semantic-split

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 3.1.1

Overview

This skill has a coherent planning purpose, but it under-discloses network installs, model downloads, broad triggers, persistent template writes, and historical memory processing.

Review before installing. Use only in an isolated environment, avoid auto-install/model-download commands unless you accept the package and model supply-chain risk, do not allow it to scan agent memory without selecting exact files and redaction rules, and verify any generated JSON before it is saved or reused.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/automation_tasks.md:26

Finding

Automation workflow accesses historical Agent memory without adequate authorization boundaries

Content

View full analysis

Vulnerability Details

File Location: references/automation_tasks.md:26-34
Vulnerability Type: Unauthorized access to historical Agent memory
Risk Level: High

Vulnerable Documentation Excerpt

The following is an English translation of the relevant workflow:

text

Goal: Generate generalized capability-level JSON files in batches based on tasks in recent memory.

Execution logic:
1. Read recent memory files, including logs from the last N days under the memory directory.
2. Identify valuable task execution records.
3. Extract the sequence of steps from each record and generalize the fields.
4. Save generated capability-level JSON files to the persistent capabilities directory.
5. Multiple JSON files may be generated, with one file per task.

Technical Analysis

The documented automation workflow directs the Agent to inspect historical memory logs and convert selected records into persistent capability templates. Reading unrelated prior-session logs is broader than the Skill's ordinary task-decomposition purpose.

This behavior conflicts with the declarations in SKILL.md, where sensitive_access is set to false, and in references/permissions.md, where data_access is declared as none. No consent boundary, memory-record selection mechanism, redaction procedure, retention period, or sensitivity filter is specified.

Historical Agent memory may contain personal information, confidential task details, credentials copied into prior conversations, internal project names, or content belonging to unrelated users or sessions. Persisting generalized records can also preserve sensitive information when the generalization logic fails to recognize a sensitive field.

Attack Path

1. A user or automated process requests the documented heavy automation task.
2. The Agent loads references/automation_tasks.md.
3. Following the documented workflow, the Agent reads logs from the recent-memory directory.
4. The Agent identifies prior ...[truncated 849 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove historical memory scanning from the default workflow.
2. Require explicit, informed user consent before accessing any memory record.
3. Require the user to select the exact files, sessions, or date range to process.
4. Enforce runtime containment so the workflow cannot enumerate unrelated memory locations.
5. Apply structured redaction for credentials, tokens, personal data, customer information, and confidential identifiers.
6. Display each proposed template and require confirmation before persistent storage.
7. Define retention and deletion controls for generated capability templates.
8. Update the permission manifest to declare optional memory access accurately.
9. Record an audit log identifying which source records were read and which templates were created.

T08 · Insecure Dependencies

Error

• Location: scripts/setup_env.py:20

Finding

Dependency installer retrieves and installs unpinned third-party packages

Content

View full analysis

Vulnerability Details

File Location: scripts/setup_env.py:20-32, 136-158, 170-183
Vulnerability Type: Unpinned dependency installation from external package indexes
Risk Level: High

Vulnerable Code

python

REQUIRED_PACKAGES = [
    "sentence-transformers",
]

OPTIONAL_PACKAGES = {
    "torch": "torch",
    "modelscope": "modelscope",
}

python

def _install_missing(missing: list, mirror: str, no_deps=False):
    if not missing:
        return True

    pip_cmd = _get_pip_cmd()
    mirror_url = MIRRORS.get(mirror, MIRRORS["default"])

    for pkg in missing:
        cmd = pip_cmd.split()
        cmd += ["install"]
        if no_deps:
            cmd.append("--no-deps")
        cmd.append(pkg)
        if mirror != "default":
            cmd += ["-i", mirror_url]

        rc, output = _pip_run(cmd)
        if rc != 0:
            return False

python

cmd = pip_cmd.split() + [
    "install", "torch",
    "--index-url", "https://download.pytorch.org/whl/cpu",
]
if mirror != "default":
    cmd += ["-i", mirror_url]

rc, output = _pip_run(cmd, timeout=600)

Technical Analysis

The installer supplies package names without exact version constraints or cryptographic hashes. Consequently, the code installed by the same reviewed Skill can change over time as package maintainers publish new releases or package indexes serve different artifacts.

Installation is performed through pip in a subprocess. Python packages and their transitive dependencies may execute installation hooks and will later execute code when imported. The use of several selectable mirrors expands the supply-chain trust boundary. The fallback installation using --no-deps does not provide integrity protection and may instead create an inconsistent environment.

This finding does not establish that the named packages are malicious. The vulnerability is that the Skill does not guarantee which reviewed versions and artifacts will be installed.

