Security audit

Sbti Fun Test

Security checks for vulnerabilities and agentic risk

Overview

This is a local entertainment personality quiz with no hidden network, credential, persistence, or system-modifying behavior.

Install this as an entertainment-only Chinese-language quiz. Be aware that the documentation appears to overstate the V3 result count, and older V1/V2 scripts are included, so use the documented scripts/sbti_test.py entrypoint for the current version.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The code does broadly implement a humorous SBTI-style personality test, so the general category is aligned. However, several core advertised features in the description are materially inaccurate relative to the code: the script contains 31 questions rather than 30, each question has only A/B choices rather than 4 options, it defines roughly 23 personality types rather than 28, and there is no implementation of unique ASCII-art pets for each type. The supplied file is also labeled v1, not V3. Because these are central product characteristics rather than minor implementation details, the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code is clearly a benign local personality test and generally aligns at a high level with the idea of an SBTI quiz using 30 questions, 4 options, humorous results, and ASCII-art pets. However, the declared description does not accurately represent this specific code chunk. The implementation is explicitly V2 rather than V3, branded as '电子宠物版' rather than '梗王版', and the set/number of personality types materially differs from the declared 28 types and examples provided. The code defines only 23 personality types, with different names and scoring logic. Therefore this is a description-behavior mismatch, even though there are no suspicious undeclared permissions or external-resource accesses.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The code does match the broad category of an entertainment personality quiz with 30 questions, 4 answer choices, and ASCII-art pets. However, the declared description makes concrete content claims that are not reflected in the implementation: it says V3 with 28 personality types and lists example types such as 自我攻击者、吗喽、狗屎人、握草人, while the supplied code is explicitly a V2 backup and defines only 23 types with a different set of names (e.g. CTRL, SHIT/愤世者, LOVE, FART, etc.). This is a material mismatch in the actual test content and scope, even though there are no suspicious undeclared behaviors or permission/resource mismatches.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · scripts/sbti_test_v2.py (reported line 55)May include surrounding context.
python
ist[str] # 该题影响哪些维度 option_a: str option_b: str option_c: str option_d: str # 每个选项对应的维度得分 scores_a: Dict[str, int] scores_b: Dict[str, int] scores_c: Dict[str, int] scores_d: Dict[str, int] @dataclass class SBTIType: """SBTI人格类型 + ASCII宠物""" code: str name: str nickname: str emoji: str description: str traits: List[str] pet_art: str # ASCII艺术宠物 pet_name: str # 宠物名字 # ==================== ASCII艺术宠物库 ==================== PET_ARTS = { "CTRL": """ ╭─────────╮ │ 👑 CTRL │ ╰────┬────╯ │ 🎩👑🎩 ( ͡° ͜ʖ ͡°) <⚡️ ⚡️> ╱ ╲ ╱ 👊 ╲ 🕴️ 掌控者 🕴️ """, "SHIT": """ 💩 SHIT ╱ ╲ │ ಠ_ಠ │ │ ╭─╮ │ │ │ │ │

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · scripts/sbti_test_v2_backup.py (reported line 55)May include surrounding context.
python
ist[str] # 该题影响哪些维度 option_a: str option_b: str option_c: str option_d: str # 每个选项对应的维度得分 scores_a: Dict[str, int] scores_b: Dict[str, int] scores_c: Dict[str, int] scores_d: Dict[str, int] @dataclass class SBTIType: """SBTI人格类型 + ASCII宠物""" code: str name: str nickname: str emoji: str description: str traits: List[str] pet_art: str # ASCII艺术宠物 pet_name: str # 宠物名字 # ==================== ASCII艺术宠物库 ==================== PET_ARTS = { "CTRL": """ ╭─────────╮ │ 👑 CTRL │ ╰────┬────╯ │ 🎩👑🎩 ( ͡° ͜ʖ ͡°) <⚡️ ⚡️> ╱ ╲ ╱ 👊 ╲ 🕴️ 掌控者 🕴️ """, "SHIT": """ 💩 SHIT ╱ ╲ │ ಠ_ಠ │ │ ╭─╮ │ │ │ │ │

