Evolving Agent

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:55 PM UTC
• Version: 0.1.0

Overview

The skill has a coherent coding-memory purpose, but it also enables persistent automatic knowledge capture, skill-file rewriting, broad triggers, arbitrary URL fetching, and privilege/path handling that need careful review.

Review this skill before installing. It is not just a coding helper: it can store session-derived knowledge for future use, create and modify local skill files, fetch remote repository content, and keep an evolution mode active across later work. Install only if you are comfortable with persistent project knowledge, and avoid using it on sensitive repositories or untrusted GitHub URLs until its confirmation, URL validation, path containment, and skill-rewrite behavior are tightened.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/core/smart_stitch.py:120
• Finding: Persistent Cross-Skill Instruction and Memory Poisoning<![CDATA[ ## Vulnerability Details **File Location**: `scripts/core/smart_stitch.py:120-211` **Related Location**: `scripts/core/align_all.py:13-23` **Vulnerability Type**: Persistent insertion of untrusted instructions into Agent memory and Skill text **Risk Level**: Critical ### Vulnerable Code ```python # scripts/core/smart_stitch.py for context, instruction in data.get('context_triggers', {}).items(): context_lower = context.lower().replace(' ', '_') context_file = experience_dir / 'contexts' / f'{context_lower}.json' if context_file.exists(): with open(context_file, 'r', encoding='utf-8') as f: ctx_data = json.load(f) else: ctx_data = {'name': context, 'instructions': []} if instruction not in ctx_data['instructions']: ctx_data['instructions'].append(instruction) index['index']['total_experiences'] += 1 with open(context_file, 'w', encoding='utf-8') as f: json.dump(ctx_data, f, indent=2, ensure_ascii=False) ``` ```python if data.get("context_triggers"): evolution_section.append("\n### Context Triggers") for trigger, instruction in data["context_triggers"].items(): evolution_section.append(f"\n- **{trigger}**: {instruction}") if data.get("custom_prompts"): evolution_section.append("\n### Custom Instruction Injection") evolution_section.append(f"\n{data['custom_prompts']}") evolution_block = "\n".join(evolution_section) content = skill_md_path.read_text(encoding='utf-8') pattern = r"(\n+## User-Learned Best Practices & Constraints.*$)" match = re.search(pattern, content, re.DOTALL) if match: new_content = content[:match.start()] + evolution_block else: new_content = content + evolution_block skill_md_path.write_text(new_content, encoding='utf-8') ``` ```python # scripts/core/align_all.py for item in os.listdir(skills_root): skill_dir = os.path.join(skills_root, item) if not os.path.isdir(skill_dir): continue evoluti ...[truncated 2086 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove support for writing free-form `custom_prompts` or executable instructions into `SKILL.md`. 2. Store learned information only in a strict, non-executable data schema. 3. Permit only narrowly defined data fields such as technology names, version numbers, error signatures, and reviewed remediation notes. 4. Reject content containing instruction-like directives, role changes, tool requests, policy overrides, or encoded payloads. 5. Require explicit per-Skill user approval before changing an installed Skill. 6. Display an exact diff and require confirmation before applying it. 7. Remove or strongly restrict `align_all.py`; do not bulk-rewrite all Skills based solely on the presence of `evolution.json`. 8. Record the provenance, author, timestamp, and integrity hash of every learned entry. 9. Keep remote, generated, and user-provided content clearly marked as untrusted data and never concatenate it into Agent instruction files. 10. Add tests proving that prompt-like content cannot enter `SKILL.md` or persistent instruction stores. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: scripts/core/toggle_mode.py:170
