Cognitive Bias Adivsor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:16 AM UTC
• Version: 2.10.2

Overview

The skill is mostly a disclosed Chinese cognitive-bias coaching workflow, but one documented install path points to a different package and some influence modules provide operational persuasion tactics, so it should be reviewed before installation.

Install only the ClawHub package named 'cognitive-bias-advisor' unless the separate 'cognitive-bias-advisor-pro' package has been independently verified. Expect a Chinese-language coaching workflow that may trigger on broad decision or learning phrases, and use the persuasion/influence modules only for transparent, non-coercive communication where the other person's autonomy is respected.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:28

Finding

Marketplace Installation Command References an Unaudited Package Identifier

Content

View full analysis

Vulnerability Details

File Location: README.md:28-32
Vulnerability Type: Supply-chain package identity mismatch
Risk Level: Medium

Vulnerable Code Snippet

bash

skillhub install cognitive-bias-advisor-pro

The audited Skill declares a different identifier in SKILL.md:2-3:

yaml

name: cognitive-bias-advisor
slug: cognitive-bias-advisor

Technical Analysis

The documented SkillHub installation command installs cognitive-bias-advisor-pro, while the audited artifact identifies itself as cognitive-bias-advisor. Consequently, following the README does not necessarily install the artifact whose source code was reviewed.

The command also provides no version pin, publisher identity, signature requirement, or integrity checksum. The effective package contents therefore depend on the external marketplace's current resolution of a different package identifier. This creates a supply-chain trust gap: an unintended, compromised, or malicious package could receive the privileges associated with an installed Agent Skill.

The repository does not establish that the -pro package is equivalent to, built from, or controlled by the same source as the audited artifact. This finding does not prove that the external package is malicious; it establishes that the documented installation path crosses into unaudited code under a mismatched identity.

Attack Path

1. A user trusts the installation instructions in README.md.
2. The user runs skillhub install cognitive-bias-advisor-pro.
3. SkillHub resolves and downloads the separately named marketplace package.
4. The Agent installs that package without verifying that it corresponds to the reviewed cognitive-bias-advisor source.
5. If the resolved package is malicious or compromised, its instructions or executable components run when the Skill is loaded or invoked.
6. The external package could then exercise any Agent tools or data access ...[truncated 724 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mismatched command with the exact audited package identifier:

   bash

   skillhub install cognitive-bias-advisor
   

2. If cognitive-bias-advisor-pro is intentionally a separate distribution, label it clearly as a distinct artifact and audit its contents independently.
3. Pin installation instructions to a reviewed version rather than resolving the latest mutable release.
4. Document the expected marketplace publisher and require users to verify it before installation.
5. Publish cryptographic checksums or signed release manifests and provide verification instructions.
6. Add a release check that compares the package slug in SKILL.md, marketplace metadata, and every documented installation command.
7. Configure the Agent runtime to require explicit approval and least-privilege permissions for newly installed Skills.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (43)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill documentation is entirely in Chinese and presents usage examples only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. This can violate language/locale policy where user choice or explicit justification is required.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The verification trigger 帮我决策一件事 is a broad, natural-language phrase that a user could plausibly say in many ordinary conversations. In a skill system that activates or routes based on trigger phrases, this raises the risk of accidental invocation, unintended context capture, or the skill taking over interactions when the user did not explicitly mean to use it. The skill’s broad life-advice scope makes this more dangerous because the phrase maps to common decision-help requests rather than a narrow, unambiguous command.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The display name, description, triggers, and all interaction templates are written exclusively in Chinese, implying the skill operates only in Chinese. There is no indication that users may choose another language or that the restriction is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list is very broad and includes common phrases like '学习', '该怎么', '帮我分析', and '继续', which can cause the skill to activate in unrelated conversations. That can unexpectedly hijack session flow, collect user responses under the wrong workflow, or steer users into influence/management guidance they did not request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The phrase "当你触发管理领域诊断时" describes activation in a generic way without specifying concrete trigger phrases, boundaries, or exclusion conditions. In a markdown skill description, this kind of broad invocation language can make it unclear when the skill should activate versus when normal discussion about management should not.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

