司马迁.skill：AI时代的个人使用说明书

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:27 AM UTC
• Version: 1.3.4

Overview

The skill mostly does what it says, but it also encourages broad memory-based personal profiling, shareable external profile links, and unpinned skill installation in ways users should review carefully.

Install only if you are comfortable with a Chinese-language personal-profile skill. Do not let it use long-term memory or past chats unless you intentionally want those details included, review generated profile text before sharing links, avoid putting secrets or private third-party information into the prompts, pin or manually inspect any GitHub install, and add your own .gitignore rules for generated persona/homepage files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: landing/index.html:1004

Finding

Forced Branded Output and Conversation-Memory Extraction

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: landing/index.html:1083

Finding

Prompt Injection Through Unsanitized Friend-Profile Fields

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: assets/caojuege-homepage-template.html:368

Finding

Hard-Coded Third-Party Promotion in the Default Homepage Output

Content

View full analysis

Made with 草诀歌 AI Labs

Closing · 结语

以产品为笔，和世界对话。

草诀歌 AI Labs {{FOOTER}} Made by 草诀歌 AI Labs →

``` The Skill instructions select this style by default when the user does not specify another style. The template contains repeated fixed third-party branding and an outbound promotional link that are not represented as optional placeholders. ### Technical Analysis The Skill's declared purpose is to create a personal homepage describing the user. The default template modifies that deliverable by adding fixed promotional attribution to an external organization. Because the attribution is embedded directly in the template, ordinary generation preserves it even when the user did not request or approve advertising. This is persistent output manipulation: loading and following the Skill can create public-facing files that promote an unrelated party. It also changes the user's public identity artifact and introduces an outbound link. ### Attack Path 1. A user asks the Skill to generate a personal homepage without selecting a visual style. 2. The Skill follows its default-template rule and chooses the Caojuege template. 3. User-specific content is inserted into the template. 4. The hard-coded branding and external promotional link remain in the generated page. 5. The user publishes the page without noticing or removing the attribution. 6. Visitors are exposed to the third-party promotion and ou ...[truncated 315 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: assets/renaissance-homepage-template.html:5

Finding

Unpinned Remote JavaScript Executed in Generated Pages

Content

View full analysis

``` ### Technical Analysis The generated page executes JavaScript obtained at runtime from `code.iconify.design`. Although a version appears in the URL, the template provides no Subresource Integrity hash and no restrictive Content Security Policy. The reviewed repository therefore does not cryptographically bind the executable content to the version audited. If the CDN, hosted resource, DNS path, or delivery infrastructure is compromised, visitors may execute modified JavaScript under the generated page's origin. The dependency may access page DOM content and, when applicable, URL fragments containing generated profile fields. The Google Fonts references are remote resources as well, but the primary code-execution concern is the external script. ### Attack Path 1. The Skill generates a homepage using the Renaissance template. 2. The user publishes the page. 3. A visitor opens the page. 4. The browser retrieves the Iconify script from the external CDN. 5. If the remote resource or delivery path has been compromised, attacker-controlled JavaScript executes in the page context. 6. The script can inspect or modify biography content, read the URL, alter links, or initiate browser-side network requests. ### Impact Assessment The dependency does not grant operating-sy ...[truncated 431 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:138

Finding

Documented Git Privacy Safeguard Is Missing

Content

View full analysis

注意：生成的 `persona-agent.md` 和 `personal-homepage.html` 默认是你的私有文件，不要提交到公开仓库（已在 `.gitignore` 中忽略）。`examples/` 里的样例都是创作者本人同意公开、并已脱敏的版本。 ``` The documentation states that generated private files are already ignored by `.gitignore`. The audited project directory contains no `.gitignore` file. ### Technical Analysis The generated persona and homepage can contain personal history, behavioral observations, collaboration boundaries, external links, and inferred traits. The README tells users that Git ignore rules already protect these files, but the referenced control is absent from the reviewed tree. Users relying on this statement may run a broad Git staging command and publish files they believed were excluded. This is a security-relevant mismatch between documented privacy behavior and actual repository configuration. ### Attack Path 1. A user installs or clones the Skill into a Git-controlled workspace. 2. The Skill generates `persona-agent.md`, `personal-homepage.html`, or the default personal-output directory. 3. The user relies on the README statement that these private outputs are already ignored. 4. The user runs a broad staging operation such as adding all untracked files. 5. Because no matching `.gitignore` rule is present, the generated files are staged. 6. The user commits and pushes the files to a remote or public repository. 7. Personal profile data becomes publicly accessible through repository history. ### Impact Assessment No additional process or system privileges are obtained. The affected scope is the confidentiality of generated personal files and any Git repository into which they are written. Exposure may persist in commit history even after files are deleted from the latest revision. The ...[truncated 185 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says the skill should transform personal materials or interview answers into a Markdown persona document and polished HTML homepage. The supplied code does not process user materials, summarize interviews, generate Markdown, or build a personal profile page. Instead, it only registers a custom HTML element that inserts and styles an image. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose describes a content-generation skill that transforms personal materials or interview answers into two deliverables: a Markdown persona file for AI agents and an HTML homepage for humans. The supplied code instead is a front-end canvas drawing module for a fixed-format visual card. It contains typography/layout helpers, theme definitions, QR image loading, and export functions (renderToCanvas/renderToBlob/renderToDataURL) to produce a PNG-like image. There is no logic for synthesizing a persona document, producing Markdown, generating HTML pages, or processing interview/source materials into those formats. While both relate loosely to personal profile presentation, the actual code's primary purpose and output format are materially different from the declared description.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/renaissance-homepage-template.html (reported line 1)May include surrounding context.

