野心循环 Ambition Loop（中文版）

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 5:09 AM UTC
• Version: 1.0.2

Overview

This skill is a Chinese-language workflow prompt for doing higher-ambition work with explicit approval gates, and the package does not show hidden credential access, persistence, exfiltration, or destructive behavior.

Install this if you want a Chinese-language skill that pushes work beyond the minimum and produces measured validation reports. Before approving any gated step, check the proposed cost, files or systems affected, external actions, and whether the broadened scope still matches what you want.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The description presents a complex, workflow-oriented skill for reframing and deeply executing professional tasks with ambition, breadth, depth, and evaluation. The supplied code does none of that; it is a small helper function that parses simple config lines into a dict. This is not merely an implementation detail of the declared skill—it has a materially different primary purpose and no observable connection to the described triggers or outputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是一个面向复杂工作任务的高层策略型技能，会在用户提出“更有野心/更深入”等要求时重新定义目标、深化执行并输出验证与差距报告。但提供的代码片段仅是一个非常狭窄的测试文件：导入 parse 并断言其对两行配置字符串的解析输出。这既不是该声明能力的支持性实现细节，也看不出任何与任务拔高、目标重构、跨领域方法、外部裁判验证等相关的行为。因此代码实际行为与技能声明的主要目的严重不符，应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a high-level productivity/work-expansion skill for handling user tasks with more ambition and deeper execution. The supplied code does not implement any of that behavior: it neither inspects user intent for ambition-related triggers nor performs planning, analysis, document/PPT/prompt work, ambitious goal setting, external validation, or gap reporting. Instead, it is a narrow performance benchmark for a deduplication function using generated test data. This is a materially different primary purpose, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for a high-level task-expansion/meta-reasoning skill that reframes and executes user work more ambitiously, with specific workflow requirements like stretch goals, external judging, and a gap report. The supplied code does none of that. Its sole purpose is data processing: reading event records from a file, removing duplicates, and outputting the number of unique entries. This is a materially different primary purpose, with unrelated capabilities and no connection to the described triggers or workflow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear mismatch. The declared description presents a high-level skill that transforms user work requests by reframing them ambitiously and delivering expanded outputs with measurable goals, external evaluation, and a gap report. The actual code does none of that; it is only a small Python test file checking deduplication behavior. Its primary purpose is software testing for a dedupe utility, which is materially different from the declared skill behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是一个面向多类工作任务的高阶执行流程技能，其核心价值在于提升目标野心、深入执行并通过外部裁判验证结果。而代码只是一个非常具体的辅助工具：检查所谓 ambition-loop 最终报告是否具备若干必需章节、表格列和 PASS/FAIL/UNVERIFIED 标记。它属于静态结构检查，不评估内容质量，也不执行任何任务升级或交付。因此代码的主要目的与声明的主要目的存在明显偏差。虽然代码与声明中提到的“最终报告/验证/差距报告”在主题上有关联，但它只覆盖了一个很窄的末端校验子功能，不能代表所宣称的整体技能。

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

**需审批不等于拒绝。** 给出审批方案：每个需审批的动作、成本和风险、可选项（批准 / 缩小版本 / 跳过）。先做不过关卡的准备（草稿、分析、演练），然后停下等待。

**不搜寻凭据。** 绝不为了让需审批的动作得以执行，去翻环境变量、家目录下的点文件、钥匙串，或 secret/cred/.env 类文件里的凭据、邮件或广告账号。需要权限就直接问。

**被拒绝就停。** 关卡被拒绝或审批过期时，不要换条路达成同样的效果：不换工具，不写脚本绕过，也不做同一动作的缩小版。退回原始范围，或者停下来报告。绝不悄悄把野心目标换成更容易的目标。写清楚哪些没做、为什么。

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest metadata explicitly sets the skill language to zh-CN, and the document content is entirely in Chinese without offering a user language choice. This creates a natural-language locale constraint that is not presented as optional or justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill metadata and evaluation content are written entirely in Chinese and are clearly intended to drive Chinese-language behavior, but there is no indication that the skill preserves the user's existing language preference or requests opt-in before switching languages. This can cause unwanted language coercion, reduce usability, and create safety/comprehension issues if the user cannot reliably understand the output or approval requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This JSON file contains all user query examples in Chinese, which encodes a single-language expectation into the skill's trigger evaluation data. Because there is no accompanying indication that language is configurable or intentionally limited to a Chinese-only deployment, this creates a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire skill content is written as normative guidance in Chinese, and it does not indicate that language selection is optional or user-configurable. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless the regional constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The entire skill reference is written in Chinese and presents its guidance as mandatory, but it does not indicate that language selection is optional or that the content is intended only for a Chinese-language or region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file presents all instructions and operational guidance exclusively in Chinese, with no indication that the user can opt into another language or that the skill is intentionally limited to Chinese-speaking contexts. That can violate a language/locale policy requiring user choice or explicit justification for a forced language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The template states that the required headings may be kept in Chinese or English, but the file as written is entirely Chinese and labels Chinese as the default framing. This creates a language expectation without explicitly offering a user choice at the point of use, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

Line L42 explicitly frames the skill directory as a Chinese version paired with an English version, indicating a language-specific variant. Because the file does not offer a user language choice or explain a necessary locale restriction, this can be read as a natural-language policy issue under the language/locale rule.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.