Security audit

Cognitive Bias Adivsor

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Chinese cognitive-bias coaching workflow, but one documented install path points to a different package and some influence modules provide operational persuasion tactics, so it should be reviewed before installation.

Install only the ClawHub package named 'cognitive-bias-advisor' unless the separate 'cognitive-bias-advisor-pro' package has been independently verified. Expect a Chinese-language coaching workflow that may trigger on broad decision or learning phrases, and use the persuasion/influence modules only for transparent, non-coercive communication where the other person's autonomy is respected.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: README.md:28
Finding: Marketplace Installation Command References an Unaudited Package Identifier## Vulnerability Details **File Location**: `README.md:28-32` **Vulnerability Type**: Supply-chain package identity mismatch **Risk Level**: Medium ### Vulnerable Code Snippet ```bash skillhub install cognitive-bias-advisor-pro ``` The audited Skill declares a different identifier in `SKILL.md:2-3`: ```yaml name: cognitive-bias-advisor slug: cognitive-bias-advisor ``` ### Technical Analysis The documented SkillHub installation command installs `cognitive-bias-advisor-pro`, while the audited artifact identifies itself as `cognitive-bias-advisor`. Consequently, following the README does not necessarily install the artifact whose source code was reviewed. The command also provides no version pin, publisher identity, signature requirement, or integrity checksum. The effective package contents therefore depend on the external marketplace's current resolution of a different package identifier. This creates a supply-chain trust gap: an unintended, compromised, or malicious package could receive the privileges associated with an installed Agent Skill. The repository does not establish that the `-pro` package is equivalent to, built from, or controlled by the same source as the audited artifact. This finding does not prove that the external package is malicious; it establishes that the documented installation path crosses into unaudited code under a mismatched identity. ### Attack Path 1. A user trusts the installation instructions in `README.md`. 2. The user runs `skillhub install cognitive-bias-advisor-pro`. 3. SkillHub resolves and downloads the separately named marketplace package. 4. The Agent installs that package without verifying that it corresponds to the reviewed `cognitive-bias-advisor` source. 5. If the resolved package is malicious or compromised, its instructions or executable components run when the Skill is loaded or invoked. 6. The external package could then exercise any Agent tools or data access ...[truncated 724 chars]
Remediation: ## Remediation Suggestions 1. Replace the mismatched command with the exact audited package identifier: ```bash skillhub install cognitive-bias-advisor ``` 2. If `cognitive-bias-advisor-pro` is intentionally a separate distribution, label it clearly as a distinct artifact and audit its contents independently. 3. Pin installation instructions to a reviewed version rather than resolving the latest mutable release. 4. Document the expected marketplace publisher and require users to verify it before installation. 5. Publish cryptographic checksums or signed release manifests and provide verification instructions. 6. Add a release check that compares the package slug in `SKILL.md`, marketplace metadata, and every documented installation command. 7. Configure the Agent runtime to require explicit approval and least-privilege permissions for newly installed Skills.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (43)