html

<!DOCTYPE html><html lang="zh-CN"><!-- Template: 文艺复兴风格 --><head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>{{NAME}} · 个人主页 — 文艺复兴风格</title>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/renaissance-homepage-template.html (reported line 189)May include surrounding context.

html

</figure>
</section>

<!-- WORK -->
<section id="work" class="section">
  <div class="wrap">
    <div class="sec-head">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/david-personal-homepage-renaissance.public.html (reported line 167)May include surrounding context.

html

</div>
</header>

<!-- HERO + ABOUT merged -->
<section class="hero" id="top">
  <div class="col-text">
    <span class="badge fade"><span class="dot"></span>Personal Homepage · 个人主页</span>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · landing/index.html (reported line 629)May include surrounding context.

html

</head>
<body>

<!-- =========================== LANDING ============================ -->
<div id="landing">

  <nav class="nav">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · landing/index.html (reported line 848)May include surrounding context.

html

</footer>
</div>

<!-- =========================== RESULT ============================ -->
<div class="render-page" id="renderPage">
  <nav class="nav">
    <div class="nav-inner">

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly encourages users to provide highly sensitive personal materials such as articles, resumes, podcasts, social media, notes, links, and to rely on AI long-term memory, but it does not warn about privacy risks, retention, third-party processing, or accidental inclusion of confidential data. In this context, the omission is security-relevant because the skill is designed to aggregate and synthesize identity-rich data into durable artifacts, increasing the chance of oversharing, profiling, or unintended disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The default prompt explicitly instructs the model in English despite the skill being described primarily for Chinese-language use cases, which can override or bias the user's preferred language without clear opt-in. This is not typically a security-critical issue, but it can degrade user control and cause unintended disclosure or mishandling if downstream processing assumes the wrong language or locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The HTML declares lang="zh-CN", which fixes the page locale to Simplified Chinese. In combination with the many Chinese-only navigation and section labels elsewhere in the template, this indicates a forced language/locale choice rather than offering user opt-in or alternatives.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The HTML root element hard-codes lang="zh-CN", which imposes a specific language/locale on all generated pages. This file does not offer a user opt-in or indicate that the template is intentionally limited to a China-specific audience, so it conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The HTML root sets lang="zh-CN", which hard-codes a specific language/locale for the entire page. Under the policy, locale constraints should either be user-selectable or clearly documented as region-specific; this template provides neither.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The entire skill file is written as Chinese-only operating guidance and includes default phrasing and prompts in Chinese, but it does not state that language selection is optional or limited to a justified region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The header comment and embedded user-facing strings throughout the file are written in Chinese and present the skill as a Chinese-language experience by default, with no indication that users can choose another language or locale. This can violate language/locale policy when a skill implicitly requires one language without documenting opt-in or offering alternatives.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The document declares lang="zh-CN", and the visible interface and prompt text are entirely in Chinese, which effectively constrains the skill experience to one language/locale. Under the policy, locale restrictions should either offer user choice or be clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The page explicitly tells the agent/user to clone and install a GitHub-hosted skill into a local skills directory, which expands the effective capability from content generation to software acquisition and installation. That creates supply-chain and execution risk because users may fetch unreviewed code from a remote repository and grant it trust within their agent environment.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The embedded prompt tells the model to use long-term memory, past conversations, and user self-disclosure to generate output, encouraging aggregation of personal data into a shareable artifact. In this skill's context, that increases the chance of exposing sensitive historical details, inferred traits, or information the user did not intend to republish.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The title '输出规格' and the entire document prescribe output structure and writing requirements exclusively in Chinese, with no indication that language selection is optional. This creates a natural-language policy concern because it effectively forces a specific language/locale without user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file contains user-facing instructions exclusively in Chinese, and there is no indication that the user can choose another language or that the template is intentionally limited to a Chinese-speaking context. Under the policy rule for natural-language violations, forcing a specific language without opt-in is a reportable issue.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template loads fonts from Google-hosted domains, causing every visitor to the generated homepage to make third-party network requests. This can leak visitor IP address, user agent, referrer context, and page access timing to an external service, which is a privacy and data-minimization issue beyond a purely self-contained homepage template.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The template loads fonts and an icon library from third-party domains, which creates outbound network dependencies and gives those providers visibility into page visits. While common for web templates, this expands the trust boundary and can enable tracking, availability issues, or supply-chain risk if the remote assets are changed or unavailable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document declares lang="zh-CN", which sets a specific language/locale for the entire page. Under the policy criteria, forcing a locale without user opt-in or a clearly documented justification is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document declares lang="zh-CN", which fixes the page to a specific language/locale. Under the policy, locale-specific content should either offer user choice or clearly justify the restriction; this file provides no such opt-in or justification in the surrounding content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The page loads third-party JavaScript and fonts from external domains, which introduces network dependency and a supply-chain trust boundary into an otherwise local static skill asset. If those remote resources are modified, blocked, or abused, page behavior could change unexpectedly or leak metadata about page access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document declares lang="zh-CN", which hard-codes a specific language/locale. Under the policy, forcing a specific language without user choice or a documented justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.