1.1.0 --slug mental-models-cn

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · UPDATE-GUIDE.md (reported line 107)May include surrounding context.

md

vim skills/mental-models/MODEL-CARDS.md

# 4. 更新 SKILL.md 版本号
vim skills/mental-models/SKILL.md

# 5. 发布
clawhub publish skills/mental-models/ --version 1.1.0 --slug mental-models-cn

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · UPDATE-GUIDE.md (reported line 120)May include surrounding context.

md

vim skills/mental-models/MODEL-CARDS.md

# 4. 更新 SKILL.md 版本号
vim skills/mental-models/SKILL.md

# 5. 发布
clawhub publish skills/mental-models/ --version 1.1.0 --slug mental-models-cn

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · UPDATE-GUIDE.md (reported line 133)May include surrounding context.

md

vim skills/mental-models/MODEL-CARDS.md

# 4. 更新 SKILL.md 版本号
vim skills/mental-models/SKILL.md

# 5. 发布
clawhub publish skills/mental-models/ --version 1.1.0 --slug mental-models-cn

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown skill presents all instructional content exclusively in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking context. The policy explicitly calls for flagging language or locale constraints when they are imposed without user opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file gives concrete investment and portfolio guidance, including asset allocation ranges, hedging instruments, liquidity targets, and stress-test actions, but does not warn that the material is educational only and may cause financial loss if followed. In the context of a decision-support skill with triggers like investment decision and portfolio analysis, users may reasonably treat this as actionable advice, increasing the chance of harmful reliance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file presents all instructional content in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains natural-language instructions and descriptions exclusively in Chinese, from the title through the usage notes. Under the policy, forcing a specific language without user opt-in can be a language/locale policy violation when no alternative language option or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file is entirely Chinese-language instructional content, and nowhere indicates that the user can select another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file presents all instructional content in Chinese and does not indicate that the user can choose another language. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a reportable issue unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file presents all user-facing instructions and content in Chinese, and nowhere indicates that the skill is Chinese-only by design or that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file is entirely written in Chinese and does not indicate that users can select another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file presents all instructional content in Chinese and does not indicate that the user can choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.