Skill Registry | 技能注册表

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:01 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed local skill registry, but it persistently changes agent routing and can auto-load other skills from broad trigger words without strong user control.

Install only in a workspace where you are comfortable exposing the list of installed skills and allowing persistent trigger-based routing. Prefer explicit commands such as /skills, require confirmation before executing matched skills, and avoid broad triggers for any skill that can read private files, use credentials, access the network, or change state.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrases include very generic requests like 'what skills' and '你会什么', which can easily overlap with normal conversation and cause unintended activation of the registry skill. This is primarily a routing integrity issue: it can expose available capabilities or divert user requests into skill enumeration when the user did not explicitly intend that.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The listed triggers such as 'example, demo' are vague and may match incidental user language rather than a deliberate invocation. In a trigger-word routing system, overly broad keywords increase accidental execution and can make downstream skill selection unreliable or manipulable.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The registry skill is configured with broad generic terms like 'skills' and '技能' without additional constraints, so ordinary discussion about skills may trigger disclosure of the registry. This can facilitate unnecessary capability discovery and weaken routing precision across the workspace.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When user asks about skills:
1. "All skills" → List by category (brief)
2. Specific domain (e.g., "video skills") → Return that category only
3. "How to use XX" → Read `skills/XX/SKILL.md`

用户询问技能时：
1. "所有技能" → 按分类简要列出

• Confidence: 84% confidence
• Finding: The file explicitly instructs the agent to list skills by category and read specific `skills/XX/SKILL.md` files on request, which enables structured skill enumeration. In environments where skills may contain sensitive operational details, exposing the registry and file paths can help an attacker map available capabilities and target higher-risk skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

用户询问技能时：
1. "所有技能" → 按分类简要列出
2. 特定领域（如"视频技能"）→ 只返回相关类别
3. "XX怎么用" → 读取 `skills/XX/SKILL.md`

---

• Confidence: 84% confidence
• Finding: The Chinese-language instructions mirror the same enumeration behavior, allowing skill discovery and direct lookup of `skills/XX/SKILL.md`. Because the behavior is duplicated across languages, the attack surface is broader and easier to trigger through multilingual prompts.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. Create skill directory under `skills/`
2. Write `SKILL.md` (refer to existing skills)
3. Add entry to this file under appropriate category
4. Add triggers to RULES routing table (if auto-routing needed)

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

|-----------|--------|
| "what skills" / "有什么技能" / "/skills" | Read REGISTRY.md, list by category |
| "XX related skills" / "/skills XX" | Return related category only |
| "How to use XX skill" | Read `skills/XX/SKILL.md` |

**Trigger-word Routing Table | 触发词路由表：**

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

|-----------|--------|
| "what skills" / "有什么技能" / "/skills" | Read REGISTRY.md, list by category |
| "XX related skills" / "/skills XX" | Return related category only |
| "How to use XX skill" | Read `skills/XX/SKILL.md` |

**Trigger-word Routing Table | 触发词路由表：**

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The task-execution flow activates skills by scanning a request and matching triggers before reading and executing the referenced SKILL.md. Because the matching criteria are not bounded by explicit confirmation, priority, or exclusion rules, ordinary user phrasing can unintentionally route execution into a skill workflow, which may cause the agent to follow the wrong instructions or expose skill-specific behavior unexpectedly.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The example shows a generic phrase like 'Help me do XX' leading directly to trigger-based skill selection. Broad, everyday language patterns increase the chance that normal conversation will accidentally invoke a skill, causing unintended workflow execution or disclosure of skill-specific capabilities.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 70% confidence
• Finding: Shadow Command Trigger: 'list skills' conflicts with built-in command 'list'

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger "你会什么" is a very general conversational phrase meaning roughly "what can you do," which can easily appear in ordinary chat outside the narrow intent of listing workspace skills. Because the file presents it as a direct trigger without exclusions or scope limits, it could cause unintended invocation of this registry skill.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill promotes keyword-based auto-routing but does not define safeguards such as exact matching, confirmation for ambiguous matches, or priority rules. In a workspace with many skills, this can cause unintended activation of unrelated or more sensitive skills based on incidental words in a user request.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The auto-routing flow states that a matched trigger leads directly to reading another skill and executing it, but it does not warn users or require consent. This creates a confused-deputy risk where a harmless-looking request can implicitly invoke another skill with broader capabilities than the user expected.

Vague Triggers

Low

• Confidence: 91% confidence
• Finding: The routing table is only a loose mapping of trigger words to skills and does not define validation, conflict resolution, exclusions, or trust boundaries for overlapping triggers. This under-specification makes misrouting and accidental activation more likely, especially as more skills are added to the registry.

Static analysis

No suspicious patterns detected.