AI偷懒检查

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:20 AM UTC
• Version: 1.0.0

Overview

This skill intentionally creates persistent self-audit hooks inside other skills, but its triggers and removal logic are too broad for that level of control.

Review carefully before installing. Use this only if you intentionally want one skill to modify other skills' instruction files, and inspect the generated diff before replacing any original SKILL.md. Avoid using the rollback flow on valuable skills unless you have a backup, because the documented deletion boundary can remove valid content after the detected hook marker.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:168
• Finding: Persistent Instruction Injection into Other Agent Skills<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:168-183`, `skill-audit-hook.txt:1-10`, and `hook.md:6-49` **Vulnerability Type**: Persistent modification of agent instructions **Risk Level**: Critical ### Vulnerable Code `SKILL.md:168-183`: ```python ### 3b · 注入钩子 未找到钩子，执行注入（内容必须来自 Step 2 读取的 skill-audit-hook.txt）： ```bash cp <原始路径> /home/claude/<n>-SKILL.md ``` ```python # Python 追加写入，确保内容完整无截断 with open('skill-audit-hook.txt', 'r') as f: hook = f.read() with open('/home/claude/<n>-SKILL.md', 'a') as f: f.write('\n\n') f.write(hook) print("钩子注入完成") ``` ``` `skill-audit-hook.txt:1-10`: ```text ## ⚙️ 自审计钩子（强制执行，不得跳过） 主任务所有输出完成后，必须立即执行以下操作，这是本 SKILL 的最后一个强制步骤： 1. 读取文件：./skills/autohook/hook.md 2. 严格按其中每一步执行自审计，不得简化、合并或跳过任何步骤 3. 将审计结果写入 debug_[SKILL名称].txt 4. 在对话中输出 ❌ / ⏭️ 摘要 **未执行自审计即视为任务未完成。** ``` `hook.md:6-49`: ```text ## ⚙️ 自审计钩子（任务完成后必须执行） **所有主任务输出完成后，立即执行以下审计流程，不得跳过。** ### Step 1 · 提取规则 重新通读本 SKILL.md，提取所有含以下语义的条目，编号 R01、R02…： - 强制要求（必须 / must / required） - 明确禁止（禁止 / 不得 / NEVER） - 数值约束（≤ / ≥ / 具体数字+单位） - 步骤顺序（Step N / 先…再…） - 格式要求（输出为 / 文件类型） ### Step 2 · 逐条对照我的输出判断 对每条规则，依次回答： 1. 这条规则要求什么具体行为？ 2. 我的输出里对应行为是什么？（引用具体位置） 3. 是否满足？判定为以下之一： - ✅ 已遵守 ❌ 未遵守 ⚠️ 部分遵守 ⏭️ 被跳过 ❓ 需人工验证 ### Step 3 · 写入 debug_[SKILL名称].txt ``` ════════════════════════════════════════════════════ SKILL 自审计报告 | <SKILL名称> | <当前时间> 任务：<一句话描述刚完成的任务> ════════════════════════════════════════════════════ [摘要] 总 N 条｜✅ N ❌ N ⚠️ N ⏭️ N ❓ N ──────────────────────────────────────────────────── R01 [类型] ✅/❌/⚠️/⏭️/❓ 规则：<SKILL原文> 行为：<我实际做了什么，或没做什么> 原因：<为什么满足 / 为什么没做到，用自己的话解释，禁止写"未找到关键词"> （所有规则逐条输出） ──────────────────────────────────────────────────── [结论] PASS ✅ / WARN ⚠️ / FAIL ❌ <一句话总结，并列出需修复的条目> ════════════════════════════════════════════════════ ``` ### Step 4 · 对话摘要 在对话中只输出 ❌ 和 ⏭️ 的条目 + 原因，询问用户是否需要修复。 ``` ### Technical Analysis The skill intentionally appends attacker-controlled instruction text to another skill's `SKILL.md`. Becau ...[truncated 2105 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not append executable instructions to another skill's `SKILL.md`. 2. Implement auditing as a separately invoked, non-persistent command or tool whose output cannot alter the target skill's instruction hierarchy. 3. Require explicit, informed consent identifying the exact target file and proposed changes before producing a modified artifact. 4. Present the proposed patch for review and require separate confirmation before installation. 5. Treat hook content as data rather than authoritative agent instructions. 6. Restrict audit output to a user-selected path and avoid mandatory filesystem writes. 7. Preserve the original target file and provide a verified rollback artifact. 8. If extension metadata is required, use a structured, non-executable configuration format with a strict schema and an allowlist of supported actions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:260