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The skill documentation is entirely in Chinese and presents usage examples only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. This can violate language/locale policy where user choice or explicit justification is required.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The verification trigger `帮我决策一件事` is a broad, natural-language phrase that a user could plausibly say in many ordinary conversations. In a skill system that activates or routes based on trigger phrases, this raises the risk of accidental invocation, unintended context capture, or the skill taking over interactions when the user did not explicitly mean to use it. The skill’s broad life-advice scope makes this more dangerous because the phrase maps to common decision-help requests rather than a narrow, unambiguous command.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The display name, description, triggers, and all interaction templates are written exclusively in Chinese, implying the skill operates only in Chinese. There is no indication that users may choose another language or that the restriction is required for a region-specific purpose.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The trigger list is very broad and includes common phrases like '学习', '该怎么', '帮我分析', and '继续', which can cause the skill to activate in unrelated conversations. That can unexpectedly hijack session flow, collect user responses under the wrong workflow, or steer users into influence/management guidance they did not request.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The phrase "当你触发管理领域诊断时" describes activation in a generic way without specifying concrete trigger phrases, boundaries, or exclusion conditions. In a markdown skill description, this kind of broad invocation language can make it unclear when the skill should activate versus when normal discussion about management should not.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: An overly broad trigger phrase like “帮我决策一件事” overlaps with normal conversation and can cause unintended skill activation. In an agent environment, accidental invocation can hijack user flows, override expected assistant behavior, or route sensitive discussions into the skill without clear user intent, increasing the chance of privacy leakage or unsafe autonomy.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The activation phrases are broad everyday expressions like indecision or difficulty learning, making the skill likely to trigger during ordinary conversation without deliberate user intent. In an advisory skill that influences decision-making and interpersonal judgments, unintended invocation can insert unrequested guidance, alter responses, and create privacy or trust issues if sensitive user content is routed into the skill unexpectedly.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The listed trigger phrases are very broad, common conversational requests such as asking how to negotiate a raise, deal with procrastination, or analyze quitting to start a business. In an agent environment, such generic phrases can cause accidental invocation outside the user's intent, leading to unexpected routing into this skill and unrequested persuasive or decision-shaping outputs.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The article embeds very generic trigger phrases such as '帮我做一次决策自检', '我项目做了两年，该不该叫停？', and '团队复盘老流于形式，怎么办？' that closely resemble ordinary user requests. In an agent ecosystem that auto-routes based on broad phrase matching, this can cause unintended skill activation and context capture, especially for unrelated conversations about decisions, teams, or learning.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The entire skill-facing article is written exclusively in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The file content is entirely in Chinese and does not offer a language choice or document a locale-specific requirement. This can exclude or mislead users who expect interaction in another language, causing incorrect understanding of decision guidance, though it is not a classic security exploit and the surrounding content is otherwise non-malicious.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The entire skill file, including prompts, questions, and prescribed output language, is written only in Chinese and provides no opt-in or alternative language path. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The file frames itself as an ethical cognitive-bias advisor with 'do no harm / transparent / bidirectional self-check' guardrails, but then provides concrete persuasion scripts designed to steer another person's decisions using anchoring, loss framing, social proof, and commitment techniques. In a communication-help skill, this shifts from neutral education into operational influence guidance, increasing the risk of manipulative use against users, coworkers, children, or negotiating counterparts.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This section provides actionable manipulative persuasion playbooks and sample scripts without a strong warning about coercion, misuse, or vulnerable-target scenarios. Because the skill is positioned as practical advice, users can directly apply these techniques to pressure decisions in sales, workplace authority dynamics, parenting, or personal relationships, making the guidance more dangerous than abstract theory.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This markdown file presents the skill title and all subsequent user-facing instructions in Chinese, implying the interaction is forced into a specific language. The policy requires either user opt-in or a clearly documented and justified locale constraint, neither of which appears in this file.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The file explicitly frames the domain as 'deeply shaping others' choices' and provides a workflow for influence rather than neutral communication. Although it states ethical guardrails, the skill operationalizes behavioral nudging techniques that can be applied to manipulate user decisions without meaningful informed consent or a legitimate safety constraint.

Ssd 4

Medium

Confidence: 90% confidence
Finding: The diagnostic and examples encourage giving small value or building rapport as a precursor to later requests, formalizing reciprocity as an influence mechanism. This can be misused to manufacture social debt and reduce resistance rather than support genuinely mutual, transparent exchange.

Ssd 4

Medium

Confidence: 96% confidence
Finding: The 'foot-in-the-door' pattern teaches obtaining a small commitment and then escalating to a larger ask, normalizing incremental compliance engineering. This is dangerous because it leverages commitment-consistency bias to bypass reflective consent, especially in workplace, commercial, or unequal-power relationships.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The example combines scarcity and social proof as a 'dual-engine' to drive action, which is a classic pressure tactic that can exploit fear of missing out and conformity bias. Even with a note about using real data elsewhere, the guidance is action-oriented and readily transferable to coercive sales, recruitment, or interpersonal manipulation scenarios.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: This markdown file contains user-facing instructions and prompts exclusively in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking context. The policy for natural-language violations applies to all file types and specifically flags forced language or locale constraints without user opt-in.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger list is broad enough to match common words and phrases such as “建议”, “设计”, or “规则”, which can cause this bias module to activate for ordinary discussion rather than true incentive-analysis scenarios. In this skill, that mainly creates over-triggering, noisy routing, and reduced reliability of advice rather than a direct security compromise, but it can still distort outputs and weaken user trust.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The file content is entirely in Chinese and does not provide any language selection, fallback, or documented locale constraint. This can exclude or mislead users who do not read Chinese, causing misunderstanding of risk/decision prompts and reducing the reliability of the skill’s output.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The file's user-facing title, questions, options, and labels are written in Chinese throughout, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate a language/locale policy when a specific language is imposed without opt-in or explicit justification.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: Using an extremely generic trigger such as a bare term like “决定” makes accidental activation likely during ordinary conversation. Unintended invocation can hijack unrelated user flows, misroute prompts into the skill, and cause collection of unnecessary personal context or generation of irrelevant guidance.

Static analysis

No suspicious patterns detected.