Machiavelli Skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:51 AM UTC
• Version: 1.8.3

Overview

This is a static Machiavelli persona and strategy skill with visible provocative advice and install caveats, but no hidden code, persistence, credential access, or exfiltration was found.

Install by manual copy or a pinned, trusted ClawHub CLI version. Treat the persona as a historical strategy lens, not a moral authority, and avoid using its harsher or manipulative passages for harassment, coercion, or real-world deception.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:31

Finding

Unpinned Third-Party Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md:31, README.md:44, README.md:99, README.md:112; related dependency declaration at package.json:20-21
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code snippets:

bash

# README.md:31
npx clawhub install machiavelli-skill --workdir ~ --dir .workbuddy/skills

bash

# README.md:44
npx clawhub install machiavelli-skill

The same unpinned commands are repeated in the English installation instructions at README.md:99 and README.md:112.

json

// package.json:20-21
"devDependencies": {
  "clawhub": "^0.18.0"
}

Technical Analysis

The documented installation procedure invokes clawhub through npx without specifying an exact, reviewed package version. If an appropriate local executable is unavailable, npx can retrieve package content from the configured npm registry and execute it with the current user's permissions.

The associated dependency uses the range ^0.18.0, which permits later compatible versions rather than restricting installation to one reviewed artifact. No lockfile or integrity-pinning mechanism is present in the audited project. Consequently, the code executed during installation can differ from the version reviewed when these instructions were written.

This network-based package execution is not required for the Skill's core functionality because the README also provides manual-copy installation methods. The unpinned execution path therefore creates avoidable supply-chain exposure.

Attack Path

1. An attacker compromises the clawhub package, its maintainer account, a permitted future release, or the package-delivery infrastructure.
2. A user follows one of the documented npx clawhub install ... commands.
3. npx resolves and retrieves a mutable package version from the configured registry when no trusted local version is available.
4. The retrieved ...[truncated 1245 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer the documented manual-copy installation method because this Skill consists of static content and does not require third-party executable installation logic.
2. If npx remains supported, pin the reviewed package explicitly:

   bash

   npx --yes clawhub@0.18.0 install machiavelli-skill --workdir ~ --dir .workbuddy/skills
   

3. Verify the selected package version and its transitive dependencies before recommending it. Update the pinned version only after review.
4. Add and commit a package lockfile generated with the intended package manager so dependency versions and integrity hashes are reproducible.
5. Replace the caret dependency with an exact version:

   json

   "devDependencies": {
     "clawhub": "0.18.0"
   }
   

6. Use a trusted registry and integrity or provenance verification where supported.
7. Document that installation commands must not be run with sudo, as an administrator, or from an account with unnecessary privileges.
8. Consider installing the verified CLI in an isolated environment first, then invoking the locally pinned executable rather than allowing npx to resolve mutable remote content at execution time.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (68)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

- `scenes/sinigaglia-1502.md` — 西尼加利亚：美丽的骗局 / Sinigaglia: the beautiful deception

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 952)May include surrounding context.

md

1. The first sentence should make clear what this letter/report is about. Don't make the reader guess.
2. Use concrete examples and numbers instead of abstractions. Saying "I cut two bundles of firewood" is stronger than "I had a busy day."
3. Put judgment after facts, not before. First say what happened, then say what you think.
4. End with a clear statement of what you want the reader to do.

