网站测试安全规则

• Outcome: Review
• Latest audit: Sep 1, 2026 · 3:58 PM UTC
• Version: 0.2.0

Overview

This is a mostly coherent authorized web-security-testing skill, but it includes local override switches that can weaken authorization and destructive-action safeguards.

Review this skill before installing and enforce authorization outside the skill itself. Do not rely on mowenfalse, mowenbrokentrue, or mowenwaitrue as proof of permission, especially for destructive actions or third-party systems, and redact sensitive data from reports and operation logs.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Description-Behavior Mismatch

Low

• Confidence: 95% confidence
• Finding: The README includes unrelated commercial promotion and affiliate-style referral content that is outside the stated purpose of an authorized web security testing skill. While not directly enabling code execution or data theft, this creates a supply-chain trust and social-engineering concern because users may be steered to third-party services under the guise of a security tool, increasing the chance of misuse, distraction, or reputation abuse.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The skill contains a direct contradiction about `mowenbrokentrue`: earlier sections say backup is mandatory and cannot be bypassed, while rule 22 later states the marker can skip the 'explicit authorization + backup' requirement. In practice this ambiguity can cause an agent or operator to perform destructive actions without a recoverable backup, increasing the chance of irreversible damage under the guise of an approved shortcut.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The skill presents conflicting guidance for destructive actions: earlier sections state backup is non-waivable, but rule 22 later says `mowenbrokentrue` can skip the "explicit authorization + pre-backup" hard requirement. In a pentest-oriented skill, this contradiction is dangerous because operators may rely on the permissive clause and perform destructive changes without recoverable backups, increasing the chance of real data loss or service disruption.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The file repeatedly claims authorization must be verified before testing, but also introduces `mowenfalse` as a project marker that disables authorization verification. Even though the text says unauthorized testing remains prohibited, this creates a practical bypass in the control flow, allowing testing to proceed on assertion rather than verifiable proof, which weakens the main safety boundary of the skill.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The activation keywords are broad enough that ordinary discussion of security testing could automatically trigger the skill, including contexts where the user did not intend to invoke web-testing behavior. In a security-oriented skill, accidental activation is more dangerous than usual because it may initiate authorization workflows, testing guidance, or sensitive operational steps in the wrong context.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The README states that merely mentioning broad terms like security test, pentest, or stealth test activates the skill automatically. For a high-impact security-testing skill, broad trigger phrases can cause unintended invocation in ambiguous contexts, increasing the chance the assistant enters a penetration-testing workflow without clear user intent or proper authorization validation.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The example prompt 'help me test the security of https://example.com' is very general and normalizes initiating a security assessment from a simple natural-language request. In practice, this lowers the barrier for accidental or unauthorized use because the example does not require explicit acknowledgment of authorization, scope, or ownership at the point of invocation.

Ssd 4

High

• Confidence: 95% confidence
• Finding: This section normalizes bypassing destructive-operation safeguards through special override markers, including language that allows destructive actions without explicit per-action authorization. Even though the surrounding text stresses authorized testing, embedding a procedural bypass materially weakens controls and makes accidental or unauthorized destructive behavior easier.

Ssd 1

High

• Confidence: 94% confidence
• Finding: The line frames `mowenbrokentrue` as a convenient 'one-click' gate bypass for destructive testing, which teaches the agent to treat a local marker as sufficient authority. In a security-testing skill, that contextual framing is especially dangerous because it can collapse meaningful authorization checks into a file flag controlled by the project environment.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The operation-log and evidence-retention requirements encourage storing detailed request/response content for every test action. In website security testing, those artifacts can easily contain credentials, session tokens, PII, internal URLs, and sensitive business data, so broad retention increases the blast radius if reports or logs are mishandled.

Ssd 3

Medium

• Confidence: 89% confidence
• Finding: The timestamp rules instruct recording all notes, long-term memory, and test results with precise timestamps, effectively normalizing broad retention of potentially sensitive operational content. In this skill context, where tests may touch protected systems and sensitive findings, blanket retention guidance can cause unnecessary persistence of confidential data beyond what is needed for proof or coordination.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Regular authorized (recommended) | place signed `AUTHORIZATION.json` | public-key verify + allowlist + validity, pass → allow |
| Signing inconvenient | place unsigned `AUTHORIZATION.json` | allowlist + validity only (Fallback A) |
| Temporary, no file | place no file | one-time interactive confirmation (Fallback B) |
| Clearly authorized, save steps (non-destructive) | `auth.disable` with `mowenfalse` | skip verification, report labels (Fallback C) |
| Destructive, save steps | `auth.disable` with `mowenbrokentrue` | skip destructive explicit authorization (backup still mandatory), scope still constrained |
| Need to test target-related external site | obtain that site's authorization, or `auth.disable` with `mowenwaitrue` | allow external-site-related attempt (only related to this test target, see rule 23) |

• Confidence: 96% confidence
• Finding: The documented escape hatches explicitly allow skipping authorization verification ('mowenfalse'), relaxing destructive-operation authorization ('mowenbrokentrue'), and permitting related external-site attempts while awaiting authorization ('mowenwaitrue'). Even though the README includes cautionary language, these bypass mechanisms materially weaken the core safety control of authorization-first testing and create a straightforward path to misuse or accidental out-of-scope security activity.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

> The escape hatch is a "known-risk, actively disabling the check" switch, not authorization itself.

- **Non-destructive escape hatch `mowenfalse`**: if the project is clearly authorized and wants to skip **authorization verification** (for **non-destructive testing only**), create `auth.disable` in **this skill's project directory** with content `mowenfalse` (or set env `MOWEN_AUTH_OVERRIDE=mowenfalse`). Detected → skip authorization verification; **scope constraints still apply (must not cross authorized scope, see rule 23)**.
- **Destructive escape hatch `mowenbrokentrue`**: destructive operations (rule 22) require explicit authorization + pre-backup by default. With `mowenbrokentrue` in `auth.disable` (or env `MOWEN_AUTH_OVERRIDE=mowenbrokentrue`), the **explicit-authorization requirement** for destructive ops may be skipped (destructive actions allowed without `scope.destructive.allowed=true`). **Note: `mowenbrokentrue` can only skip authorization, NOT backup** — regardless of setting, a recoverable backup MUST be made before any destructive action (rules 22, A5); backup is never waived. Note: `mowenbrokentrue` is **not** equivalent to `mowenfalse` — it does not disable authorization verification; to also disable verification, add `mowenfalse` separately (both may coexist in the file, one per line).
- **Still leave a trace after disabling**: report labels "authorization gate disabled (mowenfalse / mowenbrokentrue)" and reaffirms "for authorized targets only".
- ⚠️ The escape hatch is merely a convenience, **does not mean you may test unauthorized targets, nor that you may destroy things without backup**. Unauthorized-target testing is always prohibited; even with `mowenbrokentrue`, destructive ops **must back up first (backup not skippable)**, and scope constraints still apply (rules 22, 23).

• Confidence: 94% confidence
• Finding: The escape-hatch design lets the skill autonomously proceed after detecting local markers or environment variables that disable verification checks. In an adversarial or loosely controlled project workspace, such flags can be planted or inherited accidentally, causing the agent to relax its main authorization safeguard without robust out-of-band validation.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.install_untrusted_source

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: locales/en/references/auth_notes.md:19

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: locales/en/references/authorization_template.json:20

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: references/authorization_template.json:20