First Principle Analyzer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:20 AM UTC
• Version: 2.4.2

Overview

The skill appears to be a legitimate first-principles analysis helper, but it asks for unnecessary shell/process execution authority.

Review before installing. The skill does not show data theft, persistence, or destructive code, but it should not need Bash or Exec for first-principles analysis. Install only if you are comfortable granting those tools or can remove/limit them, and avoid entering confidential business, personal, financial, legal, or medical details unless sharing/export and model-provider handling are clear.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:11

Finding

Excessive Shell Execution Capabilities Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:11-16
Vulnerability Type: Excessive system permissions
Risk Level: Medium

yaml

tools:
  - Read
  - Write
  - Bash
  - Exec

Technical Analysis

The Skill declares unrestricted Bash and Exec capabilities even though its implemented purpose is limited to analyzing a supplied string and returning an in-memory object. The implementation in src/analyzer.js does not invoke shell commands or require operating-system command execution.

Granting shell capabilities expands the Skill's authority beyond its legitimate functional requirements and violates the principle of least privilege. If hostile content influences the Agent while this Skill is active, that content could induce the Agent to invoke these tools for operations unrelated to first-principles analysis.

Attack Path

1. The Skill is loaded with its declared Bash and Exec tools enabled.
2. The Agent processes attacker-controlled or otherwise untrusted contextual content.
3. The content instructs or manipulates the Agent into invoking a shell command.
4. Because command execution is available despite being unnecessary for the analysis task, the command runs within the privileges and sandbox boundaries of the hosting Agent.
5. The command may access local files, launch processes, alter writable resources, or communicate with network-accessible systems, depending on environmental restrictions.

Impact Assessment

Successful exploitation could provide command execution with the effective operating-system privileges assigned to the Agent runtime. The affected scope may include:

• Reading files accessible to the Agent process.
• Modifying or deleting writable files.
• Starting local processes.
• Accessing environment variables or runtime configuration.
• Reaching network resources available from the execution environment.

No evidence shows that the current implementation actively abuses these capabilities. The risk arises ...[truncated 85 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash and Exec from the declared tool list.
2. Grant no tools if the Skill only performs the current in-memory analysis.
3. Retain Write only if report export is implemented and required.
4. If file export is added, restrict writes to a dedicated output directory and reject path traversal or arbitrary absolute paths.
5. Add automated policy checks that reject unnecessary high-risk capabilities during packaging or publication.
6. Document the exact purpose and scope of every requested tool so future changes can be reviewed against least-privilege requirements.

A hardened declaration for the current implementation would be:

yaml

tools: []

If read-only reference material is later required, explicitly grant only Read.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a reasoning/analysis skill focused on first-principles problem solving. The supplied code does not implement any analytical framework, assumption analysis, truth extraction, or solution generation. Instead, it is a browser-side navigation helper for a code coverage HTML report, responding to key presses and moving between DOM elements representing low or missing coverage. This is a materially different primary purpose and includes undeclared capabilities related to DOM interaction and keyboard-driven UI navigation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an analytical reasoning skill for solving complex problems via first principles. The supplied code does nothing related to reasoning frameworks, assumption analysis, or solution generation. Instead, it is a client-side JavaScript prettifier similar to Google Code Prettify, used to scan PRE/CODE/XMP elements, lex source text, assign syntax classes, and render highlighted code with optional line numbers. This is a materially different primary purpose and includes undeclared capabilities centered on code formatting and DOM manipulation, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about a cognitive analysis/reasoning framework, but the supplied code is purely front-end UI logic for an lcov coverage report. It locates table elements in the DOM, injects a search box from a template, filters table rows based on user input, sorts rows by selected columns, and binds click/load event handlers. This is a materially different primary purpose from first-principles analysis and includes undeclared browser/DOM interaction and page-load-triggered behavior unrelated to the description.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.3 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

brace-expansion 2.0.3 has multiple denial-of-service advisories involving pathological expansion patterns that can trigger excessive CPU or memory consumption. Although present as a devDependency transitively, these issues are real and can impact CI or local tooling if globbing or brace patterns are influenced by untrusted input.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.2 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

browserslist 4.28.2 is flagged for crashes/prototype write and unbounded memory growth when handling untrusted stats or distinct query inputs. In this package-lock it is part of development tooling, reducing operational exposure, but it remains a valid vulnerability if CI/build processes ingest attacker-controlled browserslist configuration or stats data.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==3.14.2 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