• Finding: Persistent Evolution Mode Injects Behavioral Instructions Without Per-Task Consent<![CDATA[ ## Vulnerability Details **File Location**: `scripts/core/toggle_mode.py:170-186` **Vulnerability Type**: Persistent behavioral prompt injection and automatic knowledge retention **Risk Level**: High ### Vulnerable Code ```python def get_context_prompt() -> str: """ Get the context prompt that should be injected into the AI's context. """ if not is_mode_active(): return "" return """ ## Evolution Mode Active This session is in EVOLUTION MODE. - After completing tasks, automatically check for extractable knowledge - Run trigger detection even without explicit user commands - Store valuable experiences to the knowledge base - Only report to user when new knowledge is extracted """.strip() ``` The injected prompt is activated through a persistent project marker: ```python def get_mode_marker_path() -> Path: root = get_workspace_root() return root / '.opencode' / '.evolution_mode_active' ``` ### Technical Analysis The subsystem is explicitly designed to inject a reinforcement prompt into Agent context. The prompt instructs the Agent to perform trigger detection and store experiences without an explicit command for each task. Activation is represented by a marker under `.opencode`, so the behavior can remain active across later operations in the same project. This changes the Agent's future behavior and data-retention policy beyond the immediate command that created the marker. The prompt also says to report only when new knowledge is extracted. That reduces transparency when automatic checks occur but produce no stored entry. ### Attack Path 1. Evolution mode is enabled through `--init`, `--on`, or `--toggle`. 2. The `.opencode/.evolution_mode_active` marker persists in the project. 3. A later process calls the context-injection functionality or follows the documented evolution workflow. 4. The Agent receives instructions to analyze and store experiences even when the current user did not request retention. ...[truncated 622 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove context prompt injection from the mode-control script. 2. Require informed, task-specific opt-in before extracting or storing any experience. 3. Clearly preview the exact information that will be retained. 4. Require separate confirmation before writing to persistent storage. 5. Make evolution state session-scoped by default rather than persistent. 6. Add an expiration time and an obvious status indicator for any retained mode. 7. Provide commands to inspect, edit, and delete all stored information. 8. Never suppress reporting of automatic analysis or storage behavior. 9. Apply data minimization and redact credentials, source code, personal data, paths, and environment details before storage. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: scripts/github/create_github_skill.py:22
• Finding: Untrusted Remote README Content Is Embedded into a Loadable Skill<![CDATA[ ## Vulnerability Details **File Location**: `scripts/github/create_github_skill.py:22-55` **Vulnerability Type**: Remote-content prompt injection into generated Skill instructions **Risk Level**: Critical ### Vulnerable Code ```python skill_md_content = f"""--- name: {safe_name} description: Skill wrapper for {repo_info['name']}. Generated from {repo_info['url']}. github_url: {repo_info['url']} github_hash: {repo_info['latest_hash']} version: 0.1.0 created_at: {datetime.datetime.now().isoformat()} entry_point: scripts/wrapper.py --- # {repo_info['name']} Skill This skill wraps the capabilities of [{repo_info['name']}]({repo_info['url']}). ## Overview (Auto-generated context from README) {repo_info['readme'][:500]}... ## Usage This skill provides a Python wrapper to interface with the tool. """ with open(os.path.join(skill_path, "SKILL.md"), "w", encoding="utf-8") as f: f.write(skill_md_content) ``` ### Technical Analysis Repository README text is externally controlled. The generator copies the first 500 characters directly into `SKILL.md`, which is an Agent instruction document rather than a passive data file. Character truncation does not provide sanitization. An attacker can place a complete prompt-injection payload at the beginning of a README. The resulting content is not escaped, labeled with enforceable trust metadata, or isolated from instructions. Repository metadata fields such as the repository name and URL are also interpolated into the generated Skill document without instruction-level trust separation. ### Attack Path 1. An attacker publishes or compromises a repository. 