An overly broad trigger phrase like “帮我决策一件事” overlaps with normal conversation and can cause unintended skill activation. In an agent environment, accidental invocation can hijack user flows, override expected assistant behavior, or route sensitive discussions into the skill without clear user intent, increasing the chance of privacy leakage or unsafe autonomy.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation phrases are broad everyday expressions like indecision or difficulty learning, making the skill likely to trigger during ordinary conversation without deliberate user intent. In an advisory skill that influences decision-making and interpersonal judgments, unintended invocation can insert unrequested guidance, alter responses, and create privacy or trust issues if sensitive user content is routed into the skill unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The listed trigger phrases are very broad, common conversational requests such as asking how to negotiate a raise, deal with procrastination, or analyze quitting to start a business. In an agent environment, such generic phrases can cause accidental invocation outside the user's intent, leading to unexpected routing into this skill and unrequested persuasive or decision-shaping outputs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The article embeds very generic trigger phrases such as '帮我做一次决策自检', '我项目做了两年，该不该叫停？', and '团队复盘老流于形式，怎么办？' that closely resemble ordinary user requests. In an agent ecosystem that auto-routes based on broad phrase matching, this can cause unintended skill activation and context capture, especially for unrelated conversations about decisions, teams, or learning.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The entire skill-facing article is written exclusively in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file content is entirely in Chinese and does not offer a language choice or document a locale-specific requirement. This can exclude or mislead users who expect interaction in another language, causing incorrect understanding of decision guidance, though it is not a classic security exploit and the surrounding content is otherwise non-malicious.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire skill file, including prompts, questions, and prescribed output language, is written only in Chinese and provides no opt-in or alternative language path. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file frames itself as an ethical cognitive-bias advisor with 'do no harm / transparent / bidirectional self-check' guardrails, but then provides concrete persuasion scripts designed to steer another person's decisions using anchoring, loss framing, social proof, and commitment techniques. In a communication-help skill, this shifts from neutral education into operational influence guidance, increasing the risk of manipulative use against users, coworkers, children, or negotiating counterparts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This section provides actionable manipulative persuasion playbooks and sample scripts without a strong warning about coercion, misuse, or vulnerable-target scenarios. Because the skill is positioned as practical advice, users can directly apply these techniques to pressure decisions in sales, workplace authority dynamics, parenting, or personal relationships, making the guidance more dangerous than abstract theory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents the skill title and all subsequent user-facing instructions in Chinese, implying the interaction is forced into a specific language. The policy requires either user opt-in or a clearly documented and justified locale constraint, neither of which appears in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file explicitly frames the domain as 'deeply shaping others' choices' and provides a workflow for influence rather than neutral communication. Although it states ethical guardrails, the skill operationalizes behavioral nudging techniques that can be applied to manipulate user decisions without meaningful informed consent or a legitimate safety constraint.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The diagnostic and examples encourage giving small value or building rapport as a precursor to later requests, formalizing reciprocity as an influence mechanism. This can be misused to manufacture social debt and reduce resistance rather than support genuinely mutual, transparent exchange.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The 'foot-in-the-door' pattern teaches obtaining a small commitment and then escalating to a larger ask, normalizing incremental compliance engineering. This is dangerous because it leverages commitment-consistency bias to bypass reflective consent, especially in workplace, commercial, or unequal-power relationships.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example combines scarcity and social proof as a 'dual-engine' to drive action, which is a classic pressure tactic that can exploit fear of missing out and conformity bias. Even with a note about using real data elsewhere, the guidance is action-oriented and readily transferable to coercive sales, recruitment, or interpersonal manipulation scenarios.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file contains user-facing instructions and prompts exclusively in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking context. The policy for natural-language violations applies to all file types and specifically flags forced language or locale constraints without user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list is broad enough to match common words and phrases such as “建议”, “设计”, or “规则”, which can cause this bias module to activate for ordinary discussion rather than true incentive-analysis scenarios. In this skill, that mainly creates over-triggering, noisy routing, and reduced reliability of advice rather than a direct security compromise, but it can still distort outputs and weaken user trust.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file content is entirely in Chinese and does not provide any language selection, fallback, or documented locale constraint. This can exclude or mislead users who do not read Chinese, causing misunderstanding of risk/decision prompts and reducing the reliability of the skill’s output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file's user-facing title, questions, options, and labels are written in Chinese throughout, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate a language/locale policy when a specific language is imposed without opt-in or explicit justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Using an extremely generic trigger such as a bare term like “决定” makes accidental activation likely during ordinary conversation. Unintended invocation can hijack unrelated user flows, misroute prompts into the skill, and cause collection of unnecessary personal context or generation of irrelevant guidance.

Content

No source excerpt is available for this finding.