詹明明·哪里会被划走

• Outcome: Review
• Latest audit: Sep 6, 2026 · 12:35 PM UTC
• Version: 0.2.7

Overview

This script-review skill is not malware, but it can let external vault rules and saved feedback steer future agent behavior without clear user control.

Install only if you are comfortable with the skill reading local zmm vault rules and memory, and writing script-feedback lessons for future use. Review the vault files it will load, keep them user/project scoped, and avoid storing sensitive business metrics or private script material unless you have a way to inspect and delete the memory entries.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:19
• Finding: Untrusted External Vault Rules Override Packaged Skill Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:19-21`; `references/规则卡.md:4` **Vulnerability Type**: External instruction precedence without validation **Risk Level**: Medium ### Complete Code Snippet The following is an English translation of the complete relevant source segment: ```markdown First read `zmm/references/Family Convention.md` (if it cannot be read, explicitly state that the convention cannot be read and red lines cannot be guaranteed, then stop; do not substitute remembered content), then read `zmm/references/Interaction Specification.md` (reading it once is not sufficient: conclude according to Section 4 with Recap, Before/After, and numbered next-step options; when information is missing, ask multiple-choice questions under Section 4, one question at a time; see Section 5 for exceptions), then read memory from `{vault}/08-skill-memory/zmm-flow/` and `_common/`. The theoretical source is `zmm/references/Content Theory Foundation.md`. The built-in criteria are in `references/Rule Card.md`. Read them before beginning. When corresponding rule files exist in `{vault}`, the vault takes precedence and the rule card serves as the baseline. ``` `references/规则卡.md:4` additionally states: ```markdown When the author's environment contains corresponding rule files in `{vault}`, the vault takes precedence and this file is the baseline. If the two locations conflict, follow the vault first and then return to update this file. ``` ### Technical Analysis The Skill explicitly gives external vault files higher precedence than the rules packaged with and reviewed as part of the Skill. It also depends on family and interaction documents that are not present in the audited project. Consequently, the reviewed package is not a complete representation of the instructions that will control the Agent at runtime. There is no documented allowlist, schema validation, integrity check, provenance check, trust-boundary enforcement, or restriction pre ...[truncated 1838 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Package all mandatory family, interaction, and safety rules inside the versioned Skill directory. 2. Remove blanket precedence for vault content. Packaged safety and scope restrictions must always take priority. 3. Treat vault files as untrusted data rather than executable instructions. 4. Accept only a strict structured schema for external preferences, such as approved tone settings, prohibited phrases, and user-scoped examples. 5. Reject unknown keys, free-form directives, tool instructions, and content attempting to override system or packaged rules. 6. Restrict reads to canonical paths under a dedicated user-specific directory and defend against path traversal or symbolic-link redirection. 7. Record the source, version, owner, and integrity hash of every external rule file applied at runtime. 8. Require explicit user confirmation when external rules have changed since the previous invocation. 9. Fail closed when mandatory packaged policy files are missing instead of replacing them with mutable external instructions. 10. Add tests proving that vault content cannot override safety constraints, expand tool privileges, or alter the Skill's declared task. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:131
• Finding: User Feedback Is Written to Persistent Behavioral Memory Without Trust Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:131-132`; supporting behavior at `SKILL.md:19` and `references/规则卡.md:46` **Vulnerability Type**: Persistent memory poisoning through unvalidated feedback **Risk Level**: Medium ### Complete Code Snippet The following is an English translation of the complete relevant source section: ```markdown ## Memory Before finishing, check what type of revision the user rejected and record it as a correction, such as: "This is not repetition; I emphasized it intentionally." Check which types of breakpoints were verified by completion-rate or retention data from `/zmm-retro` to actually damage completion, and record them as effective methods together with the numerical values. Write the result to `08-skill-memory/zmm-flow/` after checking for duplicates. ``` The Skill also instructs the Agent to read this memory in later runs: ```markdown Then read memory from `{vault}/08-skill-memory/zmm-flow/` and `_common/`. ``` The supporting rule card requires recurring profile updates: ```markdown Translate the author's feedback into entries in the style profile instead of using it only for the current revision. After each write-back, update the profile's modification date and register the new sample. ``` ### Technical Analysis The Skill creates a feedback loop in which user statements and interpreted performance data are stored as durable behavioral guidance and loaded during later invocations. A duplicate check does not establish that an entry is trustworthy, accurate, authorized, correctly scoped, or safe. The documented process lacks: - Explicit consent before persistence. - Per-user and per-project isolation. - Provenance and author identity controls. - A structured schema separating observations from instructions. - Validation of purported retention statistics. - Expiration or retention limits. - Review, correction, and deletion controls. - A rule preventing memory from overriding packaged policy. - Def ...[truncated 2077 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed user approval before writing any session-derived information to persistent memory. 2. Disable persistence by default and provide a clearly identified opt-in action. 3. Isolate memory by authenticated user, workspace, project, and Skill. 4. Store observations in a strict schema with fields for source, author, timestamp, confidence, evidence, scope, and expiration. 5. Never store raw free-form feedback as an executable instruction. 6. Strip or reject directives that attempt to alter safety rules, tool permissions, system instructions, memory policy, or unrelated tasks. 7. Verify claimed performance metrics against an authorized data source before marking them as validated methods. 8. Keep packaged safety and task-scope rules immutable and higher priority than all stored memory. 9. Present proposed memory entries to the user for confirmation before committing them. 10. Provide interfaces to inspect, correct, export, and delete stored entries. 11. Apply retention limits and automatically expire unverified preferences and performance findings. 12. Log every memory read and write, including the session and identity responsible for the change. 13. Add adversarial tests demonstrating that crafted feedback cannot become a cross-session instruction or affect another user. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill declares very broad natural-language triggers such as '这稿子顺不顺', '哪里会划走', and 'does this script flow', which can overlap with ordinary conversation about writing quality. That can cause unintended invocation of the skill, leading the agent to apply this skill's specialized workflow, memory access, and follow-up behavior when the user did not explicitly intend it.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to write interaction-derived information into persistent memory ('08-技能记忆/zmm-flow/') based on user feedback and performance data, but it does not require clear user notice or consent. This creates a privacy and data-governance risk because user preferences, corrections, and potentially sensitive business performance information may be stored across sessions without transparent disclosure.

Static analysis

No suspicious patterns detected.