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · scripts/sbti_test.py (reported line 35)May include surrounding context.
python
��目 - 4选项版本""" id: int text: str dimensions: List[str] option_a: str option_b: str option_c: str option_d: str scores_a: Dict[str, int] scores_b: Dict[str, int] scores_c: Dict[str, int] scores_d: Dict[str, int] @dataclass class SBTIType: """SBTI人格类型 + ASCII宠物""" code: str name: str nickname: str emoji: str description: str traits: List[str] pet_art: str pet_name: str # ==================== 新梗王版ASCII艺术宠物库 ==================== PET_ARTS = { "IMSB": """ 💔 IMSB ╭────────╮ │ (╥﹏╥) │ │ 我垃圾 │ │ 我不行 │ ╰────┬───╯ 🔪│🔪 🩸 自我攻击刺猬 """, "BOSS": """ 👔 BOSS ╭────────╮ │ 😎😎😎 │ │ 听我的 │ │ 我说了算│ ╰────┬───╯ 💼�

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · scripts/sbti_test_v3.py (reported line 35)May include surrounding context.
python
��目 - 4选项版本""" id: int text: str dimensions: List[str] option_a: str option_b: str option_c: str option_d: str scores_a: Dict[str, int] scores_b: Dict[str, int] scores_c: Dict[str, int] scores_d: Dict[str, int] @dataclass class SBTIType: """SBTI人格类型 + ASCII宠物""" code: str name: str nickname: str emoji: str description: str traits: List[str] pet_art: str pet_name: str # ==================== 新梗王版ASCII艺术宠物库 ==================== PET_ARTS = { "IMSB": """ 💔 IMSB ╭────────╮ │ (╥﹏╥) │ │ 我垃圾 │ │ 我不行 │ ╰────┬───╯ 🔪│🔪 🩸 自我攻击刺猬 """, "BOSS": """ 👔 BOSS ╭────────╮ │ 😎😎😎 │ │ 听我的 │ │ 我说了算│ ╰────┬───╯ 💼�

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill documentation and user-facing content are written almost entirely in Chinese, with no indication that users can choose another language or that the skill is intended only for a Chinese-speaking audience. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code presents the skill name, questions, and descriptions in a single fixed language, and the interactive flow later also prompts users only in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runtime interface shown to users is exclusively Chinese, including title, instructions, answer prompt, and validation message. Because the skill does not offer a language choice or disclose that it is intentionally Chinese-only, it violates the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code file includes user-facing natural-language content that assumes Chinese as the only interaction language, including the module description and later prompts. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code presents the skill entirely in Chinese and the interactive prompts later also require Chinese-language usage, but there is no user opt-in or documented justification for a Chinese-only locale. The policy scope explicitly covers natural-language strings in code files, so this is a language/locale policy issue rather than a code-security issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The runtime interface shown to users is fully Chinese, including instructions and input validation messages, with no option to switch languages. Because the skill does not offer user choice or justify the locale restriction, this conflicts with the stated policy on forced language or locale.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The manifest describes 'SBTI personality test V3' with '28种接地气的人格类型'. This code implements an older 'V2' test, defines 9 scoring dimensions, and provides 23 personality outcomes (CTRL through BOBO), so the actual behavior and content differ from the skill's claimed functionality.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This file's user-facing instructions, questions, and results are all Chinese-only, and there is no opt-in, fallback, or explanation that the skill is intended only for a Chinese-speaking region or audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code presents the test title, prompts, questions, result descriptions, and user interaction entirely in Chinese, indicating a fixed language/locale experience. The file does not provide any user opt-in, language selection, or justification that the skill is intended only for a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The top-level documentation says the test is '基于15个维度', which implies a 15-dimension model. However, the Dimension enum and scoring state only implement 9 dimensions, so the documentation actively misstates the core behavior of the test logic rather than merely omitting detail.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The top-level documentation states the test is '基于15个维度', which describes the skill's core behavior. However, the code defines only 9 dimensions in the Dimension enum and uses those same 9 dimensions for scoring and result calculation, so the documentation materially contradicts the implemented test logic.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The code documentation identifies this as 'SBTI 测试 V2 - 4选项版', while the manifest describes a V3 test with 28 personality types. This file is explicitly a backup V2 implementation and its inline documentation reflects that older version, creating an intent/version mismatch with the stated skill identity.
Content: No source excerpt is available for this finding.