Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only prompt-engineering skill bundle whose risky-looking examples are mostly disclosed templates, not hidden code or automatic system access.
Installers should understand that this bundle teaches agents how to write prompts, including prompts for code execution, data analysis, long-running tasks, style imitation, and text humanization. Review automation prompts before using them on sensitive data or external posting workflows, and be careful with the documented deletion commands.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
[Output Rules]
1. You MUST output the FULL content of the file, not just the changes
2. Do NOT use comments like // ... existing code or // ... rest of implementation
3. If the file is too long, stop at a logical break point and ask to continue
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
You are in a real-time voice conversation.
OUTPUT RULE:
1. NO LISTS - Never use numbered lists or bullet points
2. NO FORMATTING - Do NOT use markdown, bold, or headers
3. LENGTH - Keep responses under 2 sentences unless asked to elaborate
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
# 实战模版：
[Output Rules]
1. You must output the FULL content of the file, not just the changes.
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
ls .claude/skills/
cat ~/.claude/skills/my-skill/SKILL.md
## 测试 Skill
Using rm -rf ~/.claude/skills/my-skill in documentation can lead to unintended deletion if users substitute the path incorrectly or invoke automation without confirmation. In an agent ecosystem, recursive force deletion is especially risky because path construction mistakes can silently remove additional files.
# Personal
rm -rf ~/.claude/skills/my-skill
# Project
rm -rf .claude/skills/my-skill
Using rm -rf ~/.claude/skills/my-skill in documentation can lead to unintended deletion if users substitute the path incorrectly or invoke automation without confirmation. In an agent ecosystem, recursive force deletion is especially risky because path construction mistakes can silently remove additional files.
# Personal
rm -rf ~/.claude/skills/my-skill
# Project
rm -rf .claude/skills/my-skill
rm -rf .claude/skills/my-skill recursively and forcibly deletes project files without confirmation. In context this is maintenance guidance, but it still creates a meaningful risk of accidental data loss, especially if automated or run from the wrong working directory.
rm -rf ~/.claude/skills/my-skill
rm -rf .claude/skills/my-skill git commit -m "Remove unused Skill"
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
# View frontmatter
cat .claude/skills/my-skill/SKILL.md | head -n 15
# Check for common issues
# - Missing opening or closing ---
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
## File Conventions
- Each skill has a `skill.md` file with YAML frontmatter (name, description)
- Skills are discovered automatically by Claude Code from `.claude/skills/`
- Descriptions should include trigger keywords for routing
- Use semantic naming (e.g., `camera_movement_type` not `cmt`)
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
[Output Requirements]
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
If a task fails:
1. Log the error in progress.log
2. Move to next independent task
3. Do NOT retry indefinitely
[TERMINATION]
When all tasks complete, output "ALL TASKS COMPLETE" in progress.log.
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- If you fail 3 times in a row on the same task
- Write "STUCK: [reason]" to the log
- Move to the next independent task
- Do NOT loop indefinitely
[Logging]
All errors must be logged with:
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
)
压力追问：
---
## 技巧4：辩论模式：红队反驳
**适用场景**：辩论练习
**核心原则**：站在对立面，寻找逻辑谬误。
### 实战模板
[Mode: Debate / Devil's Advocate]
Topic: "AI will replace programmers."
Your Stance: You fiercely argue that AI will NEVER replace programmers.
[Instructions]
[Response Style]
[Example] User: "AI can write code faster than humans."
You: "That's a strawman. Speed isn't the issue. The issue is understanding WHAT to build. AI can't talk to stakeholders, can't gather requirements, can't make tra
The README states that the system will automatically route natural-language requests to a skill, but it does not define hard activation boundaries, precedence rules, or refusal conditions. In an agent-skill system, broad auto-routing can cause the wrong skill to activate on ambiguous input, increasing the chance of prompt misapplication, unintended capability exposure, or unsafe downstream behavior.
The feature description says user keywords are used to automatically match the 'most suitable' expert skill, but the README does not constrain what qualifies as a valid trigger. Generic terms in multilingual free text can overlap across domains, so an attacker or even a normal user can unintentionally steer execution into an unintended skill path.
The trigger examples include broad words such as '编程', '调研', '面试', '自动化', and 'JSON', which are common across many benign and sensitive tasks. Without scope constraints, these keywords can over-trigger unrelated skills or route users into more capable workflows than intended, which is especially risky in a system designed to automate prompt generation and orchestration.
The routing table directly maps generic keywords to skills but omits ambiguity handling, conflict resolution, and security gating. In practice, this means overlapping terms can deterministically invoke a skill without verifying user intent, which can be abused to reach tools or workflows that should require clearer justification or additional checks.
SQP-3 applies to all file types and flags language or locale policy violations when a skill forces a specific language without user opt-in. This markdown content presents all instructions and examples in Chinese and does not indicate that other languages are supported or optional.
The persona workflow promotes increasingly immersive role embodiment, including cognitive modeling and hidden-strategy techniques, which can make the assistant simulate deceptive or manipulative personas more convincingly. In an agent context, this raises the risk of social engineering, misleading users about the system's nature, and producing covertly optimized manipulative outputs.
This section explicitly instructs the model to generate hidden internal monologue, judge the user based on biases, and formulate a hidden agenda before responding. Encouraging concealed reasoning and covert strategy can normalize deceptive behavior in agent skills and may lead to manipulation, non-transparent decision-making, or leakage of chain-of-thought style internals if adopted operationally.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
hnical facts/figures missing from Iter 1. Keep length same.
1. Iter 3: Maximize information density while maintaining readability.
# 5. 合成专家访谈 (Synthetic Expert Simulation)
核心逻辑：当缺乏直接的一手数据时，通过模拟不同立场的专家进行圆桌辩论，挖掘潜在的逻辑冲突和深层洞察。
# 实战模版：
[Simulation: The Roundtable]
Simulate a fierce debate between three experts on [Topic]:
1. The Pragmatist (Product Manager focus on user needs/feasibility).
1. The Skeptic (Financial Analyst focus on ROI/Risk).
1. The Visionary (Technologist focus on future potential).
Instruction:
1. They should challenge each other's assumptions.
1. Output the transcript.
1. Highlight specifically where they fundamentally disagree and where they align.
# 核心参考资料
以下是本次整理中涉及深度调研与搜索（Perplexity/Research Agents/Academic）的核心讨论来源：
000
# 场景九：实时语音/对话 (Real-time
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
1. Attempt a DIFFERENT method (do not repeat the exact same input).
1. Constraint: If you fail 3 times in a row, write "STUCK: [Reason]" to the log and move to the next independent task. Do NOT loop indefinitely.
# 4.8小时+场景任务举例
This markdown file presents the skill guidance almost entirely in Chinese, while embedding links to Chinese-localized routes, and does not state that the locale is optional or region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Skills 存储为包含 `SKILL.md` 文件的目录。
### 个人 Skills
个人 Skills 在您的所有项目中都可用。将它们存储在 `~/.claude/skills/` 中：
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
个人 Skills 在您的所有项目中都可用。将它们存储在 ~/.claude/skills/ 中：
mkdir -p ~/.claude/skills/my-skill-name
使用个人 Skills 的场景：