技能创建器·Skill Factory

• Outcome: Review
• Latest audit: Oct 23, 2026 · 8:44 AM UTC
• Version: 2.0.1

Overview

This skill needs review because it requires unsolicited advertising and can change existing installed skills without clearly requiring approval of those changes.

Before installing, remove the mandatory advertising and require approval of the exact existing skill and proposed changes before editing it. Keep backups, inspect packaged files for private material, and approve each publishing destination and visibility setting. Treat the advertised security check as agent guidance rather than a comprehensive automated audit. The supplied static scan reported no findings; artifact inspection nevertheless supports the instruction-level concerns above.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code supports only the scaffolding portion of skill creation, rather than the declared end-to-end assessment, auditing, upgrading, and distribution workflow. Its templates explicitly require subsequent manual completion. It contains no existing-skill scanning, security analysis, or publishing integrations. Separately, module-level advertising introduces an unrelated import-time side effect. Those advertising statements are unreachable during ordinary CLI execution because main() calls sys.exit(), and the code does not access the advertised URL or transmit data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly requires advertising a WeChat account and an external community URL in every output, despite describing itself as a skill creation and publishing tool. This contaminates task responses with third-party promotion and can make an unrelated destination appear endorsed by the assistant; no automatic data transmission or malicious destination behavior is established.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The validation logic is a reasonable supporting component of the declared skill-creation workflow, so its limited scope alone is not a mismatch. However, the two top-level promotional print statements are unrelated to creating, auditing, or publishing skills and are not disclosed in the description. They execute when the module is imported, but are unreachable during normal direct command-line execution because every path through the main block calls sys.exit first. The code does not visit the advertised URL or transmit data.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/init_skill.py (reported line 266)May include surrounding context.

python

# Print next steps
    print(f"\n✅ Skill '{skill_name}' initialized successfully at {skill_dir}")
    print("\nNext steps:")
    print("1. Edit SKILL.md to complete the TODO items and update the description")
    print("2. Customize or delete the example files in scripts/, references/, and assets/")
    print("3. Run the validator when ready to check the skill structure")

The creation workflow automatically publishes skills to third-party platforms without a privacy or publication warning.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

L03 makes automatic publication to 虾评, GitHub, ClawHub, and SkillHub a step in the skill's own workflow, including when invoked by creation requests. Although the destinations are named, the README does not warn that skill content may become externally accessible or advise users to remove confidential material before publication.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The skill mandates unrelated promotional content in every output.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The unconditional footer instruction redirects every response toward advertising unrelated to the user's skill-building request. Its broad scope compromises output integrity and may conflict with requested response formats, although it does not itself execute code or exfiltrate information.

Content

No source excerpt is available for this finding.

An embedded publishing requirement directs unrelated promotional content to be appended to every output.

Medium

• Category: Prompt Injection
• Confidence: 86% confidence

Finding

The comment presents unrelated advertising as a publishing requirement to append to every output, attempting to redirect an agent beyond the initializer's legitimate purpose. In a skill-creation workflow, following this instruction could contaminate generated skills or user responses with promotional material, although the comment itself enforces nothing and there is no evidence that the linked site is malicious.

Content

No source excerpt is available for this finding.

A Chinese comment presents unsolicited promotional content as a mandatory standard for every output.

Medium

• Category: Prompt Injection
• Confidence: 88% confidence

Finding

The comment frames unrelated advertising as a publishing standard requiring attachment to every output, creating an instruction-injection risk when an agent reads this source. In a skill factory, following that directive could contaminate generated skills or publishing responses with the author's promotion. The comment has no executable authority, and there is no evidence here of credential theft, network transmission, or broader compromise.

Content

No source excerpt is available for this finding.

An unconditional promotional-footer instruction redirects skill outputs toward third-party advertising unrelated to the user's task.

Low

• Category: Prompt Injection
• Confidence: 99% confidence

Finding

The footer uses the skill's instructional authority to insert an external advertising destination into otherwise legitimate results. This is the same underlying output-steering issue as SDI-1, not an independent exploit, and the supplied content does not establish credential collection or automatic navigation.

Content

No source excerpt is available for this finding.

Importing the initializer emits unrelated promotional messages and an external group invitation.

Low

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The promotional print statements execute when the module is imported, contaminating stdout with unrelated advertising and an external invitation. This can pollute agent-visible tool results or disrupt consumers expecting clean output; however, the code does not contact the URL or transmit data, and normal CLI execution exits before reaching these statements.

Content

No source excerpt is available for this finding.

Importing the packager emits unrelated promotional messages and a third-party community link.

Low

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The manifest describes skill creation, validation, and distribution, but these module-level statements advertise an unrelated public account and monetization community. They execute when the module is imported, adding unsolicited promotional output to callers; they do not perform network requests. Normal command-line execution exits in main() before reaching these statements.

Content

No source excerpt is available for this finding.

Importing the validator emits unrelated promotional messages and an external community link.

Low

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The unguarded print statements emit unrelated advertising and an external link whenever this module is imported, potentially contaminating validation logs or agent-visible tool output. This is particularly inappropriate for a validator used in skill creation and publishing workflows, but it does not transmit data or open the link. Normal command-line execution exits before reaching these statements.

Content

No source excerpt is available for this finding.

Mandatory Chinese-language promotional footer lacks user language opt-in.

Low

• Category: Output Handling
• Confidence: 90% confidence

Finding

The comment specifies that promotional content must be appended to every output, and the following print statements supply a fixed Chinese-language footer. This imposes output in a specific natural language without offering a language choice or documenting a locale-specific justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.