• Finding: Destructive Hook Removal Can Truncate Legitimate Skill Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:260-285` **Vulnerability Type**: Unsafe file modification and overly broad deletion boundary **Risk Level**: High ### Vulnerable Code ```python python3 << 'PYEOF' with open('/home/claude/<n>-SKILL.md', 'r') as f: lines = f.readlines() # 找到钩子起始位置（向上包含最近一个 --- 分隔线） hook_start = None for i, line in enumerate(lines): if '强制自审计' in line or '自审计钩子' in line: # 向上找最近的 --- 分隔线 for j in range(i-1, max(i-5, 0)-1, -1): if lines[j].strip() == '---': hook_start = j break if hook_start is None: hook_start = i break if hook_start is not None: # 删除从 hook_start 到文件末尾，并去除末尾多余空行 cleaned = lines[:hook_start] while cleaned and cleaned[-1].strip() == '': cleaned.pop() cleaned.append('\n') # 保留一个末尾换行 with open('/home/claude/<n>-SKILL.md', 'w') as f: f.writelines(cleaned) print(f"已删除第 {hook_start+1} 行起的钩子段落") else: print("未找到钩子，无操作") PYEOF ``` ### Technical Analysis The removal routine identifies a hook by searching for the first line containing either of two generic phrases. These phrases are not unique identifiers and can legitimately appear in documentation, examples, or an independently implemented audit section. After the first match, the routine optionally moves the deletion boundary to a nearby Markdown separator and then retains only `lines[:hook_start]`. It does not search for an end marker, compare the candidate block against the known hook payload, verify a cryptographic hash, or ensure that the detected block is at the end of the file. Consequently, every line from the selected boundary through the end of the target skill is discarded. Although the documented workflow modifies a copied replacement file, installing that replacement can destroy legitimate instructions from the effective skill. ### Attack Path 1. A target `SKILL.md` contains either matching phrase i ...[truncated 1251 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enclose injected content in unique, versioned start and end markers containing a random or project-specific identifier. 2. Remove only content located between an exact matching marker pair; never delete from a detected heading through end of file. 3. Record and verify a cryptographic hash of the injected payload before removal. 4. Require the candidate block to exactly match a payload version shipped by the project. 5. Abort removal if the end marker is absent, multiple candidate blocks exist, or content appears after an expected terminal hook. 6. Generate and retain a byte-for-byte backup before modification. 7. Show a unified diff and require explicit confirmation before delivering or installing the cleaned artifact. 8. Perform an atomic write to a new file and verify that all unrelated content remains unchanged before replacing any target. 9. Add tests covering generic phrase collisions, legitimate trailing content, malformed markers, repeated hooks, and partially modified payloads. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The description promises restoration of the original file, but the documented removal logic deletes everything from the detected hook start to end-of-file. If any legitimate content was added after the hook or if the hook boundary is misidentified, the skill can irreversibly destroy valid file content while claiming a safe rollback.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The rollback trigger phrases include very broad everyday language such as '不用检查了' and '关掉审计', which can be mentioned in ordinary discussion and accidentally activate destructive file modification behavior. Because the skill edits or removes content from SKILL files, false activation can lead to unauthorized or unintended changes.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

