multi-agent-team

• Outcome: Pass
• Latest audit: Aug 14, 2026 · 1:34 AM UTC
• Version: 1.0.0

Overview

This skill runs a local multi-agent-style decision helper and writes local reports/learning files, with no evidence of hidden exfiltration or destructive behavior.

Install only if you are comfortable with a Chinese-language local CLI skill that saves decision tasks, stances, consensus output, and optional learning/preferences data to JSON files. Avoid entering secrets or highly sensitive business data unless you control and review the output paths.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""交叉验证：每个 agent 产出过 reason-verify，返回可靠度。"""
    if RV and os.path.exists(RV):
        tmp = os.path.join(SELF_DIR, "rv_tmp.json")
        r = subprocess.run([sys.executable, RV, "reason", "--question", "任务立场核查",
                           "--answer", text, "--out", tmp],
                           capture_output=True, text=True, timeout=60)
        if r.returncode == 0 and os.path.exists(tmp):

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: 描述聚焦于多智能体协作、交叉验证、投票聚合和共识输出，这与 scripts/team.py 的主要行为基本一致。但代码还包含 scripts/learner.py，这是一个独立的通用自进化学习/遥测模块，会持久化操作记录、错误模式和用户偏好，并提供 insight/reflect 功能。这些行为并未在声明中提及，属于额外能力。虽然它们可被视为辅助模块，但其功能完整、可直接调用，且明显超出“多 agent 辩论/自一致性”本身，因此按标准应判定为描述与实际代码不完全匹配。

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The manifest describes a multi-agent collaboration capability that assigns roles, gathers multiple perspectives, performs verification, and aggregates a consensus. This file instead implements a reusable telemetry and self-improvement CLI that records usage, stores user preferences, and generates optimization suggestions for arbitrary skills, which is not an obvious or necessary part of multi-agent reasoning itself.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill description claims concrete multi-agent orchestration behaviors such as role assignment, task dispatch, cross-verification, weighted voting, and confidence-bearing consensus conclusions. In contrast, the implemented operations here only update a learned_patterns.json file, track preferences and errors, and print insights or reflection suggestions, which do not implement the described agent-team behavior.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: This is a markdown/manifest file, so vague trigger guidance applies. The phrase '当复杂决策需要多视角、且要抑制单点幻觉时使用' is broad and does not define clear invocation constraints, examples of when not to use the skill, or a narrower trigger scope, which could lead to unintended activation for many ordinary tasks.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Natural-language policy violations apply to all file types. The user-facing description and usage guidance are presented entirely in Chinese, and the file does not indicate that the skill is region-specific or provide an opt-in language/locale choice, which can amount to forcing a specific language.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The module docstring, CLI descriptions, and all user-facing messages are written entirely in Chinese, which imposes a specific language on users without any opt-in or alternative locale support. Under the policy, language constraints should either offer user choice or be explicitly justified as region-specific.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This code invokes an external verification script and passes the generated stance text, which includes the user-supplied task, via command-line arguments. Although the module docstring describes verification, there is no explicit user-facing warning, confirmation, or disclosure near the operation that user-provided content is being sent to another process.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The script serializes a report containing the user task, agent stances, and consensus output to a JSON file. While the final print shows the report path after completion, there is no prior warning or explanatory comment near the write operation disclosing that potentially sensitive task content will be persisted to disk.

Unvalidated Output Injection

High

• Category: Output Handling

Content

"""交叉验证：每个 agent 产出过 reason-verify，返回可靠度。"""
    if RV and os.path.exists(RV):
        tmp = os.path.join(SELF_DIR, "rv_tmp.json")
        r = subprocess.run([sys.executable, RV, "reason", "--question", "任务立场核查",
                           "--answer", text, "--out", tmp],
                           capture_output=True, text=True, timeout=60)
        if r.returncode == 0 and os.path.exists(tmp):

• Confidence: 95% confidence
• Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Static analysis

No suspicious patterns detected.