Axiomata Skill Evaluator Zh

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:11 AM UTC
• Version: 3.0.1

Overview

This is a local skill-quality checker with overstated capability claims but no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Install only if you want a Chinese-language, heuristic skill-quality evaluator. Treat its scores as advisory, not proof of production readiness, and run it only on skill directories you intend to inspect, especially when using --all.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The code is broadly related to skill quality evaluation, so the high-level domain matches the description. However, the declared description overstates and mischaracterizes the implemented functionality in materially important ways. The script does perform 13 automated checks, but they are ad hoc structural/documentation/security heuristics rather than a clearly implemented 'Axioma 5维框架' or 'ISO 25010结构框架'. It also explicitly says it covers only automated/structural checks and relies on a separate manual rubric for full evaluation, which conflicts with the stronger claim that this bundled tool itself provides the full dual evaluation system and validates production readiness. Therefore, this is a description-behavior mismatch, mainly due to overstated and inaccurately labeled evaluation frameworks rather than unrelated or malicious behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The code generally matches the broad category of a skill evaluation/audit tool, so the overall domain is aligned. However, the declared description materially overstates what is implemented. The evaluator performs five heuristic checks on markdown content and aggregates them into a 100-point score. Although comments and docstrings mention 'ISO 25010 structural', there is no separate ISO 25010 evaluator, no 13-item automated checklist, and no concrete second framework implementation. Additionally, the --improve flag is accepted and stored but never used to modify or improve skills, so improvement functionality is not actually present in this chunk. Therefore the description does not accurately represent the code's actual capabilities.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill instructs the agent to run bundled Python scripts and evaluate arbitrary skill paths, which implies shell/file access and possibly environment or network reach, yet it declares no explicit tool scope. Missing permission boundaries can cause an agent runtime to grant broader capabilities than necessary, increasing the blast radius if the skill is invoked on untrusted content or paired with a permissive executor.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

文件标题、描述、触发词、命令说明和输出示例均以中文呈现，且技能名中明确标注“zh”，但文档没有说明这是可选语言模式，也没有提供其他语言或用户选择入口。按规则，这构成未获用户选择的语言/区域约束。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases include broad everyday terms such as '评估技能', '改进技能', and '检查质量', which can unintentionally activate the skill during unrelated conversations. Because this skill recommends running local scripts against supplied paths, accidental activation can lead to unnecessary shell execution or analysis of unintended directories.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/eval-skill.py (reported line 345)May include surrounding context.

python

"html", "http", "imaplib", "importlib", "inspect", "io", "ipaddress",
        "itertools", "json", "keyword", "linecache", "locale", "logging",
        "lzma", "math", "mimetypes", "multiprocessing", "operator", "os",
        "pathlib", "pickle", "platform", "plistlib", "pprint", "profile",
        "queue", "random", "re", "readline", "reprlib", "secrets",
        "select", "shelve", "shlex", "shutil", "signal", "smtplib",
        "socket", "sqlite3", "ssl", "stat", "statistics", "string",

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a broader evaluation capability with two named frameworks and 13 automated structural checks targeting 90%+, suggesting a substantive quality-assessment engine. In this file, the implemented logic is limited to simple keyword/format heuristics across five dimensions and never encodes a distinct ISO 25010 13-check model, so the behavior is materially narrower than described.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The comment at L318 states a functionality validation intent, which implies behavioral or runtime verification. The code instead counts command-like backticked text and searches for output-related keywords, so the documentation overstates what the function really does.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code file defines an --improve / -i option described only as Auto-improve skill, which implies file-writing behavior, but there is no docstring, comment, prompt, or other user disclosure in this file about what changes may be made. For code files, safety-relevant write operations or destructive behavior should have some visible warning unless clearly documented as the skill's stated purpose, which is not the case here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The SELF_NAME selection explicitly distinguishes ...-en and ...-zh variants based on directory naming, embedding language-specific behavior in the skill logic without any visible user choice. Under the language/locale policy rule, forcing a particular language or locale without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.