优先级：项目级 > 用户全局 > 系统 > 内置（`$skill-creator`、`$skill-installer`）。

禁用而不删除，在 `~/.codex/config.toml` 中：
```toml
[[skills.config]]
path = "/path/to/skill/SKILL.md"

• Confidence: 90% confidence
• Finding: The skill documents direct interaction with an agent configuration file under `~/.codex/config.toml`, which is a sensitive control-plane location. Guidance that modifies or disables skills via config increases the blast radius from single-file hook management to broader agent behavior manipulation if followed or automated.

Ae1

High

• Category: analysis-evasion

Content

find /mnt/skills -name "SKILL.md" | sed 's|/SKILL.md||' | xargs -I{} basename {}

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: 文件中的自然语言描述、触发词和交付文案全部固定为中文，且未说明可根据用户偏好切换语言，也没有给出语言选择机制。按规则，这种未征得用户同意即强制特定语言/locale 的设计属于语言策略风险。

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The injection trigger list is broad and context-light, so common phrases about checking whether a skill is规范 or where it is located may invoke file-reading or modification behavior without clear operator intent. In a multi-skill environment, this increases the chance of unplanned activation and unauthorized edits.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill includes broad path discovery, platform-specific configuration details, registry references, and installation guidance extending well beyond the narrow task of auditing or injecting a hook into a specified skill. This widens the operational scope, increases exposure to unnecessary filesystem reconnaissance, and makes it easier to enumerate or tamper with other agent assets than required.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

优先级：项目级 > 个人全局 > 插件 > 内置捆绑。

> ⚠️ **Windows WSL 已知问题**：Claude Code 可能将 skill 写入 Windows 挂载的项目路径而非 Linux 用户路径。
> 修复：`mkdir -p ~/.claude/skills && cp -r .claude/skills/* ~/.claude/skills/`

### A2 · OpenAI Codex CLI

• Confidence: 85% confidence
• Finding: The skill contains guidance to create and copy skill directories, and elsewhere instructs listing available skills when a target is not found. In aggregate, this supports skill discovery and enumeration beyond the minimum needed for the requested operation, exposing inventory and layout information that could aid follow-on tampering.

Session Persistence

Medium

• Category: Rogue Agent

Content

优先级：项目级 > 个人全局 > 插件 > 内置捆绑。

> ⚠️ **Windows WSL 已知问题**：Claude Code 可能将 skill 写入 Windows 挂载的项目路径而非 Linux 用户路径。
> 修复：`mkdir -p ~/.claude/skills && cp -r .claude/skills/* ~/.claude/skills/`

### A2 · OpenAI Codex CLI

• Confidence: 80% confidence
• Finding: The WSL 'fix' command copies project skill content into the persistent global `~/.claude/skills` directory, potentially making temporary or unreviewed skills persist across sessions and contexts. This can unintentionally widen trust and cause modified skills to continue affecting future agent runs.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the agent to write a `debug_[SKILL名称].txt` file, which modifies the user's workspace, but it provides no warning, consent check, or path restrictions. In an agent setting, silent file creation can overwrite existing files, leak task details into persistent storage, or create unexpected artifacts the user did not approve.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The instructions are written entirely in Chinese and require a specific dialogue output format, but there is no opt-in, language selection, or documented reason for enforcing that locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The hook is framed as a mandatory final step with '不得跳过' semantics, but the surrounding skill metadata also says it should trigger immediately on broad phrases like '审计 XX skill' or 'XX skill 有没有 hook'. That combination creates ambiguous and overly broad execution scope, increasing the chance the agent runs the hook in contexts the user did not clearly authorize, including unrelated tasks or simple discovery requests.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The file mandates writing audit output to a local file (debug_[SKILL名称].txt) but provides no user-facing notice, consent step, or path constraint. This can cause silent local state changes, overwrite existing files, leak sensitive audit content into the workspace, or violate user expectations for a read-only review operation.

Static analysis

No suspicious patterns detected.