Security audit

reason-verify

Security checks for vulnerabilities and agentic risk

Overview

This skill is not destructive or credential-seeking, but it overstates its reasoning-verification capability and includes under-disclosed self-evolution metadata that users should review before installing.

Install only if you understand this as an incomplete synthesized verifier, not a dependable correctness checker. Prefer requiring explicit user invocation, use `scripts/verify.py` rather than the documented placeholder runner if you test it, and avoid enabling any self-evolving or global capability registration behavior without a separate review gate.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill advertises no explicit permissions, yet its documented usage invokes a Python script and the analyzer detected shell and file-write capabilities. That mismatch reduces transparency and weakens containment, because a caller may activate the skill believing it is documentation-only or low-risk while it can execute commands and modify files.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The declared purpose is narrow and safety-relevant—reasoning verification—but the analyzed behavior suggests unrelated capability registration, self-evolving metadata, and only a generic run path rather than the promised verification workflow. This kind of description-behavior mismatch is dangerous because it can conceal broader execution behavior behind a trusted-looking interface, leading users or orchestrators to grant access under false assumptions.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script introduces managed enrollment and self-evolution behavior that is not aligned with the declared purpose of the skill, which is reasoning verification. Hidden capability expansion is risky because it can cause the skill to modify how it is classified or propagated in a larger agent ecosystem without operator awareness. In this context, the mismatch between manifest purpose and code behavior makes the finding more dangerous, because a verification-oriented skill should not silently participate in capability growth workflows.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The code explicitly marks the skill as "self_evolving": true and sourced from lifelong synthesis, which is unrelated to verifying reasoning correctness. This creates a pathway for the skill to represent itself as an evolving synthesized capability, potentially influencing orchestration, trust, or inclusion decisions in downstream systems. Given the skill context, this is suspicious and more dangerous because the declared function provides no legitimate reason to self-register as a self-evolving capability.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill is advertised as performing reliable reasoning verification, contradiction detection, coverage assessment, and fact anchoring, but the implementation only truncates input text and reports a trivial non-empty check. This creates a dangerous integrity gap: downstream users or agents may trust the output as validated reasoning when no meaningful verification has occurred, enabling silent acceptance of incorrect or fabricated conclusions.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The self_verify function claims to perform contradiction and coverage detection, but in reality it only checks whether the text is non-empty. In a skill explicitly positioned as a verifier, this is security-relevant because it can falsely bless arbitrary content as reliable, undermining any system that uses this result for trust, validation, or decision-making.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The code comments and implementation indicate only generic processing, which conflicts with the stated purpose of reason verification. This mismatch is dangerous because operators may select the skill for assurance-sensitive tasks under the false belief that it performs specialized validation, leading to misplaced trust rather than direct code execution compromise.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The activation condition '出现与「通用处理」相关的任务' is overly broad, making the skill eligible for many generic tasks outside its specialized purpose. Overbroad triggers increase the chance of unintended invocation, which is especially risky when the skill may execute scripts or expose undeclared capabilities.

Static analysis

No suspicious patterns detected.