司马迁.skill：AI时代的个人使用说明书

• Outcome: Pass
• Latest audit: Jul 17, 2026 · 9:48 AM UTC
• Version: 1.3.4

Overview

This skill is a coherent personal-profile generator, but users should treat the generated profile and homepage as sensitive personal material.

Install only if you are comfortable giving an agent personal materials to summarize. Review generated persona-agent.md and personal-homepage.html before sharing, avoid secrets or regulated data, and remember that the HTML templates may contact third-party font/icon services when opened.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Description-Behavior Mismatch

Low

• Confidence: 93% confidence
• Finding: The template loads Google Fonts from third-party domains, which causes any generated homepage to make external network requests when opened. This leaks visitor metadata such as IP address, user agent, and access timing to Google, and breaks the expectation that the skill outputs self-contained local artifacts derived only from provided user materials.

Context-Inappropriate Capability

Low

• Confidence: 90% confidence
• Finding: The homepage template includes third-party resource loading that is not necessary for the core function of synthesizing a personal homepage. Even without active code execution, this creates an unnecessary external dependency, introduces privacy leakage, and can make output behavior differ from a user's expectation of a static local HTML file.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The manifesto explicitly instructs users to provide extensive personal materials such as articles, resumes, podcasts, social media, notes, and work links, and to produce both a private AI-facing persona file and a public homepage, but it provides no warning about privacy, consent, retention, or sensitive-data minimization. In a skill centered on identity synthesis, this omission can lead users to expose highly sensitive personal information to the model, downstream agents, or public output channels without understanding the risks.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger description includes many broad activation phrases such as generic requests for bios, homepages, and persona materials, without clear exclusions. In an agent ecosystem, this can cause the skill to activate on loosely related user requests and unnecessarily ingest sensitive personal materials, increasing the chance of over-collection, privacy leakage, or inappropriate output generation.

Natural-Language Policy Violations

Medium

• Confidence: 79% confidence
• Finding: The skill content is written entirely in Chinese and implicitly centers Chinese-language operation without stating that language should follow the user's preference. This can lead to incorrect language selection, user confusion, and mishandling of nuanced privacy or consent interactions if the agent defaults to Chinese when the user's locale differs.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The default prompt is hardcoded in English ("Use $simaqian.skill...") even though the skill metadata and intended use cases are primarily Chinese. This can cause unwanted language steering at invocation time, reducing user control and potentially leading to outputs in the wrong language without explicit opt-in; while not a direct security exploit, it is a real prompt-quality and user-intent integrity issue.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The page instructs users to clone and install a third-party skill into a local agent skills directory, which can cause an agent runtime to trust and execute unreviewed local content. In an agent ecosystem, this lowers the barrier to supply-chain compromise or prompt-injection persistence because users are nudged to install code/configuration directly into a privileged integration path.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The framework explicitly solicits sensitive personal information, including what can or cannot be public, what should remain in private context, and what an AI agent must not say. Collecting this kind of data without any accompanying privacy notice, minimization guidance, retention limits, or handling safeguards creates a real risk of oversharing, inadvertent disclosure, or unsafe downstream use by agents and operators.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The file hardcodes Chinese as the output language and framing ('输出规格', '给 AI', '给人的') without indicating that language should follow the user's preference or locale. In an agent skill, this can cause the system to ignore user language choice, reduce accessibility, and create confusing or unusable outputs for non-Chinese-speaking users, especially when the skill is auto-triggered.

Static analysis

No suspicious patterns detected.