Meta Skill Weaver

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:21 AM UTC
• Version: 2.5.0

Overview

This skill does not show malware, but its broad automation authority, incomplete implementation, and local feedback/metrics storage need careful review before installation.

Install only after reviewing whether you actually need this broad orchestration skill. Restrict Write/Bash/Exec use, require explicit approval for shell commands and event-handler scripts, and avoid storing sensitive feedback or task error details unless local retention and access controls are acceptable. Treat the implementation as incomplete until the missing orchestrator entry points and version inconsistencies are fixed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The supplied code is unrelated to complex task orchestration. It is a small JavaScript utility for an lcov coverage report page: it selects DOM elements representing missing coverage, tracks a current selection, scrolls to items, highlights them, and binds keyboard shortcuts (n/j for next, b/k/p for previous). This is a materially different primary purpose from the declared orchestration framework. The actual code introduces an undeclared capability—browser keydown-based navigation of HTML coverage output—while none of the declared orchestration features appear in the snippet.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The supplied code is unrelated to workflow orchestration. It is a minified/packed JavaScript file for code prettification in coverage reports, exposing functions like prettyPrint/prettyPrintOne, registering syntax lexers/handlers, processing DOM elements (<pre>, <code>, <xmp>), and applying syntax-highlighting spans and line numbers. None of the declared orchestration capabilities appear in this chunk. The primary purpose is materially different from the declared description, so this is a clear mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is for a sophisticated orchestration framework, but the supplied code is a small browser-side script for an lcov coverage report page. It queries DOM elements, adds a search box, filters table rows, sorts coverage-summary columns, and binds click/load events. There is no evidence of workflow orchestration, event bus infrastructure, multi-skill execution, timeout management, recovery logic, metrics collection middleware, feedback handling, or tests. The primary purpose is materially different from the declared purpose, so this is a clear mismatch.

Known Vulnerable Dependency: brace-expansion==2.0.3 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)

High

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: brace-expansion 2.0.3 has multiple reported denial-of-service issues due to pathological expansion patterns causing excessive CPU or memory use. Although this instance is dev-only and likely exercised through glob/minimatch-style tooling, it can still disrupt CI or local automation if attacker-controlled patterns are processed.

Known Vulnerable Dependency: browserslist==4.28.2 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: browserslist 4.28.2 is flagged for crash/prototype-write and unbounded memory growth issues when given untrusted stats or many distinct queries. In this package-lock it is part of development tooling, so the main risk is CI/build instability or unsafe handling of attacker-supplied configuration rather than direct end-user compromise.

Known Vulnerable Dependency: js-yaml==3.14.2 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: js-yaml 3.14.2 has multiple CPU-exhaustion issues involving crafted YAML structures and merge behavior. Even though it appears only in dev tooling here, parsing attacker-controlled YAML in CI or local automation could lead to denial of service and stalled workflows.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation explicitly promotes collection of user ratings, comments, tags, rankings, and trend analysis, but provides no privacy notice, retention limits, consent expectations, or guidance on handling potentially sensitive user-generated content. In a workflow/orchestration skill that may be deployed across many tasks and users, this omission can lead to over-collection, unauthorized retention, and downstream privacy/compliance issues if operators implement the feature as described.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill documentation is written almost entirely in Chinese, including usage guidance and operational instructions, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking region. This can violate language/locale policy because it imposes a specific language experience without user opt-in.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The README says v0.4.1 newly adds EventBus, Jest tests, and a first-principles decomposer, while later sections say those same features were already present in v0.3.0, and the manifest context separately claims v2.3/v2.4 features such as MetricsMiddleware and FeedbackMiddleware that are not documented here at all. This is not mere incompleteness: the documentation presents contradictory statements about what version introduced key orchestration capabilities.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill markets itself for broadly defined 'complex multi-step tasks' without sufficiently constraining when it should or should not be invoked, despite exposing powerful tools like Write, Bash, and Exec. Over-broad activation guidance increases the chance an agent will route sensitive or unnecessary tasks through a capability-rich orchestrator, expanding attack surface and the risk of unintended command execution or file modification.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill declares powerful file-writing and command-execution tools but provides no prominent safety warning, approval gate, or usage constraints in the description. In an agent ecosystem, this omission can lead operators or upstream planners to invoke the skill without appreciating that it may write files or execute shell commands, raising the risk of destructive actions, data exfiltration, or local environment abuse.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

- Write
  - Bash
  - Exec
model: sonnet
---

# Meta Skill Weaver - 技能编织器

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The example `--handler="notify.sh"` normalizes external script execution from an event hook without any safety caveat, validation requirements, or sandboxing guidance. This pattern can encourage unsafe use where arbitrary scripts are triggered by events, enabling command injection, privilege misuse, or persistence if handlers are user-controlled or sourced from untrusted content.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list uses vague conditions like 'multi-step complex task' and 'needs 3+ skills collaboration' without explicit scope, priority, or disambiguation rules. In an orchestration skill, over-broad activation is risky because unintended invocation can cause the agent to route tasks through this meta-skill unnecessarily, expanding access to other skills and increasing the chance of unsafe autonomous coordination.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This JSON file includes multiple user-facing natural-language fields in Chinese, such as evidence, improvement, and action text. Because the file does not indicate that Chinese is optional or justified by a region-specific context, it appears to enforce a specific language without user opt-in.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code writes collected user feedback, including free-text comments and ratings, to a local JSON file. Although the file header describes storage behavior for developers, there is no user-facing warning, confirmation, or visible disclosure in code around the persistence of potentially sensitive user-provided content.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The file’s human-facing comments and generated suggestion messages are written in Chinese, indicating a fixed language choice embedded in the skill. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The middleware persists task execution metrics to a local JSON file automatically, including per-skill names, failure history, timestamps, and error message text, without any consent gate, disclosure, minimization, or retention control. In an orchestration skill, those fields can reveal sensitive workflow behavior or user-derived content from errors, so silent persistence creates a real privacy and data exposure risk, especially on shared hosts or developer machines.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The analysis messages attached to optimization suggestions are emitted as Chinese text literals, which enforces a specific language for downstream users or operators. The file does not provide localization, opt-in language selection, or documentation justifying a Chinese-only scope.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: The manifest description says v2.4 adds middleware and that v2.3 includes 54+ Jest tests for production stability, but later sections state v2.3 added 35 tests and list a total of 35 test cases with 62% coverage. This is an intent/documentation contradiction within the skill file rather than a mere omission.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: Most of the skill documentation is presented in Chinese, including headings, usage explanations, and FAQs, without indicating that the user can choose another language. This can constitute a language/locale policy issue when a skill imposes one language by default without opt-in or documented justification.

Intent-Code Divergence

Low

• Confidence: 98% confidence
• Finding: The manifest header declares version 2.4.0 at L005 and the document header repeats v2.4.0, but the footer says the file version is v2.3.0. This is a direct documentation inconsistency about what version the skill file represents.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The primary natural-language description of the middleware is written in Chinese, including the module summary and feature notes. Under the stated policy, forcing a specific language without user opt-in or documented regional justification is a locale-policy issue.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The document declares `lang="en"`, which is a natural-language locale choice embedded in the file. Under the policy rule, forcing a specific language without user opt-in or a documented justification can be a locale-policy violation.

Static analysis

No suspicious patterns detected.