---

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file explicitly instructs the agent to switch into sexist, coercive language when discussing women, including conquest framing and a quoted line normalizing domination. In an AI personality skill, this is dangerous because it can cause the model to generate derogatory or abusive content toward a protected class without user opt-in, increasing harassment, reputational, and policy-compliance risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to execute npx clawhub install machiavelli-skill without pinning a specific package version. Because npx resolves and runs the latest published package by default, a compromised upstream package, dependency, or malicious new release could execute arbitrary code on the user's machine during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This installation command again invokes npx clawhub without a fixed version, which means users may execute whatever package version is current at install time. If the package namespace or a later release is compromised, the README becomes a supply-chain execution vector for arbitrary code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The English installation section repeats the same unpinned npx clawhub pattern, exposing users to the same supply-chain risk. The danger is elevated by the fact that this is an installation instruction in documentation, so users are encouraged to run it directly in a shell with little scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This command also uses npx clawhub without version pinning, allowing execution of an unreviewed future package version at install time. In skill-distribution contexts, this is a common and realistic supply-chain weakness because users often trust copy-paste setup commands from README files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The file says that starting with "Machiavelli" or "马基雅维利" or /machia automatically selects dialogue mode, while the skill broadly mixes bilingual and East-oriented content elsewhere. Because the skill includes a distinct Eastern mode and substantial Chinese-language framing, defaulting based on language tokens can impose a locale/cultural mode selection without explicit user choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guidance says to use the skill broadly 'when deciding,' which is an expansive trigger that could cause the agent to invoke this skill in many loosely related situations. Over-broad activation can lead to unnecessary or inappropriate influence on decision-making, especially if the skill is applied outside its intended historical/strategic framing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation guidance is vague enough that the skill could trigger for ordinary feelings of being 'unrecognized' or for general self-reflection, rather than a clearly bounded task. Overly broad activation conditions can cause unintended routing and injection of persuasive or normative content into conversations where it is not appropriate, reducing predictability and user control.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The 'When to use' guidance says to use this skill 'when exploring a new field or researching a new problem,' which is a very common and expansive condition without clear boundaries or exclusions. It does not specify concrete triggers, scope limits, or negative examples, so the skill could be invoked in many routine conversations unintentionally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file presents all content in both English and Chinese, implying a fixed bilingual locale format rather than adapting to user preference. Under the policy rule, language behavior should be optional or clearly justified; no such opt-in or justification appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire skill content is written in Chinese, and there is no natural-language indication that the user can choose another language or that the locale restriction is intentional and justified. Under the policy, a skill that effectively enforces a specific language without opt-in is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file is entirely written in Chinese and provides no indication that language selection is optional or user-configurable. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is in scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire skill content is written in Chinese, and there is no indication that users may opt into another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill content is entirely in Chinese and does not indicate any locale constraint or offer an alternative language path. In a general-purpose agent skill, this can cause user exclusion, misinterpretation of instructions, or failed task completion for non-Chinese speakers, though it is not a direct code-execution or data-exfiltration issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains user-facing natural-language content only in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file presents all user-facing content in Chinese and does not indicate that the user can choose another language. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains user-facing natural-language skill content exclusively in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This file presents the skill entirely in specific languages, which can amount to a language/locale policy constraint when no opt-in or alternative is provided. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation text says the skill triggers after '读了鬼谷子之后' ('after reading Guiguzi'), but it does not define what counts as reading, how much content qualifies, or any exclusion conditions. This broad natural-language trigger could cause unintended invocation because it lacks clear scope, specificity, or negative examples.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger is explicitly designed to fire on very broad topics and even in unrelated conversations, which can cause the persona behavior to activate far outside its intended scope. This is not a code-execution or data-exfiltration issue, but it is a genuine safety/quality vulnerability because it increases the chance of unprompted derailment, reduced user control, and prompt-injection-style conversational hijacking by trivial keyword mention.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill content is entirely in Chinese and presents behavior/instructions without any indication that language selection is conditional on user preference. In an agent setting, this can override expected language alignment, reduce usability, and create confusion or exclusion for users who did not opt into Chinese output, though it does not by itself enable code execution or direct data compromise.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file content is entirely written in Chinese and presents behavior instructions without any indication of locale negotiation or user opt-in. While this is less severe than code-execution risks, forcing a language or locale can degrade user comprehension, cause misapplication of persona rules, and lead to unintended behavior when the broader system expects language alignment with the user.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition is defined very broadly around common moral or consensus-seeking phrases, so the impatience behavior can activate during ordinary, benign user dialogue. In a personality skill, that creates a reliability and safety problem because the agent may interrupt, sharpen tone, or dismiss normative discussion in many contexts where the user did not request adversarial or confrontational behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.