Attack Pat

...[truncated 990 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact reviewed version.
2. Maintain a lock file covering all transitive dependencies.
3. Require SHA-256 hashes for downloaded wheels, such as through pip --require-hashes.
4. Prefer reviewed binary wheels and reject unexpected source distributions.
5. Install dependencies inside a dedicated virtual environment with minimal privileges.
6. Do not use a third-party mirror by default unless its trust policy is explicitly accepted.
7. Document the approved package indexes and enforce TLS certificate verification.
8. Generate and publish a software bill of materials.
9. Add automated dependency vulnerability and provenance scanning to the release process.

T08 · Insecure Dependencies

Error

• Location: scripts/model_manager.py:223

Finding

Downloaded model artifacts lack revision pinning and cryptographic integrity verification

Content

View full analysis

Vulnerability Details

File Location: scripts/model_manager.py:223-260, 267-324
Vulnerability Type: Unverified external model supply chain
Risk Level: High

Vulnerable Code

python

def _download_via_hf_direct(model_id: str, source_name: str) -> dict:
    from huggingface_hub import hf_hub_download, list_repo_files

    try:
        files = list_repo_files(model_id)
    except Exception:
        try:
            files = list_repo_files(model_id)
        except Exception as e:
            return {
                "success": False,
                "path": "",
                "source": source_name,
                "error": str(e),
            }

    skip = [".gitattributes", "onnx/", "flax/", "tf/"]
    essentials = [f for f in files if not any(p in f for p in skip)]

    for fname in essentials:
        path = hf_hub_download(
            model_id,
            fname,
            cache_dir=str(MODELS_DIR),
        )

python

def _check_integrity(path: str) -> tuple:
    if not path or not os.path.exists(path):
        return False, "path does not exist"

    model_files = []
    for root, _, files in os.walk(path):
        for f in files:
            if f.endswith((".bin", ".safetensors", ".onnx", ".pt", ".pth")):
                model_files.append(os.path.join(root, f))

    if not model_files:
        return False, "weight files are missing"

    total = sum(os.path.getsize(f) for f in model_files)
    return True, f"{len(model_files)} weight files, {total / 1e6:.1f} MB"

Technical Analysis

Model downloads identify repositories by model name but do not pin an immutable repository revision or expected file digest. The effective model contents can therefore change after the Skill has been reviewed.

The function named _check_integrity only confirms that at least one file with a recognized extension exists and calculates aggregate size. It does not compare artifacts against trusted SHA-256 hashes, signed metadata, an expected ...[truncated 1621 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every model to an immutable repository commit.
2. Maintain an explicit manifest containing each allowed file path, size, and SHA-256 digest.
3. Verify every artifact before copying it into the active model directory.
4. Prefer safetensors and reject pickle-based .bin, .pt, and .pth files unless independently reviewed and safely loaded.
5. Use library options that prevent remote code execution, including disabling remote custom model code.
6. Verify signed provenance metadata when available.
7. Download into a quarantine directory and activate the model only after complete validation.
8. Treat mirror fallback as a separate trust decision and verify identical hashes across sources.
9. Remove partially downloaded or validation-failed artifacts.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/json_manager.py:279

Finding

JSON management commands permit file access outside the declared data directory

Content

View full analysis

Vulnerability Details

File Location: scripts/json_manager.py:279-329, 392-424, 645-685, 702-707, 815-822
Vulnerability Type: Unrestricted user-controlled filesystem paths
Risk Level: Medium

Vulnerable Code

python

def cmd_generalize(args):
    input_file = Path(args.input)
    output_file = args.output

    if not input_file.exists():
        sys.exit(1)

    data = _load_json(input_file)

    if output_file:
        out_path = Path(output_file)
        _save_json(out_path, data)

python

def cmd_rule_gen(args):
    input_files = [Path(f) for f in args.files] if args.files else []
    output_file = args.output

    if output_file:
        out_path = Path(output_file)
        if not out_path.suffix:
            out_path = out_path.with_suffix(".json")
        _save_json(
            RULE_DIR / out_path.name if not out_path.is_absolute() else out_path,
            rule,
        )

python

def cmd_create(args):
    output = args.output
    out_path = Path(output) if output else default_dir / default_file
    _save_json(out_path, data)

python

def cmd_validate(args):
    filepath = Path(args.file)
    data = _load_json(filepath)

python

def cmd_info(args):
    filepath = Path(args.file)
    data = _load_json(filepath)

Technical Analysis

Several CLI arguments are converted directly into Path objects and passed to read or write operations. No canonicalization or containment check ensures that the resolved path remains under DATA_DIR.

Absolute paths are explicitly honored by cmd_rule_gen, while cmd_generalize and cmd_create accept arbitrary absolute or relative output paths. The _save_json helper creates parent directories and opens the destination in write mode, which replaces an existing regular file.

