Security audit

Sun Tzu Perspective

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese-language Sun Tzu strategy-advice skill with some unrelated helper scripts, but I found no hidden execution, persistence, credential access, or data exfiltration behavior.

Before installing, be aware that this is primarily a Chinese-language strategic-advice persona and that some bundled scripts are unrelated to the stated purpose. Do not use the strategic framing for deception, coercion, illegal surveillance, harassment, or unfair manipulation; treat any script as optional local tooling and inspect it before manually running it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个以《孙子兵法》为核心的战略分析/决策辅助类技能，而代码实际是一个用于视频字幕下载的 shell 脚本示例。两者在主要目的、能力范围和触发场景上都明显不一致。即使脚本目前只是示例、未真正执行下载，其明确意图仍是处理视频字幕，而非提供战略思维或竞争分析。因此应判定为描述与行为严重不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向战略分析与孙子兵法思维框架的内容型/推理型技能；而实际代码实现的是一个文件处理与统计工具，用于分析 research 目录中的文档来源数量和文件大小。二者的主要目的完全不同：代码没有体现任何孙子兵法、战略规划、竞争分析、决策优化、谈判或领导力相关逻辑，反而执行了未声明的本地目录扫描、文件读取和统计汇总功能。因此该描述与代码行为存在明显且实质性的不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个以《孙子兵法》为核心的战略思维/决策支持类技能，但提供的代码并未实现任何战略分析、竞争策略建议、谈判辅助或“孙子视角”相关逻辑。相反，它是一个面向 SKILL.md 的质量检查工具，检查文档结构和写作规范。这属于与声明主用途 materially different 的行为，并且包含未声明的本地文件读取与文档审查能力。虽然代码看起来像开发/维护辅助脚本，但就所给代码块而言，其实际功能与技能描述明显不符。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向战略思维与孙子兵法分析的技能，但代码实现的是字幕文件到纯文本的转换脚本，核心功能与战略规划、竞争分析、谈判或领导力完全无关。代码还执行了本地文件输入输出，这些能力在声明用途中没有体现。两者的主要目的、能力和适用场景均明显不一致，因此属于高置信度的描述与行为不匹配。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The manifest describes a conceptual strategy/leadership perspective skill centered on Sun Tzu-style analysis, but this file is a utility that reads subtitle files, strips timestamps/HTML, and outputs plain text. That behavior is unrelated to strategic planning, competitive analysis, negotiation, or any stated 'Sun Tzu perspective' functionality.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description and trigger phrases are entirely in Chinese, and the document presents the persona and interaction model exclusively in Chinese without indicating that users may choose another language. This creates a language-policy concern because the skill appears to impose a single language by default rather than offering opt-in or documenting a justified Chinese-only scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases include broad generic terms such as '战略思维' and '竞争策略', which are likely to match many benign user requests and cause accidental invocation. Over-broad activation increases the chance that users receive this persona's manipulative or adversarial framing in contexts where they did not request it, reducing predictability and consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill promotes tactics such as deception, initiative control, and exploiting weaknesses, but does not pair them with clear ethical guardrails or warnings against misuse in harmful real-world manipulation. In a general-purpose advisory setting, that context makes socially engineered, coercive, or unfair conduct easier to normalize.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code file contains natural-language comments and printed messages in Chinese, and the script's behavior implicitly assumes Chinese-language users. Under the policy, forcing a specific language without user opt-in or a documented justification is a locale-policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes a skill for providing Sun Tzu-style strategic thinking, competition analysis, and decision support. This file instead implements a local QA validator for SKILL.md content structure and terminology, which is build-time/documentation tooling rather than strategic-analysis behavior exposed by the declared skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: SQP-3 applies to all file types and includes language or locale policy violations. This file presents all instructions exclusively in Chinese and does not indicate that users may choose another language or that the Chinese-only constraint is required for a specific region or compliance context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This file contains natural-language content exclusively in Chinese starting from the title, and nowhere indicates that the language is optional or user-selectable. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in is a potential organizational policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file contains user-facing natural language content exclusively in Chinese, and there is no indication that the reader can choose another language or that the document is intentionally limited to a Chinese-speaking audience. Under the language/locale policy check, forcing a single language without opt-in can be a policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: SQP-3 applies to all file types and includes language or locale policy violations. This markdown file presents all content in Chinese and does not state that the skill is Chinese-only, region-specific, or that users may choose another language, so it can be read as forcing a specific language by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file uses Chinese throughout and does not indicate that the user opted into Chinese or that the skill is intentionally limited to a Chinese-speaking or region-specific context. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This file presents all content exclusively in Chinese and does not indicate that the skill is region-specific or that users may choose another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script's natural-language comments and console messages are entirely in Chinese, with no option for users to select another language. This can violate language/locale policy when a skill is expected to be generally usable unless the locale restriction is explicitly documented or made optional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code file contains natural-language comments and printed messages in Chinese, including error and summary output, with no indication that the skill is intended only for Chinese-speaking users. That can violate language/locale policy because it effectively forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.