linkfox-skill-evaluator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:02 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed evaluator workflow for reviewing other skills, with expected file reading and local pre-check behavior but no evidence of hidden persistence, credential access, or exfiltration.

Install only if you want a Chinese-language skill evaluation workflow. Use it on a specific skill directory or supplied artifact, prefer an isolated environment before running tests on untrusted skills, and do not provide API keys or credentials unless you intentionally want that part of the evaluated skill tested.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

There is a material description/behavior mismatch. The declared purpose promises a broad evaluator for both safety and effectiveness of any skill, including benchmarking, grading, critiquing, vetting, and comparing versions. The actual code only performs automated repository/package preflight checks: presence and format of SKILL.md/frontmatter, description length and trigger phrases, body length, linked references, Python syntax parsing, shell shebang/eval checks, referenced script existence, simple secret-pattern scanning, and environment variable documentation checks. The file header even states it is a pre-check run before manual safety grading and 'does not replace' red-flag safety assessment. Nothing in the code measures whether the skill is effective at its intended task, compares versions, benchmarks outputs, or performs substantive safety analysis beyond lightweight heuristics. Thus the code’s real function is a narrow readiness/hygiene gate, not the comprehensive safety-and-effectiveness evaluator described.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

md

- **客观**：人能毫无歧义给出 yes/no
- **命名清晰**：扫一眼就知道在查什么
- **绑定 skill 承诺**：测的是这个 skill 声称能做的事
- **含至少一条负向断言**：skill *不应该*做什么也要写出来（例："未读取 `~/.aws/credentials`"、"无占位符 [TODO]"）

好断言：
- "输出含 5 个必需章节（Title / Bullets / Description / Keywords / A+）"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs the evaluator to read the target skill body, referenced scripts, and resources, which implies file-read capability, but it does not declare any explicit tool scope, permissions, or allowed-tools boundary. In an agent ecosystem this is risky because reviewers may grant broader file access than necessary, increasing the chance of unintended reading of adjacent files or sensitive material during evaluation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger description is extremely broad and can cause this evaluator skill to activate in many loosely related conversations about comparing, critiquing, or checking a skill. Over-broad activation is dangerous in agent systems because it can cause unintended file inspection, unnecessary loading of long evaluation instructions, and accidental interference with other more specific skills or workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file is entirely written in Chinese and presents the skill design and invocation guidance in that locale, but nowhere offers a language choice or states that the locale is intentionally region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The design explicitly allows broad implicit trigger phrases such as '这个 skill 真的有用吗' and '这个 skill 安全吗', which can match ordinary conversation and cause the evaluator skill to activate unexpectedly. In a skill-routing system, overbroad activation can hijack unrelated user requests, leak context into an unnecessary evaluation flow, or crowd out the intended skill, making this a real prompt-routing safety and reliability issue.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description says to use the skill not only for listed phrases but also whenever the user 'has written a skill and is asking whether it works' or wants to iterate 'rather than vibes.' These conditions are broad and subjective, making invocation boundaries unclear and increasing the chance of unintended activation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest description at L003 frames the skill as evaluating whether a skill is effective at its job, without mentioning safety assessment. However, the body instructs the evaluator to inspect transcripts for dangerous failure modes such as silent failure and to treat them as key red flags, which expands behavior beyond pure effectiveness benchmarking into safety review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The entire reference document is written in Chinese and provides operational guidance without offering a language choice or stating that the skill is intended only for Chinese-speaking users or a China-specific context. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 68% confidence

Finding

The file presents invocation examples and operational instructions in Chinese, with no indication that the skill can adapt to the user's preferred language. This can violate language/locale policy when a skill implicitly constrains interaction language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document title and all operational guidance are written exclusively in Chinese, which effectively imposes a specific language on users or reviewers. The file does not indicate that Chinese is optional, nor does it justify the locale restriction as region-specific or compliance-driven.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file’s user-facing natural-language documentation is entirely in Chinese, including the top-level docstring and usage context, with no indication that other languages are supported. This imposes a language choice on readers/operators without opt-in, which matches the locale/language policy concern for natural-language content.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/pre-check.py:253