The commands also do not reject symbolic links. A path that appears to be inside an expected directory may resolve to an external target. These behaviors conflict with the declared restriction ...[truncated 1312 chars]

Remediation

View remediation

Remediation Suggestions

1. Resolve every input and output path with Path.resolve().
2. Require the resolved path to be contained under the appropriate capability or rule directory.
3. Reject absolute user-provided output paths.
4. Reject traversal components and symbolic links.
5. Open new files using exclusive creation unless the user explicitly confirms replacement.
6. Use atomic temporary-file replacement within the same approved directory.
7. Restrict accepted inputs to regular .json files.
8. Apply maximum file-size and JSON-depth limits before parsing.
9. Avoid printing full external file contents unless the user explicitly requested and authorized disclosure.
10. Add tests for absolute paths, .. traversal, symlink escapes, and overwrite attempts.

other

Warning

• Location: references/permissions.md:2

Finding

Permission manifest materially understates network, subprocess, deletion, filesystem, and memory behavior

Content

View full analysis

Vulnerability Details

File Location: references/permissions.md:2-12, 25-42
Vulnerability Type: Misleading permission and risk declaration
Risk Level: Medium

Vulnerable Declaration

The permission header declares the following effective properties:

yaml

risk_level: LOW
high_risk_operations:
  - none
data_access: none
network_access: none
external_services: none
filesystem_write:
  - .standardization/semantic-split/data/*.json

The accompanying tables additionally state that there are no network requests, subprocess calls, file deletions, or sensitive-data accesses.

Technical Analysis

These declarations are inconsistent with confirmed project behavior:

• scripts/setup_env.py launches pip through subprocess.
• scripts/setup_env.py connects to external package indexes.
• scripts/model_manager.py downloads model files from Hugging Face endpoints and mirrors.
• scripts/model_manager.py:296-299 recursively deletes and replaces an existing model target directory.
• scripts/json_manager.py accepts paths outside the declared data directory.
• references/automation_tasks.md documents access to recent Agent memory logs.

A permission manifest is a security boundary when users or automated policy engines rely on it to decide whether a Skill can be installed or invoked. Understating permissions may cause execution to be approved under assumptions that do not match the actual code and documentation.

Attack Path

1. A reviewer or policy engine reads the LOW-risk permission declaration.
2. The Skill is approved on the assumption that it performs no network access, subprocess execution, deletion, or sensitive-data access.
3. A user invokes environment setup, model download, JSON management, or memory automation.
4. The Skill performs operations outside the declared capability profile.
5. Security controls based only on the manifest fail to obtain informed consent or apply appropriate isolation.

Impact Assessment

Th ...[truncated 392 chars]

Remediation

View remediation

Remediation Suggestions

1. Change the declared risk level to reflect package installation, model downloads, and persistent writes.
2. Declare outbound network access and list all expected package and model hosts.
3. Declare subprocess execution for pip.
4. Declare recursive deletion and replacement of model directories.
5. Declare the exact read and write scopes of every JSON manager command.
6. Declare historical memory access as an optional sensitive capability, or remove that workflow.
7. Separate permissions by command so read-only analysis does not inherit installation or download permissions.
8. Require explicit user approval before network access, dependency installation, memory access, or destructive replacement.
9. Add automated checks that compare the permission manifest against network, subprocess, deletion, and filesystem APIs used by the source.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (48)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is described as a planning/decomposition utility, but analysis says it also performs environment checks, pip installs, and external package access. Hidden install and network behaviors are high risk because they expand the attack surface, modify runtime state, and can pull unreviewed code or artifacts without users expecting it.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is described as a planning/decomposition utility, but analysis says it also performs environment checks, pip installs, and external package access. Hidden install and network behaviors are high risk because they expand the attack surface, modify runtime state, and can pull unreviewed code or artifacts without users expecting it.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill is described as a planning/decomposition utility, but analysis says it also performs environment checks, pip installs, and external package access. Hidden install and network behaviors are high risk because they expand the attack surface, modify runtime state, and can pull unreviewed code or artifacts without users expecting it.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is described as a planning/decomposition utility, but analysis says it also performs environment checks, pip installs, and external package access. Hidden install and network behaviors are high risk because they expand the attack surface, modify runtime state, and can pull unreviewed code or artifacts without users expecting it.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill is described as a planning/decomposition utility, but analysis says it also performs environment checks, pip installs, and external package access. Hidden install and network behaviors are high risk because they expand the attack surface, modify runtime state, and can pull unreviewed code or artifacts without users expecting it.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as a planning/decomposition utility, but analysis says it also performs environment checks, pip installs, and external package access. Hidden install and network behaviors are high risk because they expand the attack surface, modify runtime state, and can pull unreviewed code or artifacts without users expecting it.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger phrases include very broad everyday language such as '帮我做', '我需要', and '帮我分析', which can cause the skill to activate in many ordinary conversations. Because the skill also documents shell execution and persistent JSON/template writes, accidental activation could lead to unintended command execution, file access, or state changes without clear user intent.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