2. The attacker places Agent directives within the first 500 characters of its README. 3. A user obtains the repository metadata and invokes `create_github_skill.py`. 4. The generator writes the remote text into the generated `SKILL.md`. 5. The generated Skill is installed or placed in a Skills directory. 6. When an Agent loads the Skill, the malicious ...[truncated 610 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never copy remote README content into `SKILL.md`. 2. Store remote documentation in a separate reference file that is explicitly treated as untrusted data. 3. If a summary is needed, generate it through a constrained schema and require human review before installation. 4. Escape markup and reject instruction-like language, role directives, tool commands, and policy-override phrases. 5. Show users the complete generated Skill diff before writing or installing it. 6. Pin the repository source and commit hash and verify them before generation. 7. Add a visible trust boundary stating that repository content must not be followed as Agent instructions. 8. Keep generated Skills disabled until reviewed and explicitly enabled. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/github/fetch_info.py:52
• Finding: Arbitrary URL and Git Transport Access Enables SSRF and Local Resource Probing<![CDATA[ ## Vulnerability Details **File Location**: `scripts/github/fetch_info.py:52-106` **Vulnerability Type**: Missing host, scheme, redirect, and network-destination validation **Risk Level**: High ### Vulnerable Code ```python clean_url = url.rstrip('/') if clean_url.endswith('.git'): clean_url = clean_url[:-4] repo_name = clean_url.split('/')[-1] try: result = subprocess.run( ['git', 'ls-remote', url, 'HEAD'], capture_output=True, text=True, check=True, timeout=30 ) latest_hash = result.stdout.split()[0] ``` ```python readme_content = "" readme_url_base = clean_url.replace("github.com", "raw.githubusercontent.com") for branch in ["main", "master"]: try: readme_url = f"{readme_url_base}/{branch}/README.md" with urllib.request.urlopen(readme_url) as response: readme_content = response.read().decode('utf-8') break except Exception: continue if not readme_content: for branch in ["main", "master"]: try: readme_url = f"{readme_url_base}/{branch}/readme.md" with urllib.request.urlopen(readme_url) as response: readme_content = response.read().decode('utf-8') break except Exception: continue ``` ### Technical Analysis The command is documented as a GitHub repository fetcher, but it does not verify that the supplied URL is an HTTPS GitHub URL. The value is passed directly to `git ls-remote`, which supports multiple transports, and is also transformed into a README URL through an unrestricted string replacement. For non-GitHub URLs, the replacement does nothing, and `urllib.request.urlopen` accesses the resulting target directly. There is no protection against: - Localhost or loopback destinations - Private network ranges - Link-local and cloud metadata addresses - Non-HTTP schemes supported by the underlying libraries - URLs containing credentials - Redi ...[truncated 1310 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse URLs with `urllib.parse.urlparse`; do not validate through string replacement. 2. Allow only `https://github.com/<owner>/<repository>` input. 3. Reject embedded credentials, fragments, unexpected query parameters, nonstandard ports, and malformed owner or repository names. 4. Construct raw README URLs independently using validated owner and repository components. 5. Allow only `raw.githubusercontent.com` for README retrieval. 6. Disable redirects or validate every redirect destination against the same allowlist. 7. Resolve destination addresses and reject loopback, private, link-local, multicast, reserved, and unspecified IP ranges. 8. Revalidate after every DNS resolution and redirect to reduce DNS-rebinding risk. 9. Set explicit connection and read timeouts and enforce a strict response-size limit. 10. Restrict Git to HTTPS GitHub transport and disable external Git protocol helpers where possible. 11. Run network retrieval in a sandbox without access to internal networks or cloud metadata endpoints. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/github/store_to_knowledge.py:189
