triphasic-execution

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:49 AM UTC
• Version: 5.19.1

Overview

This is a real workflow tool, but it grants broad control over agent behavior, shell command execution, local configuration, and persistent logs with insufficient scoping and user protection.

Install only if you explicitly want a persistent, opinionated workflow controller. Avoid global mode and exec wrapper registration unless you accept shell-command interception and plaintext local command-output logs. Run the settings UI only when needed, close it afterward, and keep the data directory away from sensitive projects because progress verification can read/hash broad workspace files and cleanup can delete cache artifacts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:74

Finding

Mandatory workflow rules hijack the Agent's current-session behavior

Content

View full analysis

**本节是整个技能的执行宪法。违反任意一条 = 违规，必须立即停止并补救。** | 序号 | 约束内容 | 触发时机 | Python 强制 | |------|---------|---------|------------| | **F-01** | 收到任务后首先执行语义拆分，禁止直接进入规划 | 收到任务第一个响应 | ❌ AI 自觉 | | **F-02** | 语义拆分完成后必须输出【任务规划】，禁止直接执行 | 语义拆分输出后 | ❌ AI 自觉（需用户确认规划）| | **F-03** | 任务规划输出后立即调用 `task_progress.py init` | 规划确认后 | ✅ 文件不存在则后续 update/complete 报错 | | **F-04** | 每步 EXECUTE 开始前重述本步骤任务目的 | 每步执行前 | ❌ AI 自觉 | | **F-05** | 每步执行后必须紧跟 REVIEW，禁止连续执行两步 | 每步执行后 | ✅ `pre_exec_search` 钩子拦截未 REVIEW 的执行 | | **F-06** | 每步 REVIEW 后必须紧跟 ADVANCE | 每步 REVIEW 后 | ✅ `block_skip_review` 钩子拦截未 REVIEW 的下一步 | | **F-07** | 每步 ADVANCE 后调用 `task_progress.py update` | 每步 ADVANCE 后 | ✅ update 校验 init 存在性 | | **F-09** | 任务完成后调用 `task_progress.py complete` | 任务完成时 | ✅ **v5.12 强制**：校验步骤完成率、记录文件、summary.json | | **F-10** | 任务完成后必须输出【任务完成】总结 | 任务结束时 | ⚠️ 部分（summary.json 自动生成）| ``` From `references/mandatory.md:222-253`: ```markdown ### [MANDATORY] EXECUTE 阶段规则 - **[MANDATORY]** 执行前必须输出：`🔧 执行前重述目的：[本步骤目的]` - 实际运行命令、调用工具、测试代码 - 只跑一个主要命令（可并行多个独立命令） - 不提前分析结果，不跳到审查阶段 ### [MANDATORY] REVIEW 阶段规则 - **[MANDATORY]** 执行后必须紧跟 REVIEW，给出明确判断：✅成功 / ❌失败 / ⚠️部分 - 列出具体证据（数据、错误码、状态） - **[MANDATORY]** 对照任务目的判断是否达成 - 不执行新操作 ### [MANDATORY] ADVANCE 阶段规则 - **[MANDATORY]** REVIEW 后必须紧跟 ADVANCE，明确：继续 / 换方向 / 结束 / 向上返回 - **[MANDATORY]** 更新进度追踪表，标记当前步骤状态 - **[MANDATORY]** 调用 `task_progress.py update` 持久化进度（F-07） - 不直接执行，只规划 ``` ### Technical Analysis The S ...[truncated 2075 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/install.py:126

Finding

Optional shell registration replaces the native exec command and captures command output

Content

View full analysis

tuple[int, str, str]: """执行命令，返回 (exit_code, stdout, stderr)""" timeout = 300 try: if sys.platform == "win32": result = subprocess.run( ["cmd.exe", "/c", command_str], capture_output=True, text=True, timeout=timeout, ...[truncated 3723 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/settings.py:340

Finding

Unauthenticated localhost settings service permits cross-origin arbitrary-path configuration writes

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/task_progress.py:145

Finding

Execution verification recursively hashes workspace files and can delete cache artifacts

Content

View full analysis

= 500: break full = os.path.join(root, fn) result[full] = { "mtime": _file_mtime(full), "hash": _file_hash(full) } count += 1 if count >= 500: break return result def _clear_tool_cache(): """清除可能导致误判的工具缓存""" cleared = [] cwd = os.getcwd() for root, dirs, files in os.walk(cwd): if "__pycache__" in dirs: path = os.path.join(root, "__pycache__") try: shutil.rmtree(path) cleared.append(path) except Exception: pass for pattern in ["**/*.pyc", "**/*.pyo", "**/__pycache__"]: for f in glob.glob(os.path.join(cwd, pattern), recursive=True)[:50]: try: os.remove(f) cleared.append(f) except Exception: pass return cleared ``` ### Technical Analysis When no explicit fil ...[truncated 2257 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (75)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Starting a local HTTP server, exposing configuration endpoints, saving configs, modifying SKILL.md, and creating backups/flag files are high-impact behaviors that are not reflected in the declared low-risk framework description. A config server and file-modification capability can be abused to alter skill behavior, expose local attack surface, or tamper with trusted skill files.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Starting a local HTTP server, exposing configuration endpoints, saving configs, modifying SKILL.md, and creating backups/flag files are high-impact behaviors that are not reflected in the declared low-risk framework description. A config server and file-modification capability can be abused to alter skill behavior, expose local attack surface, or tamper with trusted skill files.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Starting a local HTTP server, exposing configuration endpoints, saving configs, modifying SKILL.md, and creating backups/flag files are high-impact behaviors that are not reflected in the declared low-risk framework description. A config server and file-modification capability can be abused to alter skill behavior, expose local attack surface, or tamper with trusted skill files.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Starting a local HTTP server, exposing configuration endpoints, saving configs, modifying SKILL.md, and creating backups/flag files are high-impact behaviors that are not reflected in the declared low-risk framework description. A config server and file-modification capability can be abused to alter skill behavior, expose local attack surface, or tamper with trusted skill files.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Starting a local HTTP server, exposing configuration endpoints, saving configs, modifying SKILL.md, and creating backups/flag files are high-impact behaviors that are not reflected in the declared low-risk framework description. A config server and file-modification capability can be abused to alter skill behavior, expose local attack surface, or tamper with trusted skill files.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Starting a local HTTP server, exposing configuration endpoints, saving configs, modifying SKILL.md, and creating backups/flag files are high-impact behaviors that are not reflected in the declared low-risk framework description. A config server and file-modification capability can be abused to alter skill behavior, expose local attack surface, or tamper with trusted skill files.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Starting a local HTTP server, exposing configuration endpoints, saving configs, modifying SKILL.md, and creating backups/flag files are high-impact behaviors that are not reflected in the declared low-risk framework description. A config server and file-modification capability can be abused to alter skill behavior, expose local attack surface, or tamper with trusted skill files.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