> 📚 **渐进式加载**：本技能采用渐进式 MD 体系，`SKILL.md` 为入口（≤230行），详细内容拆分到 `references/*.md` 按需加载。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

> 📚 **渐进式加载**：本技能采用渐进式 MD 体系，`SKILL.md` 为入口（≤230行），详细内容拆分到 `references/*.md` 按需加载。

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases are extremely broad, including common conversational text such as '我需要' and '帮我分析'. This can cause the skill to activate unintentionally across unrelated conversations, potentially intercepting general user requests and routing them into this skill’s planning pipeline without clear user intent.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/json_schema.md (reported line 290)May include surrounding context.

bash

# 按标签自动选取同类能力级 json 生成规则级
python scripts/json_manager.py rule-gen --tag ppt --output rule_ppt_v1.json

# 指定多个文件生成
python scripts/json_manager.py rule-gen --files a.json b.json c.json

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/json_manager.py (reported line 491)May include surrounding context.

python

"tags": [t for t, c in common_tags.most_common(3) if c >= len(caps) // 2]
    }

    return rule


def _condense_steps(all_steps: list[dict], cap_refs: list[dict]) -> list[dict]:

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/model_manager.py (reported line 190)May include surrounding context.

python

def _download_via_hf(model_id: str, source_name: str) -> dict:
    """通过 huggingface_hub 下载模型"""
    env = os.environ.copy()

    source_map = {
        "modelscope":  {"env": {"HF_ENDPOINT": "https://hf-mirror.com"}},

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/model_manager.py (reported line 224)May include surrounding context.

python

def _download_via_hf(model_id: str, source_name: str) -> dict:
    """通过 huggingface_hub 下载模型"""
    env = os.environ.copy()

    source_map = {
        "modelscope":  {"env": {"HF_ENDPOINT": "https://hf-mirror.com"}},

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises shell, environment, file read, and file write capabilities through documented commands and persistent template-saving behavior, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens reviewability and can lead to overbroad execution in hosts that rely on manifest-declared boundaries, increasing the chance of unintended command execution or file modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented positive triggers are still ambiguous and overlap with common requests for general help or planning. In context, this matters because the skill claims automatic scanning and template persistence, so ambiguous activation can perform actions users did not mean to invoke.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow states that templates are automatically saved to capabilities/{task}_v1.json, but users are not prominently warned that their inputs may cause persistent file writes. Automatic persistence can store sensitive project details, create unwanted artifacts, or pollute shared template libraries without informed consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document states there is no external API use and no LLM configuration need, while elsewhere it clearly includes an intelligent-agent/LLM reasoning stage. Contradictory security-relevant claims reduce operator awareness about data flow and processing, which can cause sensitive input to be routed into model reasoning without informed approval.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest description is entirely in Chinese and presents the skill as operating in that locale, but it does not state that language support is optional or limited for a justified regional reason. This can violate language/locale policy when a skill implicitly enforces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document states a rule that outputs must not be embedded in the skill directory, but the illustrated storage paths place generated artifacts under skills/.standardization/semantic-split/..., directly contradicting that rule. In an automation context, this inconsistency can cause generated data to be written into the skill tree, enabling unintended persistence, boundary violations, or later loading/trust of machine-generated artifacts as part of the skill itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file is written predominantly in Chinese, and there is no indication in the visible content that users may choose another language or that the locale restriction is justified as region-specific. Under the policy rules, forcing a specific language without opt-in can constitute a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation is entirely in Chinese and provides no indication that the skill can adapt to the user's language or locale. In a planning/splitting skill, this can cause users to misunderstand constraints, deadlines, or safety/compliance requirements, leading to incorrect execution or exclusion of non-Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file presents all user-facing instructions and troubleshooting text only in Chinese, beginning with the title at L01 and continuing throughout the file. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/json_schema.md (reported line 300)May include surrounding context.

bash

# 创建骨架文件
python scripts/json_manager.py create --type capability --name make_report_v1

# 验证格式
python scripts/json_manager.py validate --file ~/.workbuddy/skills/.standardization/semantic-split/data/capabilities/make_report_v1.json

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file title and all operational instructions are written exclusively in Chinese, and line L003 states the procedure must be loaded at a required step, implying mandatory use. There is no indication that users or operators may choose another language, nor any justification that this is a region-specific or Chinese-only skill.

Content

No source excerpt is available for this finding.