Security audit

WenYan 文言引擎

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed classical-Chinese style mode with local validation scripts and low-impact persisted style settings.

Install this if you want a persistent classical-Chinese reply style. Be aware that casual phrases may enable or disable the mode, and the skill keeps a small local state file so the chosen style can continue across turns.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill explicitly instructs the agent to read and write a persistent `state.json` file every turn, but no permissions are declared to bound or document that behavior. Undeclared file I/O weakens the trust model and can lead to unexpected persistence, making it harder for the host platform or user to understand and control what the skill stores.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The README defines activation through broad natural-language phrases such as '用古风说话' and '换个古代风格' without documenting clear boundaries, precedence, or exclusion rules. In an agent skill, ambiguous triggers can cause unintended activation from ordinary conversation or quoted text, unexpectedly altering system behavior and potentially interfering with user intent or downstream instructions.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The README states that deactivation is 'not limited to keywords' and can occur through semantic interpretation like '够了' or '我听不懂', which makes exit conditions inherently fuzzy. Ambiguous deactivation logic can be exploited or accidentally triggered, causing the skill to turn off unexpectedly or fail to turn off reliably, reducing predictability and control of agent state.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The activation phrases are broad natural-language triggers such as '用古风说话' and '换个古代风格', with no strong scoping or confirmation step. This can cause unintended invocation during ordinary conversation or when discussing the feature hypothetically, after which the skill persists state and changes future responses automatically.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The skill defines deactivation through unrestricted semantic judgment and even instructs the model to '宁可误退也不强留', making state transitions unpredictable. While less severe than arbitrary code execution, this broad interpretation can be manipulated or triggered accidentally, causing unreliable behavior and weakening user control over persistent mode.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The generated prompt includes the directive 'You MUST reply in the following style. This is mandatory, not optional.', which forces downstream agents to always answer in a specific style rather than conditioning style changes on current user consent. In a style-conversion skill this may seem expected, but as written it can override user intent, interfere with safety/clarity, and cause persistent prompt behavior unless the caller adds separate gating logic.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill defines exit behavior using broad semantic matching and generic phrases like '够了', '算了', and '不好', which commonly occur in ordinary conversation unrelated to style control. This can cause unintended deactivation of the skill, making its state machine unreliable and allowing normal user utterances to change behavior unexpectedly.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation phrases include broad natural-language requests such as '用文言说话' and '换个古代风格', which can overlap with ordinary user content requests rather than intended mode switching. This ambiguity can trigger persistent style changes when the user may only want a one-off phrasing transformation, causing unintended behavior across subsequent responses.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: assets/agents.md:20