批判性思维提问教练

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:47 AM UTC
• Version: 1.0.10

Overview

This is a coherent Markdown critical-thinking coaching skill with no artifact-backed evidence of code execution, credential access, persistence, exfiltration, or destructive behavior.

Install this if you want a Chinese-first critical-thinking assistant for reviewing arguments, decisions, data claims, or debate positions. Be aware it may activate broadly when you paste proposal-like text, so invoke another skill explicitly if you do not want critique-style analysis.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (18)

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
</div></nav>

<!-- Hero -->
<section class="hero"><div class="container">
<div class="hero-badge"><span class="dot"></span><span data-en="v2.0.0 · Open Source · Based on《Asking the Right Questions》" data-zh="v2.0.0 · 开源发布 · 基于《学会提问》">v2.0.0 · 开源发布 · 基于《学会提问》</span></div>
<h1><span data-en="Critical Thinking Coach:<br>Not lectures — <em>critical questioning</em>." data-zh="批判性思维提问教练：<br>不是讲道理，而是<em>批判性提问</em>">批判性思维提问教练：<br>不是讲道理，而是<em>批判性提问</em></span></h1>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
</div></section>

<!-- Highlights -->
<section class="block bg-warm" id="highlights"><div class="container">
<div class="section-label">✨ <span data-en="Core Highlights" data-zh="核心亮点">核心亮点</span></div>
<h2 class="section-title"><span data-en="Structure, not vibes" data-zh="靠结构，不靠感觉">靠结构，不靠感觉</span></h2>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

<section class="block bg-warm" id="highlights"><div class="container">
<div class="section-label">✨ <span data-en="Core Highlights" data-zh="核心亮点">核心亮点</span></div>
<h2 class="section-title"><span data-en="Structure, not vibes" data-zh="靠结构，不靠感觉">靠结构，不靠感觉</span></h2>
<p class="section-desc"><span data-en="Every output is anchored to a named framework and a quoted sentence. No abstract lecturing, no moral judgement on your position — only the quality of the reasoning." data-zh="每一条输出都锚定到一个具名框架和一句被引用的原文。不讲抽象大道理，不当道德裁判评判立场对错，只评估论证本身的质量。">每一条输出都锚定到一个具名框架和一句被引用的原文。不讲抽象大道理，不当道德裁判评判立场对错，只评估论证本身的质量。</span></p>
<div class="hl-grid">

<div class="hl">

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Hidden Instructions

High

• Category: Prompt Injection

Content

</tbody></table></div>
</div></section>

<!-- Workflows & Interaction Modes -->
<section class="block bg-warm" id="workflows"><div class="container">
<div class="section-label">🚀 <span data-en="Interaction Modes &amp; Workflows" data-zh="三种交互模式 &amp; 六大工作流">三种交互模式 &amp; 六大工作流</span></div>
<h2 class="section-title"><span data-en="Say it plainly. It picks the right lane." data-zh="正常说话，它自己选路">正常说话，它自己选路</span></h2>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The README defines triggers such as "train me," "ask me questions," "should we do this?" and "how should I read this?" as activation phrases. These are common conversational phrases without clear exclusion conditions or tight context limits, so they could collide with ordinary chat and make invocation boundaries unclear.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

git clone https://github.com/muippt/mu-critical-thinking.git ~/.claude/skills/mu-critical-thinking
```

> Using a different agent? Just drop the folder wherever your tool loads skills from. Project-level works too: `.claude/skills/mu-critical-thinking`.

**2. Verify** — restart your agent and confirm the skill is picked up

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The default behavior 'directly paste text -> automatically run 12-dimension scan' is overly broad and lacks a strict activation boundary. Any pasted content could unintentionally trigger the skill, causing misrouting of user intent and unnecessary analysis, which is especially problematic in multi-skill agents where broad defaults can override more appropriate behaviors.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill defines broad natural-language trigger phrases such as '训练', '追问', '帮我审计', and '教我看数据', which are common in ordinary conversation and can cause unintended activation. In an agent environment, accidental invocation can redirect the assistant into this skill's behavior unexpectedly, leading to prompt-context hijacking of normal tasks, though this skill's domain is low-risk because it is analytical rather than code-executing.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The skill’s display name, description, templates, and interaction rules are entirely written to operate in Chinese, with no indication that users may choose another language. This can constitute a language/locale policy issue because the skill appears to impose a specific language without offering user choice or documenting a justified locale restriction.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The description lists trigger words such as “追问”, “证据可信”, and “逻辑漏洞”, which are common conversational phrases and not narrowly scoped to this skill. Without stronger constraints or negative examples tied to those phrases, the skill could activate in unintended contexts.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The default activation rule enters shortcut mode whenever a user pastes a text/opinion/plan without specifying a mode, which is overly broad and can cause unintended takeover of unrelated user content. In a multi-skill environment, ambiguous auto-activation can misroute benign text into an analysis workflow, leading to confusion, loss of user intent fidelity, or inappropriate transformation of sensitive content.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This markdown file is entirely written in Chinese and presents itself as a general-purpose reference guide, but it does not offer any language or locale choice for users. Under the language/locale policy rule, a skill or reference that implicitly requires a specific language without opt-in can be a natural-language policy violation unless the regional constraint is clearly justified.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire skill file is written in Chinese and does not offer any language choice, fallback, or opt-in for users who may expect another language. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: A language-only constraint in skill instructions can violate organizational language/locale policy when it forces a specific language without user opt-in. Here the title and the rest of the file indicate Chinese-only content, with no indication that users may choose another language or that the constraint is justified by a region-specific purpose.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The technical specs say "Language | Chinese-first content; works with English input and output," which establishes a language preference in natural language. This may conflict with language/locale policy expectations because it does not explicitly state that the user can choose their preferred language or that Chinese is only a default with opt-in.

Vague Triggers

Low

• Confidence: 83% confidence
• Finding: Phrases like “训练” and “教我看数据” are broad and could refer to many kinds of coaching unrelated to critical-thinking review. The file provides example phrases but lacks tighter scope boundaries or exclusion conditions for similar everyday requests.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The script unconditionally calls `applyLang('zh')`, making Chinese the default experience regardless of the user's browser language or explicit choice. Although an English toggle exists, the initial forced locale can still violate a language/locale policy that requires user choice or opt-in.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The title and all instructional content in this markdown file are written in Chinese, and there is no indication that the skill supports other languages or that Chinese is a justified, region-specific constraint. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Static analysis

No suspicious patterns detected.