• Finding: Knowledge Entry Name Allows Path Traversal and Arbitrary JSON File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `scripts/github/store_to_knowledge.py:189-195` **Input Location**: `scripts/github/store_to_knowledge.py:318-321` **Vulnerability Type**: Path traversal through an insufficiently sanitized filename **Risk Level**: High ### Vulnerable Code ```python category_dir.mkdir(parents=True, exist_ok=True) # Save entry file entry_filename = f"{name.lower().replace(' ', '-')}.json" entry_path = category_dir / entry_filename with open(entry_path, 'w', encoding='utf-8') as f: json.dump(entry, f, ensure_ascii=False, indent=2) ``` The value can originate from caller-controlled JSON: ```python if args.input: with open(args.input, 'r', encoding='utf-8') as f: data = json.load(f) else: data = json.load(sys.stdin) ``` ### Technical Analysis Replacing spaces does not remove `/`, `\`, `..`, absolute-path syntax, or platform-specific path separators. `pathlib` then combines the attacker-controlled filename with `category_dir` without resolving the result or checking that it remains beneath the intended directory. For example, a name containing `../../../target` produces a path ending in `../../../target.json`. The final `open(..., 'w')` creates or truncates that file with the process user's permissions. Although automatically extracted framework names are selected from a fixed internal list, the storage CLI also accepts JSON from a file or stdin, making direct exploitation possible. ### Attack Path 1. An attacker supplies storage JSON through `--input` or stdin. 2. The JSON includes a crafted `name`, such as `../../../some/writable/target`. 3. `replace(' ', '-')` leaves the traversal components intact. 4. `category_dir / entry_filename` resolves outside the intended knowledge directory at filesystem access time. 5. `open(..., 'w')` creates or overwrites the selected `.json` file. 6. If the selected file is later consumed as configuration, memory, or instructions, the overwrite can be chained into ...[truncated 456 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not derive storage paths directly from user-controlled names. 2. Generate filenames from internal UUIDs or cryptographic identifiers. 3. If readable slugs are required, allow only a strict character set such as lowercase ASCII letters, digits, and single hyphens. 4. Reject names containing `/`, `\`, `..`, drive prefixes, null bytes, control characters, or absolute-path syntax. 5. Resolve both paths before writing and enforce containment: ```python base = category_dir.resolve() target = (base / safe_filename).resolve() if not target.is_relative_to(base): raise ValueError("Entry path escapes the knowledge directory") ``` 6. Open new files with exclusive creation where overwriting is not intended. 7. Use atomic writes through a safely created temporary file inside the same directory. 8. Apply the same centralized path-validation routine to every knowledge and experience writer. 9. Add traversal tests covering POSIX paths, Windows paths, mixed separators, encoded separators, and absolute paths. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/core/toggle_mode.py:65
• Finding: Project-Local Mode Marker Unnecessarily Falls Back to Sudo<![CDATA[ ## Vulnerability Details **File Location**: `scripts/core/toggle_mode.py:65-86` **Related Location**: `scripts/core/toggle_mode.py:120-130,157-159` **Vulnerability Type**: Unnecessary administrative privilege request for project-local state **Risk Level**: Medium ### Vulnerable Code ```python def run_with_sudo(command: list[str]) -> tuple[bool, str]: """ Run a command with sudo after user confirmation. """ try: print(f"需要管理员权限来写入文件") response = input("是否使用 sudo 继续? [y/N]: ").strip().lower() if response not in ('y', 'yes'): return False, "用户取消操作" result = subprocess.run( ['sudo'] + command, capture_output=True, text=True ) ``` The privileged helper is used for project-local marker creation and deletion: ```python if not parent_dir.exists(): success, msg = run_with_sudo(['mkdir', '-p', str(parent_dir)]) success, msg = run_with_sudo(['touch', str(marker_path)]) ``` ```python success, msg = run_with_sudo(['rm', '-f', str(marker_path)]) ``` ### Technical Analysis Evolution mode is represented by a marker under the current working directory. Such state should only be created in a user-writable project. If the project is not writable, the safe response is to stop and report the permission problem. Instead, the script offers to run `mkdir`, `touch`, or `rm` through `sudo`. The path is derived from the current working directory, so the operation can create root-owned project state or delete the exact marker at a privileged location. The commands use argument arrays and fixed executable names, so shell metacharacter injection was not found. User confirmation also reduces exploitability. However, the privilege request is unnecessary for the declared functionality and violates least privilege. ### Attack Path 1. The script is run from a directory where the user cannot create or remove `.opencode/.evolution_mode_active`. 2. Normal filesystem ...[truncated 822 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `run_with_sudo` and every sudo fallback. 2. If the workspace is not writable, stop with a clear error. 3. Store state only in a user-owned project directory or a user-specific application-state directory. 4. Verify that the resolved workspace is an expected project root before creating a marker. 5. Refuse to operate through symlinked marker paths or unexpected filesystem objects. 6. Create files with restrictive permissions and avoid producing root-owned project artifacts. 7. Document that mode management never requires administrator access. 8. Add tests confirming that permission failures do not trigger or recommend privilege escalation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (79)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 该描述将技能表述为通用“AI 编程系统协调器”，覆盖开发、实现、修复、优化、review、分析、学习等多种编程辅助场景；但实际代码只是一个本地运维/批处理工具，用于扫描技能目录并对符合条件的子目录执行 smart_stitch.py。它不包含任何面向编程任务的分析、生成、修复或评审逻辑，主要能力是目录遍历、检测 evolution.json 是否存在，以及通过 subprocess 启动另一个脚本。虽然“协调器”一词勉强能与批量调度外部脚本沾边，但整体声明的核心用途和触发范围明显宽于且不同于实际行为，因此构成实质性不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: 声明描述的是一个广义的 AI 编程系统协调器，强调开发、修复、review、分析、学习等编程辅助/协调场景；但提供的代码并不实现这些能力。它只执行一个非常具体的任务：解析输入 JSON，合并到 skill_dir 下的 evolution.json，处理若干字段的去重与覆盖，并保存结果。该代码的主要目的属于“技能演化元数据持久化维护脚本”，而不是声明中的通用编程协调器。虽然这可能是整个系统中的一个支撑组件，但就这段代码本身而言，其实际行为与声明的主要功能存在明显偏差，且包含未声明的本地文件修改能力。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 该描述与代码主功能存在明显不一致。声明描述的是一个面向编程任务的系统协调器，应该体现任务分派、代码生成/修改、评审、经验保存或分析等行为；但提供的代码仅实现跨平台路径解析和命令拼接，属于底层基础设施组件。虽然这类工具可能用于支持编程系统，但它本身并不执行所声明的核心协调功能。代码还会访问环境变量、检查本地目录、创建知识库目录，这些都更接近路径/资源管理，而非声明中的编程协调器。因此应判定为描述与实际行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description suggests a broad orchestration skill for AI programming assistance, activated by development-related keywords. The supplied code does not implement a programming coordinator or trigger handling. Instead, it is a specific maintenance script for migrating/stitching skill evolution data into markdown and JSON files within a skill directory. Its primary purpose is persistence and transformation of experience data on disk, which is materially different from the declared role. Also, the declaration lists no permissions, while the code clearly reads, writes, creates, and renames local files and directories. This is a substantive description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 声明描述的是一个广义的 AI 编程协调器，触发词也集中在编程任务与复盘学习场景；但提供的代码并未实现编程协调、任务分发、代码生成、review 或学习分析等核心能力。其主要功能是切换和查询“evolution mode”状态，并输出一段用于注入 AI 上下文的提示。虽然 `--init` 会打印“协调器已启动”等文案，但实际上没有启动任何协调器进程，只是启用模式并显示说明。因此代码的主要目的与声明用途存在实质性偏差，且还包含未声明的 sudo 文件操作能力。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: 描述将该技能定位为通用的 AI 编程系统协调器，暗示它能处理开发、实现、创建、修复、重构、优化、review、分析、学习等多种编程任务的编排或响应。但实际代码没有任何代码生成、任务协调、修复、评审或开发流程控制逻辑；它只是在分析会话上下文，统计尝试次数、检测成功关键词、提取包含“记住/保存”等反馈，并判断是否触发 evolution。