Feature Retcon / 需求后悔药

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:54 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed local workflow helper for safely revising project feature decisions, with no evidence of hidden network access, persistence, credential theft, or destructive behavior outside user-confirmed file changes.

Install only if you are comfortable with a Chinese-language workflow that can modify and delete project files after confirmation. Before execution, verify the target stage, writable roots, deletion list, hook permissions, and any sensitive-file or large-recovery-payload prompts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs the agent to read files and execute shell commands such as `python3 .../contract.py`, but it does not declare an explicit tool scope via `permissions` or `allowed-tools`. That mismatch can cause an agent runtime to grant broader capabilities than the skill metadata communicates, increasing the chance of unintended command execution or file access if the skill is invoked in a permissive environment. The context makes this more dangerous because the shell usage is central to the workflow and includes file-state manipulation and restore operations, even though the prose tries to impose procedural safeguards.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The manifest description and all operational instructions are written exclusively in Chinese, with no indication that the user may choose another language or locale. This creates a natural-language policy issue because the skill effectively constrains usage to a specific language without documenting opt-in or a justified locale-specific scope.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This markdown file presents all operational instructions in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. The policy for natural-language violations applies to all file types, and forcing a specific language without opt-in is in scope.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The entire skill reference document is written in Chinese and does not indicate that language choice is optional or user-selectable. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire skill reference is written in Chinese and does not provide an English alternative, opt-in language selection, or any statement that the skill is region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire skill document is written in Chinese and provides no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This markdown file contains all user-facing guidance in Chinese and does not indicate that the language is optional, user-selectable, or required for a region-specific purpose. That can violate language/locale policy when users are not given an opt-in or alternative locale.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This Python file contains natural-language interface text such as the module docstring, argparse help strings, and runtime error messages entirely in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_git(repo_hint: Path, *args: str, check: bool = True) -> subprocess.CompletedProcess[bytes]:
    try:
        result = subprocess.run(
            ["git", "-C", str(repo_hint), *args],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This markdown file contains user-facing instructions exclusively in Chinese, starting with the title and continuing through all operational guidance. The policy requires flagging language or locale constraints when the skill forces a specific language without giving the user a choice or documenting a justified regional scope.

Static analysis

No suspicious patterns detected.