以史为鉴

• Outcome: Pass
• Latest audit: May 27, 2026 · 10:33 PM UTC
• Version: 0.1.4

Overview

This skill is a disclosed Chinese-history decision-support tool with local-only case retrieval and an explicit local case-saving feature, but users should be aware it can steer broad strategy questions into historical analogy and can persist added cases.

Install only if you want broad Chinese-history analogy support for strategy-style questions. Review any generated case JSON before allowing it to be saved, avoid storing sensitive private details in user_cases.json, and treat organizational-control outputs as prompts for lawful governance and risk analysis rather than direct tactics.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly describes workflows where the host agent can transform natural-language input into structured JSON and write it into a persistent local case library, but it does not warn users that this changes on-disk state and may permanently retain user-provided content. In an agent setting, silent persistence can surprise users, create privacy/data-retention issues, and allow unintended poisoning of future retrievals if unreviewed content is stored for later use.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill advertises activation for very broad phrases like general strategy, reform, conflict, competition, and decision questions, which can cause the host agent to invoke it even when the user did not request historical analogy. This creates a prompt-scope problem: the skill can unnecessarily steer responses into its framing, reducing user intent fidelity and potentially overriding more appropriate domain-specific handling.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The instruction to trigger based on what the question 'essentially' asks invites implicit activation from subjective interpretation instead of explicit consent. In an agent environment, this can lead to overreach, where the skill reframes ordinary questions through a historical-analysis lens and crowds out safer or more relevant tools.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly directs the agent to write user-supplied content into a local persistent file (`data/user_cases.json`) and promises future automatic loading, but it does not require any warning, confirmation, or consent before modifying stored data. This creates a real persistence risk: users may unknowingly cause durable state changes, and adversarial or malformed content could be added to a corpus that influences later retrievals or downstream behavior.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The manifest description defines activation triggers far beyond the named Chinese-history sandbox, including generic organization, business, and team strategy topics. Overly broad routing can cause the skill to be invoked for many ordinary strategic discussions, increasing the chance of unneeded tool takeover, off-topic guidance, or policy-bypassing behavior through historical analogy framing.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The manifest hard-codes the skill language as zh-CN without indicating fallback behavior or user choice. In multi-language environments this can lead to unintended invocation, misunderstood outputs, or reduced transparency if users are routed into a Chinese-language skill they did not request.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to directly invoke a local repository-writing script and prioritizes doing so over asking the user to edit files manually, but it does not require explicit user confirmation or a clear warning that a persistent file modification will occur. This creates a risky write primitive: a user could be led into unintended repository changes, and if downstream tooling is weakly validated, crafted input could pollute stored data or trigger unsafe behavior in the write path.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The manifest description defines very broad activation triggers, including generic organization, business, team strategy, competition, alliances, leadership replacement, and timing questions. In an agent ecosystem, this can cause the skill to activate outside a narrow history-analogy context and influence ordinary strategic discussions, increasing the chance of overreach, unwanted tool selection, or policy evasion through reframing sensitive advice as 'historical sandbox' analysis.

Ssd 4

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly frames the response around historical coups and power-consolidation tactics, then asks for comparative paths such as 'seize the center,' 'use rules to restructure power,' and 'quickly settle the situation.' Even without explicit illegal instructions, this steers the agent toward advising coercive organizational manipulation and escalation in a real internal corporate power struggle, which can facilitate abuse of authority, retaliation, or harmful noncompliant conduct.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pytest>=8.3.0

• Confidence: 92% confidence
• Finding: The dependency is specified with a lower bound only (`pytest>=8.3.0`), which allows future, unreviewed versions to be installed. This creates supply-chain and reproducibility risk because a later release could introduce breaking changes or a vulnerable version without the project explicitly opting in.

Known Vulnerable Dependency: pytest — 1 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling)

Low

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: The file declares `pytest`, and the supplied static analysis indicates an advisory affecting this package (CVE-2025-71176 related to tmpdir handling). If an affected version is resolved at install time, test execution could expose the environment to unsafe temporary-directory behavior, especially in CI or shared runners.

Static analysis

No suspicious patterns detected.