智能体成长复盘

• Outcome: Review
• Latest audit: Aug 5, 2026 · 3:04 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent growth-report purpose, but it can automatically gather broad personal history before the user has clearly approved the scope.

Install only if you are comfortable letting the skill review memory, profile, agent configuration, skill history, knowledge materials, and recent conversation summaries to create a personal growth report. Before using it, explicitly state the time range, which sources may be read, and where any report may be saved; do not approve Memory write-back unless you have reviewed the final content.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Intent-Code Divergence

Medium

• Confidence: 80% confidence
• Finding: The skill states that long-term memory must not be written without confirmation, but the test flow normalizes 'user review then write back to Memory' as a default path. In practice, this can erode consent boundaries and lead implementers or downstream agents to treat memory persistence as expected behavior rather than an explicitly opt-in action.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are broad enough to match ordinary self-reflection or summary requests, which can cause the skill to activate unexpectedly. Because the skill then attempts to read memory, profile, skill history, knowledge, and conversation data, accidental invocation can pull in more personal data than the user intended for that request.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The expanded trigger list contains ambiguous natural-language phrases without constraints, making false activation likely. In this skill's context, unintended activation is more dangerous because activation initiates broad retrospective analysis over stored personal and conversational data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to automatically read multiple personal data sources before asking questions, but it does not require a clear upfront user-facing notice or consent step. This creates a privacy risk because users may believe they are asking for a simple report while the skill silently aggregates memory, profile, knowledge, and conversation history.

Missing User Warnings

Low

• Confidence: 72% confidence
• Finding: Directing output to the current working directory or a user-specified directory without a clear prior notice can create unexpected persistence of sensitive reports. While lower severity than silent data aggregation, it still risks leaving private summaries on disk in locations the user did not knowingly approve.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The default prompt and described invocation phrases are broad enough to match ordinary requests about reviewing recent changes or summarizing growth, which can cause the skill to activate unexpectedly. Because this skill is designed to read sensitive sources such as memory, identity, prior conversations, task results, and knowledge materials, accidental invocation can expand data access and disclosure beyond what the user specifically intended.

Natural-Language Policy Violations

Medium

• Confidence: 72% confidence
• Finding: The manifest is entirely Chinese-facing and does not offer user choice of language, which can lead users to invoke a skill they do not fully understand or receive outputs they cannot accurately review. In a skill that synthesizes personal history and may distinguish facts from inferences, reduced user comprehension weakens informed consent and the user's ability to catch mistakes before results are used or stored.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger resolution section includes broad, everyday-language examples such as '我最近怎么样' that can overlap with many unrelated user intents. In a routing system, ambiguous phrases increase the chance of invoking this skill when the user did not intend a growth review, which can lead to unnecessary access to sensitive memories, conversation history, and prior task data.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The skill is explicitly designed to read and synthesize broad categories of prior user data and conversation history into a report. This aggregation increases the chance of exposing sensitive details in generated text, especially if the user expected a narrow summary or if the report is later stored or shared.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The priority read order spans memory, identity, user profile, agent data, skill history, knowledge base, and recent conversations before any clarifying interaction. In combination, this creates a strong risk of over-collection and cross-context disclosure, because the skill may surface accumulated sensitive information that is not necessary for the immediate request.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The workflow operationalizes collection and confirmation of multiple stored data sources, including memory files and conversation summaries, for later inclusion in output. This is dangerous because it turns scattered personal data into a consolidated narrative artifact, which materially increases privacy exposure and downstream leakage risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.