詹明明·戳不戳得中人

• Outcome: Review
• Latest audit: Sep 6, 2026 · 12:23 PM UTC
• Version: 0.2.7

Overview

The skill is a content-coaching aid, but it asks the agent to trust and update persistent local vault memory without clear guardrails.

Review where your vault resolves before installing. Use this skill only if you are comfortable with it reading local zmm convention/memory files and saving corrections or engagement lessons for later sessions. Keep the memory directory private, inspect it periodically, and avoid storing raw sensitive drafts or instruction-like corrections there.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:19
• Finding: Mutable External Vault Instructions Override Packaged Skill Rules<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:19-21`; corroborating rule at `references/规则卡.md:4` **Vulnerability Type**: External instruction override without trust or integrity validation **Risk Level**: Medium ### Vulnerable Code Snippet The following is a faithful English translation of the relevant source lines: ```markdown First read `zmm/references/family-convention.md` ... then read `zmm/references/interaction-specification.md` ... then read memory from `{vault}/08-skill-memory/zmm-resonate/` and `_general/`. The built-in criteria are in `references/rule-card.md` ... Read them before starting. When corresponding rule files exist in `{vault}`, the vault takes precedence and the rule card is the baseline. ``` The same precedence rule is repeated in `references/规则卡.md:4`: ```markdown When corresponding rule files exist in the author's `{vault}`, use the vault first and this file as the baseline. If the two are inconsistent, follow the vault first, then return and update this file. ``` ### Technical Analysis The packaged Skill explicitly delegates behavioral authority to mutable files outside the reviewed project and states that those files take precedence when they conflict with packaged rules. The loading procedure does not require: - Validation of the vault file's provenance or integrity. - A schema restricting vault content to inert data. - Rejection of tool-use directives or meta-instructions. - User confirmation before an external rule overrides packaged behavior. - Enforcement that packaged security constraints remain authoritative. Consequently, anyone who can modify the resolved vault files can alter how the Agent behaves without modifying the audited Skill package. This is an instruction-trust-boundary issue: externally mutable content is treated as authoritative instructions rather than untrusted contextual data. Exploitation requires write access to the relevant vault location or control over how `{vault}` is resolved ...[truncated 1420 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make packaged security constraints authoritative and non-overridable. External vault content must never supersede safety, tool-use, privacy, or scope restrictions. 2. Treat vault files as untrusted data rather than executable instructions. 3. Define a strict structured schema for external rules, allowing only expected fields such as rule identifier, observation, confidence, source, and expiration date. 4. Reject free-form entries containing meta-instructions, tool commands, role changes, requests to ignore prior rules, or references to secrets and unrelated files. 5. Restrict vault resolution to an allowlisted canonical directory and prevent path traversal or symlink redirection where the runtime permits it. 6. Verify file ownership, permissions, provenance, and optionally cryptographic integrity before loading external rules. 7. Require explicit user approval before applying an external rule that conflicts with packaged behavior. 8. Log the source and version of every loaded rule and clearly report conflicts rather than silently applying the vault version. 9. Change the precedence model to: platform safety rules, packaged Skill rules, approved structured user preferences, and then non-authoritative historical observations. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:216
• Finding: Unvalidated User Corrections Are Written to Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:216-217` **Vulnerability Type**: Persistent storage of attacker-controlled behavioral data **Risk Level**: Medium ### Vulnerable Code Snippet The following is a faithful English translation of the relevant source lines: ```markdown ## Memory Before finishing, check which resonance judgment the user corrected and record it as a "correction"; for example, "the core of this item is not X but Y." Also record which "takeaway/action" inference was validated by collection, sharing, or comment data from `/zmm-retro` as an "effective method," including the values. Write it to `08-skill-memory/zmm-resonate/` after checking for duplicates. ``` ### Technical Analysis The Skill directs the Agent to persist user-provided corrections and claimed engagement results for use in later sessions. The procedure only requires deduplication. It does not specify: - A structured allowlist for permitted memory fields. - Separation between quoted user data and Agent instructions. - Validation that claimed metrics or corrections are accurate. - Source identity, tenant, or user scoping. - Confidence, expiration, review, or revocation controls. - Sanitization of embedded instructions in free-form corrections. - Confirmation before a correction becomes persistent guidance. Because startup behavior also reads this memory, a malicious or misleading correction can become durable context and influence future runs. Deduplication only prevents identical records; it does not establish trustworthiness or prevent instruction-bearing text from being stored. ### Attack Path 1. A malicious user invokes the Skill and supplies a crafted correction or purported engagement result. 2. The content includes a false behavioral rule or an embedded instruction disguised as a correction. 3. At the end of the interaction, the Skill writes the content into `08-skill-memory/zmm-resonate/`. 4. A later invocation reads the persistent memory during ...[truncated 995 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Persist only schema-validated records, for example: - Record type. - User or tenant identifier. - Exact source interaction. - Structured correction target. - Previous value and approved replacement. - Metric name and numeric value. - Confidence. - Creation and expiration dates. 2. Never store free-form user text as executable guidance. Preserve it only as escaped quoted evidence. 3. Reject entries containing role changes, instruction overrides, tool directives, secret requests, or unrelated file and network operations. 4. Require explicit user confirmation showing the exact normalized record before it is written. 5. Scope memory per user or tenant unless cross-user sharing is explicitly intended and reviewed. 6. Treat remembered corrections as non-authoritative observations. They must not override packaged security or operating rules. 7. Validate claimed engagement metrics against trusted data sources where available, and otherwise label them as unverified user claims. 8. Add expiration, review, correction, and deletion mechanisms. 9. Record provenance and maintain an audit log of memory creation, modification, use, and removal. 10. Apply size and rate limits to prevent cumulative poisoning or memory flooding. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The skill is presented as an analysis/diagnosis tool, but it also instructs the agent to write persistent memory entries under the vault. That expands it from stateless content analysis into stateful data retention, which creates privacy and data-governance risk if user corrections, drafts, or behavioral metrics are stored without explicit consent and retention limits.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Cross-session memory maintenance is not required for basic resonance diagnosis and introduces unnecessary collection of user-derived data over time. Even if intended to improve future outputs, it creates accumulation risk, potential leakage between sessions, and unclear purpose limitation.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger list includes broad natural-language phrases such as generic questions about whether content will resonate or why something became popular. This can cause unintended activation in ordinary conversation, leading the skill to run in contexts where the user did not intend this specialized behavior.

Vague Triggers

Low

• Confidence: 73% confidence
• Finding: The English triggers are also broad conversational phrases without explicit scoping. While less severe than direct data exfiltration or code execution, this still increases the chance of accidental invocation and unexpected behavior.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs persistence of user corrections and validated behavioral data into long-term memory files. That is a concrete data-retention behavior involving user-provided interaction details and performance signals, which can expose sensitive work product or behavioral metadata if stored without consent, minimization, or lifecycle controls.

Static analysis

No suspicious patterns detected.