虽然声明中的部分触发词（如“记住”“保存经验”“复盘”）与代码用途有一定关联，但整体主用途明显更窄且不同，因此属于描述与实际行为的实质性不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: There is a clear description-behavior mismatch. The declared description promises an AI coding coordinator with many software engineering and learning triggers, but the actual code chunk is only a minimal __init__.py file containing a comment. It does not implement coordination logic, trigger handling, GitHub interactions, analysis features, persistence, or any other described behavior. Because the code provides no substantive functionality matching the declared purpose, the description is not accurately represented by this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的是一个面向编程任务的“系统协调器”，应当体现任务分派、编程辅助、代码实现/修复/评审等行为；但实际代码并未执行任何编程协调、分析、修复或 review 功能。相反，它只是一个离线脚手架生成工具：读取仓库元数据，创建技能目录结构，写入 SKILL.md 和 wrapper.py 模板文件，并输出后续提示。这属于 materially different primary purpose。虽然它与“开发”领域有弱相关性，但核心能力与声明严重不符，且实际具备未声明的文件生成与模板化封装能力。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: 描述强调的是一个广义的 AI 编程系统协调器，触发词覆盖开发、修复、重构、评审、学习等大量编程交互场景。但代码并不执行代码生成、修复、评审、任务协调或会话管理，而是一个相对专用的离线分析工具：读取 GitHub 仓库信息，检测技术栈/架构模式/规范/最佳实践，并可将结果保存到知识库。这属于明显更窄且不同的主功能。虽然“学习/分析/参考”与知识提取有一定关联，但整体描述没有体现该脚本的核心能力——解析仓库数据并存储知识，因此属于描述与实际行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents the skill as a general AI coding coordinator handling software development tasks and related conversational triggers. The supplied code does not implement coordination, coding assistance, review, memory, learning, or trigger handling. Instead, it is a narrow repository-inspection tool that queries remote GitHub resources, invokes the `git` command, downloads README content, and extracts structural hints from that content. These are materially different capabilities and involve external resource access and subprocess execution not reflected in the description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的是一个面向编程任务的协调器/触发器技能，重点应是响应开发、修复、评审、分析等请求并协调 AI 编程流程。而实际代码并不执行任何编程协调、代码生成、修复、评审或开发任务；它是一个知识库持久化工具，负责把提取出的知识写入本地 knowledge-base，并更新多个索引文件。其主要行为、资源访问方式（本地知识库文件读写）以及用途都与声明的技能定位明显不符，因此应判定为描述与行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 根据提供的代码，实际内容只是一个空的 Python 包初始化文件注释，不包含函数、类、触发词处理、编程任务协调、学习/复盘/保存经验等实现。声明描述的是一个功能丰富的 AI 编程系统协调器，但代码并未体现这些能力，二者主用途明显不一致，因此应判定为描述与行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: 描述强调的是一个面向编程任务的“系统协调器”，应主要体现为开发流程编排、任务分发、代码实现/修复/评审等能力；而实际代码并未执行任何编程协调、代码生成、修复、评审或工作流编排逻辑。它的核心功能是查询本地知识库数据，访问 ~/.config/opencode/knowledge、~/.claude/knowledge 或环境变量指定目录中的 JSON 文件，并提供多种检索方式与格式化输出。这属于知识库查询工具，而不是 AI 编程系统协调器。两者在主要目的、能力边界和资源访问对象上均存在实质性不一致。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: 声明描述的是“AI 编程系统协调器”，暗示其主要职责是根据开发、修复、评审、分析等触发词进行编程任务协调或编排。而实际代码并未体现任何任务协调、代码实现、修复、评审或多组件调度逻辑；它的核心功能是本地知识管理与持久化：解析知识库路径、生成条目 ID、读取/写入 JSON、创建目录、更新索引、统计 recent entries，并提供若干 store_* 便捷方法和命令行入口。这属于明显不同的主要用途。另一个显著差异是，代码具备实际的文件系统写入能力和知识库存储能力，但声明中未体现这一能力或相关资源访问。基于“主要目的不同 + 存在未声明的重要持久化能力”，应判定为描述与行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 描述强调的是通用编程任务协调/编程助手触发器，而代码并不执行代码生成、修复、重构、评审或开发编排。相反，它专注于分析会话文本并维护知识库，包括自动存储与评分更新。这属于 materially different primary purpose，并且包含未在声明中体现的持久化知识管理能力。因此描述与实际行为不一致。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence
• Finding: 描述较为宽泛地指向“AI 编程系统协调器”，暗示的是面向编程任务的总控/编排能力；但给出的代码并不执行编程协调、代码实现、修复、评审或系统编排，而是专门做知识触发检测与知识库检索。它还会读取项目目录以检测技术栈，并通过 query 模块访问知识库，再按 relevance/category 组织结果。这些是较具体的检索与检测能力，和声明中的主要用途存在明显偏差。触发词中少量如“开发/实现/修复/优化/分析”与代码中的意图检测有一定相关性，但声明未准确表述其真实主功能，因此应判定为描述与行为不一致。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: 该代码没有表现出“AI 编程系统协调器”应具备的任务路由、代码生成、修复、审查、记忆或经验保存等能力；它只是一个命令行工具，用于读取项目目录中的特定配置文件并基于静态规则识别技术栈。虽然“分析”类触发词与‘项目分析’存在弱相关，但整体主用途与声明相差较大，属于 materially different primary purpose。未发现明显越权行为；主要问题是描述过于宽泛且与实际实现不符。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 描述强调的是一个面向编程任务的“系统协调器”，类似根据触发词驱动开发/修复/评审等流程的编排能力；但代码并未实现任务协调、代码生成、修复、review 或工作流触发逻辑。它的核心功能是查询和格式化本地经验库数据，并可通过项目检测加载相关经验。虽然这可能作为编程系统的辅助组件，与“学习/参考/记住/保存经验”语义有一定弱相关，但其主要用途与声明的高层角色明显不一致，且实际具备的文件读取、索引查询、项目检测等能力未在描述中体现。因此属于明显描述-行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: 声明描述的是一个广义的 AI 编程系统协调器，暗示会处理开发、创建、修复、重构、优化、review、分析、学习等多种编程任务；而实际代码只是一个 CLI 持久化工具，专门把“经验”分类存储到本地目录中的 JSON 文件。虽然声明中包含“记住”“保存经验”等词，与代码部分相关，但这不足以覆盖其主要描述与实际行为之间的差异。尤其是代码具备明确的本地存储/文件写入能力，这在声明中没有准确表达；同时声明所涵盖的大部分能力在代码中并不存在。因此属于描述与行为的实质性不匹配。