js-yaml 3.14.2 has multiple CPU exhaustion issues related to merge keys and object map parsing, making it susceptible to denial of service on crafted YAML input. Even as a transitive devDependency, this is a true vulnerability because many tooling paths parse configuration files, and malicious YAML in CI or repository content could trigger resource exhaustion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document advertises多人协作/分享功能 but does not warn users that inviting collaborators may expose potentially sensitive problem statements, assumptions, business plans, or research data to other people. In a tool intended for strategic analysis and decision support, users are likely to input confidential information, so lack of an explicit sharing warning can lead to inadvertent disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The export feature supports Markdown/PDF/Word output without warning that exported reports may leave the protected environment, be stored unencrypted, synced to third-party services, or forwarded outside the original audience. Because this skill is designed for complex business, academic, and entrepreneurial analysis, exported reports may contain high-value confidential reasoning and strategic data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains user-facing instructions, examples, and invocation guidance exclusively in Chinese. Under the language/locale policy, forcing a single language without user opt-in or an explicit region-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation guidance uses very broad wording ('启动 first-principle-analyzer' / direct invocation on arbitrary problems) without defining scope, exclusions, or when not to invoke the skill. In an agent environment, ambiguous triggers can cause over-activation on sensitive or unsuitable tasks, increasing the chance of unintended handling of confidential, regulated, or high-stakes decision content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs users to save and share Markdown analysis results but provides no warning about sensitive data exposure, retention, or downstream distribution risks. Because the skill encourages users to provide background, constraints, and decision context, saved reports may contain confidential business, personal, or strategic information that could be leaked or overshared.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Declaring Bash and Exec for a skill whose documented role is conceptual reasoning creates unnecessary command-execution capability. If an agent can invoke shell or process execution without a clear functional need, prompt injection or misuse could turn a benign analysis workflow into arbitrary local command execution.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Specifying an external model/provider introduces an external processing dependency that may send user prompts or sensitive analysis content outside the local environment. In the context of a reasoning skill that encourages users to analyze business, career, or technical problems, this can have privacy and compliance implications if not transparently disclosed and governed.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

- Write
  - Bash
  - Exec
model: sonnet
---

# First Principle Analyzer - 第一性原理分析器

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file presents nearly all user-facing instructions, usage guidance, and FAQs in Chinese, which effectively imposes a specific language on users. The policy only allows this when the skill offers a language/locale choice or clearly documents a justified regional constraint, neither of which appears here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description limits the skill to structured first-principles analysis, assumption challenging, truth extraction, and solution generation. However, the file also documents exporting reports in multiple formats and sharing/collaboration features, which are product/workflow capabilities not reflected in the stated manifest purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation states that all analysis data is stored locally with encryption, yet elsewhere advertises sharing, team collaboration, and API features that imply data may leave the local environment. This inconsistency can mislead users about privacy guarantees and cause sensitive business or personal analysis data to be exposed under false assumptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file contains natural-language behavior that is effectively limited to Chinese: problem categorization relies on Chinese keywords, and all generated assumptions, truths, and solutions are returned in Chinese. Because the skill does not provide opt-in language selection or document a region-specific constraint, it violates the language/locale policy for natural-language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The metadata presents the skill name and description in Chinese without any indication of locale negotiation or user language preference. This can cause incorrect selection or poor user comprehension in multilingual environments, leading to misuse, confusion, or silent failure when the orchestrator assumes the skill matches the user's language context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are overly broad and map to common, everyday reasoning tasks, which can cause the skill to activate far outside its intended niche. In an agent ecosystem, ambiguous activation increases the chance of misrouting user requests, unnecessary invocation of this skill, and interference with more appropriate or safer skills handling decision-making contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This JavaScript file embeds Chinese-only keywords, assumptions, truths, and solution text across the analyzer's categorization and generated output. That effectively forces a specific language/locale on users without opt-in, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The 'when to use this skill' guidance is overly broad ('complex problems,' 'major decisions,' 'innovation needs') and lacks operational boundaries. This can lead users or orchestration systems to apply the skill in contexts where structured ideation is inappropriate or risky, especially for high-impact decisions requiring domain-specific safety controls.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

Write access is broader than strictly necessary for a reasoning-only skill and can enable unintended file creation or modification if the skill is steered by hostile input. While lower risk than shell execution, unnecessary write capability still expands the attack surface and the consequences of prompt injection.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @babel/core==7.29.0 — 1 advisory(ies): CVE-2026-49356 (@babel/core: Arbitrary File Read via sourceMappingURL Comment)

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

@babel/core 7.29.0 is flagged for an arbitrary file read issue via sourceMappingURL handling. In this lockfile it is only a transitive devDependency through Jest/Babel tooling, so exploitability is limited to build/test workflows that process attacker-controlled JavaScript or sourcemaps, but it is still a real supply-chain exposure.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: baseline-browser-mapping==2.10.16 — 1 advisory(ies): CVE-2026-45819 (baseline-browser-mapping process termination on invalid input causes denial of s)

Low

• Category: Supply Chain
• Confidence: 74% confidence

Finding

baseline-browser-mapping 2.10.16 is reported as vulnerable to process termination on invalid input, which can cause denial of service. Here it appears as a transitive devDependency of browserslist, so the risk is mostly confined to developer tooling and CI tasks rather than runtime skill behavior.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The development dependency uses a caret range, which permits automatic installation of newer minor/patch versions rather than a single fixed version. While this is only a devDependency and does not directly affect runtime behavior of the skill, it can still expose the build or test environment to supply-chain risk if a compromised or breaking upstream release is pulled.

Content

Scanner excerpt · package.json (reported line 31)May include surrounding context.

json

]
  },
  "devDependencies": {
    "jest": "^30.3.0"
  }
}

Static analysis

No suspicious patterns detected.