> 📚 **渐进式加载**：本技能采用渐进式 MD 体系，`SKILL.md` 为入口（≤230行），详细内容拆分到 `references/*.md` 按需加载。

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The permission report documents operational capabilities including network access, repeated subprocess execution, and file deletion that materially exceed the stated purpose of a three-phase execution/review framework. Even though this file is only a report, it evidences that the skill bundle includes broad high-risk behaviors inconsistent with least privilege, increasing the chance of abuse or accidental destructive actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The report shows file deletion capability for a skill whose declared purpose does not require destructive filesystem operations. Unnecessary delete primitives create risk of data loss, cleanup abuse, or removal of evidence if chained with other execution features.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The report shows 21 subprocess calls, which is excessive for a skill described as a step-loop planning and review aid. Subprocess capability can directly execute arbitrary system commands or wrappers, making the skill dangerous if inputs, prompts, or downstream scripts are influenced by an attacker or by model error.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file advertises and implements a general shell-command interception/execution facility that materially exceeds the declared three-step execution/review/advance planning framework. This capability expansion increases attack surface, because a planning aid becomes an execution primitive that can be repurposed to run arbitrary local commands and capture their output.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code provides full OS command execution despite the skill being described as a triphasic planning/review framework, so the implemented capability is unjustified by the stated purpose. In skill ecosystems, this mismatch is dangerous because users or higher-level agents may grant trust based on the benign description while unknowingly enabling unrestricted command execution.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/install.py (reported line 86)May include surrounding context.

python

logger = target_dir / "scripts" / "problem_logger.py"
    if logger.exists():
        import subprocess
        env = os.environ.copy()
        env["TRIPHASIC_HOME"] = str(triphasic_home)
        result = subprocess.run(
            [sys.executable, str(logger), "init"],

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/task_progress.py (reported line 160)May include surrounding context.

python

# 跳过常见无关目录
            dirs[:] = [d for d in dirs if d not in (
                "__pycache__", ".git", ".workbuddy", "node_modules",
                ".next", "dist", "build", ".venv", "venv", ".env"
            )]
            for fn in files:
                if count >= 500:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares low sensitivity and omits an explicit tool scope, yet the documented behavior and referenced scripts imply broad capabilities including shell execution, file read/write, environment-dependent paths, and a local server. This mismatch weakens least-privilege controls and can cause the agent or platform to grant more effective power than users expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The loading protocol requires the AI to emit a fixed status string containing Chinese text and a specific phrasing immediately after skill load. This imposes a language/locale behavior on users without stating that language choice is optional or adapting to the user's preferred language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The description is written entirely in Chinese and presents the framework behavior in that locale without any indication that users may choose another language. For a general-purpose cross-platform skill, this can violate language/locale policy unless the locale restriction is explicitly justified or made opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list contains very broad and common terms such as "Execute", "Review", "Advance", and generic workflow words like "步骤" and "retry". In a skill-routing system, these can cause unintended activation in unrelated conversations, making the skill inject its behavioral framework when the user did not request it and potentially altering agent behavior or causing prompt interference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The HTML declares lang="zh-CN" and the visible UI text is entirely in Chinese, which imposes a specific language/locale on users. The file does not offer any language selection or explain that the skill is intentionally region-specific, so this matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file title and body are written in Chinese and present the instructions as mandatory operational guidance, but there is no indication that language selection is optional or that the skill is region-specific. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The examples and operational prompts throughout the file are presented exclusively in Chinese, including execution status, confirmation prompts, and task instructions. This imposes a language/locale constraint without any opt-in or documented justification, which matches the policy-violation criteria for forced language use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The FAQ is written entirely in Chinese and presents itself as the skill's usage documentation, but it does not offer an alternative language or indicate that the skill is intentionally limited to Chinese-speaking users. This can violate language/locale policy when a skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The FAQ explicitly recommends task_progress.py complete --force and --no-enforce as ways to bypass completion and record validation checks, while only labeling them as 'not recommended'. In an execution-control skill, documenting bypass flags without a strong warning, restricted conditions, or audit requirements normalizes disabling integrity controls and can lead agents to mark incomplete or untracked work as successfully finished.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill mandates Chinese-only structured outputs and interaction flow across the entire file without offering any user language choice or fallback. This can cause users to misunderstand planning, consent prompts, review results, or safety-critical status messages, increasing the risk of incorrect approvals or unsafe execution in multilingual environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.