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The trigger list includes very broad everyday terms such as '分析', '学习', '为什么', '继续', and '实现', which can cause the skill to activate in many unrelated conversations. Because the skill then routes into module loading and operational steps, accidental activation can lead to unintended file access, script invocation, or state changes in contexts where the user did not intend to use this skill.

Credential Access

High

• Category: Privilege Escalation

Content

(['documentation', 'docs'], '完善的文档说明'),
        (['ci/cd', 'github actions', 'gitlab ci', 'jenkins'], '自动化 CI/CD 流程'),
        (['docker', 'container', 'kubernetes'], '容器化部署支持'),
        (['environment variable', '.env'], '环境变量配置管理'),
        (['logging', 'observability'], '日志和可观测性'),
        (['security', 'authentication', 'authorization'], '安全性设计'),
        (['api versioning', 'backward compatible'], 'API 版本管理'),

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

cmd = [python_exe, str(script_path)] + args
    
    # 设置环境变量，确保子进程能找到正确的路径
    env = os.environ.copy()
    env['PYTHONUNBUFFERED'] = '1'  # 确保 Python 输出不缓冲
    
    try:

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no explicit tool restrictions even though it directs use of shell commands, filesystem access, and potentially network-capable helper scripts. In a skill that auto-routes user intents and invokes subordinate modules, missing scope boundaries increases the chance of unintended or over-privileged execution.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The skill explicitly instructs immediate module execution without waiting for confirmation after intent recognition. In a skill that may read local files, inspect project state, invoke scripts, and potentially perform writes, skipping user confirmation creates a real risk of unintended impactful actions from ambiguous or accidental triggers.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The command documentation states that ordinary natural-language requests can implicitly initialize evolution mode, causing background state changes and automatic knowledge capture, but it does not provide clear, upfront user consent or explain the persistence implications. In an agent skill that coordinates coding work and stores experience, silent activation and background collection can surprise users, capture sensitive project context, and alter the environment without an explicit opt-in.