Natural Language Response

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:58 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Chinese-focused reply formatter that changes tone and stores limited local conversation state, with no evidence of exfiltration, deception, or destructive behavior.

Install this only if you want a Chinese-oriented, casual reply-style layer that may automatically rewrite every outgoing response. Review or disable it for formal work, safety-critical answers, multilingual conversations, or any environment where local session metadata should not be retained.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

清除状态（重置对话计数）：
```bash
rm memory/reply_state.json
# 或编辑 JSON 手动清理特定会话
```

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The README states the skill is 'automatically applied' and 'intercepts all replies sent to users,' which gives it global influence over outbound model behavior without documenting any scope limits, opt-in, or exclusions. In a prompt/skill system, broad automatic interception increases the chance of unintended modification of sensitive, safety-critical, or system-generated responses, making policy bypasses or output corruption more likely even if the stated goal is stylistic.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The README states that language support is 'currently mainly optimized for Chinese,' while the skill auto-applies to all replies. Because no user choice, opt-in, or explicit locale restriction is provided, this can conflict with language/locale policy expectations for multilingual users.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill describes capabilities that read and write local state (`memory/reply_state.json`) but does not declare any tool scope or permission boundaries. Undeclared file access makes the skill harder to review and constrain, and can enable broader-than-expected data access or persistence if the runtime infers capabilities automatically.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly prioritizes Chinese behavior and says its regex and processing are optimized for Chinese without any user opt-in or negotiation. While not a classic exploit primitive, it can cause unauthorized behavior changes, degraded output quality, and policy or UX issues when applied to users expecting another language or a neutral style.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The note that the skill runs automatically before message sending is a broad trigger with no precise activation conditions, exclusions, or user opt-in. A broadly auto-invoked formatter can unexpectedly alter outputs in unrelated or sensitive contexts, including formal, safety-critical, or multilingual interactions.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The script's user-facing output is presented in Chinese, including the installation banner and error message, with no opt-in, fallback, or indication that the skill is intended only for Chinese-speaking users. This is a natural-language locale policy issue because the file enforces a specific language for interaction without user choice.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: Line L110 says there is 'No support for languages other than Chinese yet,' and the surrounding examples and topic detection design are explicitly Chinese-specific. This is a natural-language policy concern because it hard-codes a language limitation without presenting user choice or a justified region-specific scope.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code embeds Chinese greeting patterns, Chinese casual replacements, and Chinese-specific filler and punctuation rules as the default behavior for all formatted replies. That enforces a specific language/locale style without opt-in or documented scope, which matches the policy category for forced language or locale behavior.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill persists per-session conversation metadata to disk even though its stated purpose is only reply-style formatting. This creates unnecessary data retention and expands the attack surface: session identifiers, timing, and topic data can accumulate locally and be accessed by other components or users on the host.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code performs local filesystem read/write operations for state management without a clear need tied to a pure formatting skill. Unnecessary file I/O can expose conversation-derived state, enable cross-session leakage, and create security/privacy issues if the runtime environment is shared or logs/backups capture the state file.

Session Persistence

Medium

• Category: Rogue Agent

Content

}

    def _save_state(self):
        """Save state to file."""
        os.makedirs(os.path.dirname(self.state_file), exist_ok=True)
        with open(self.state_file, 'w', encoding='utf-8') as f:
            json.dump(self.state, f, ensure_ascii=False, indent=2)

• Confidence: 94% confidence
• Finding: Saving session state to disk introduces persistent retention of conversation-associated data beyond the active interaction. In the context of a reply-humanization skill, that persistence is not obviously necessary, so it increases privacy risk and the chance of unintended disclosure through local access, backups, or multi-tenant environments.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This code file contains numerous user-facing strings such as scenario labels and conversation text exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a locale/language policy issue, and this file provides no indication that the skill is intentionally restricted to a Chinese-language context.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The value for "current_topic" is a Chinese phrase, which indicates locale-specific natural-language behavior embedded in the skill state. For all file types, locale-specific language should not be forced unless the skill offers user choice or clearly documents why a specific language is required.

Static analysis

No suspicious patterns detected.