观势

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:03 AM UTC
• Version: 3.2.1

Overview

The skill is a coherent strategy-analysis tool, but its initializer can persistently install unverified remote skills into the local agent environment.

Review the initializer before running it. Avoid --yes unless you are comfortable installing current remote expert skills into your local skill directory, and consider --skip-agents if you only want the local knowledge-base templates. Do not provide confidential company data unless you accept that the workflow may use external web search and save report-derived PPT outline files under output/.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/guanshi-init.py:659

Finding

Unpinned Remote Skill Retrieval and Installation Without Integrity Verification

Content

View full analysis

100: target_dir = Path(skills_base) / slug target_dir.mkdir(parents=True, exist_ok=True) with zipfile.ZipFile(io.BytesIO(zip_data)) as zf: zf.extractall(target_dir) subdirs = [d for d in target_dir.iterdir() if d.is_dir()] if len(subdirs) == 1 and subdirs[0].name == slug: nested = subdirs[0] for item in nested.iterdir(): dest = target_dir / item.name if dest.exists(): import shutil shutil.rmtree(dest) if dest.is_dir() else dest.unlink() item.rename(dest) nested.rmdir() if (target_dir / "SKILL.md").exists(): print("✅ 成功（从 ClawHub 下载）") installed.append(slug) installed_ok = True ``` ### Technical Analysis The initialization script retrieves Skill packages from a remote API using only a mutable slug. It does not constrain the download to an exact version or verify an expected cryptographic digest, trusted signature, package manifest, publisher identity, archive size ...[truncated 2565 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared purpose is strategic analysis, but the skill also describes behavior consistent with installation, environment enumeration, downloading components, and creating sub-skills. This mismatch is dangerous because users and reviewers may approve the skill for benign analysis while it performs materially different actions with broader system impact.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares capabilities that imply file writing, network access, and shell-like behavior, but it does not explicitly scope or constrain tool permissions. In an agent environment, missing tool boundaries increases the chance of overreach, unintended side effects, or abuse through prompt-triggered actions that exceed the user's expectation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The invocation language is broad enough to match many common business questions, which can cause accidental routing into a heavyweight agent workflow. This becomes security-relevant because the skill is not purely conversational; it may call other skills, perform searches, and produce persistent outputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The primary description, command forms, and user-facing interaction examples are all specified in Chinese, and no language choice or opt-in behavior is offered. This can amount to a locale/language policy issue because the skill appears to assume a fixed language rather than adapting to the user's preferred language.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

An overly broad implicit trigger can cause the skill to activate on ordinary discussion and begin multi-step analysis or side-effecting workflows without clear user intent. In this skill, that risk is amplified because activation can lead to expert dispatch, searches, audits, and later file generation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill instructs silent generation of a PPT outline file and follow-on presentation creation, which introduces undeclared file side effects. Even if intended as a convenience feature, silent artifact creation can overwrite files, leak sensitive report content into persistent storage, or surprise users who only requested analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly describes silent file generation before the user is warned, which violates the principle of informed consent for data-affecting actions. Silent writes can create privacy, retention, and overwrite risks, especially when reports may contain sensitive business data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all user-facing guidance in a single language and does not indicate that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documented invocation examples for deeper analysis are limited to Chinese phrases such as "深入分析" and "再想想", which implies activation depends on a specific language. Because the file does not state that other languages are accepted or that this is a justified region-specific constraint, it creates a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The guide instructs users to run a local initialization script with a non-interactive --yes flag and explicitly states it will automatically create local bootstrap versions of eight experts, but it provides no warning about what files or directories will be created or modified. In a skill package context, encouraging silent filesystem changes increases the risk of unintended writes, persistence, or abuse if the bundled script is altered or if users run it without reviewing its behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill document is written as mandatory Chinese operating instructions and output format, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. This checklist forces a single language for all users with no opt-in, alternative locale, or justification that it is only for a Chinese-language audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The title "输出规范" establishes this file as an output specification, and the entire document prescribes output behavior exclusively in Chinese. There is no indication that the user may choose another language or that the Chinese-only constraint is justified as a region-specific requirement, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The protocol explicitly instructs the skill to silently write output/guanshi-ppt-outline.json to the workspace during the same invocation, before the user has confirmed PPT generation. That creates an undisclosed side effect and weakens user control over filesystem writes, which is especially risky because the skill also frames the write as '静默保存' and relies on downstream automation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file is entirely written with Chinese trigger phrases, commands, and required reply text such as replying with "是" or using /观势, which implicitly constrains operation to Chinese-language interaction. There is no indication that users may choose another language or that the locale restriction is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The protocol explicitly directs the agent to use web_search and web_fetch to obtain external data, but it provides no requirement to notify the user, request consent, or describe privacy/network implications. In a strategy-analysis skill, this can cause unexpected outbound requests, disclosure of sensitive query context to third parties, and ingestion of untrusted external content into the analysis pipeline.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is written to operate in Chinese throughout and does not provide a user-language choice or opt-in path. This can cause user intent to be misinterpreted, hide important caveats or uncertainty from non-Chinese users, and reduce transparency in security-sensitive or business-critical outputs where the user may not fully understand the response.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The fallback to network search introduces a data-handling and privacy risk because user prompts, company context, or query-derived sensitive business details may be transmitted to external services without an explicit user warning or consent step. In this skill, which is designed for strategy, competition, and internal business analysis, the likelihood of processing confidential corporate information is high, making silent fallback especially risky.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document states that insufficient information must result in a strict STOP with only follow-up questions, but later explicitly allows a short 'preliminary judgment framework' before collecting missing data. In a strategic-analysis skill, that exception weakens the control boundary and can normalize speculative output presented as analysis, increasing the chance that users act on unsupported recommendations.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Allowing a small 'appetizer' judgment before the stated hard gate creates a gradual bypass pattern: once limited evaluative output is permitted, the agent can drift into substantive analysis despite missing facts. Because this skill is explicitly used for strategic decisions and market recommendations, even brief early judgments can anchor users and bias subsequent decision-making based on incomplete information.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/guanshi-init.py (reported line 570)May include surrounding context.

python

if entry.is_dir() and (entry / "SKILL.md").exists():
                    installed.add(entry.name)
    try:
        result = subprocess.run(["hermes", "skills", "list"], capture_output=True, text=True, timeout=10)
        for line in (result.stdout + result.stderr).split("\n"):
            parts = [p.strip() for p in line.split("│")]
            if len(parts) >= 2 and parts[1]:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

In non-interactive mode, the script can proceed with automatic download and installation of remote content without a strong user-facing warning at execution time. This creates a silent remote content intake path suitable for CI, automation, or scripted environments, where users may assume only local initialization occurs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This initializer performs network retrieval of additional skills and installs their contents onto the local filesystem, which materially expands its trust boundary beyond simple local setup. A user running an innocuous-looking init script may unknowingly import unverified remote content, enabling supply-chain compromise if the remote source or transport assumptions fail.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script belongs to a strategic-analysis skill, but it includes capability to fetch and install other skills from a remote service, creating behavior not tightly aligned with its core purpose. That mismatch increases the chance users will execute it with lower scrutiny, making supply-chain abuse or unexpected dependency expansion more dangerous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The implicit-trigger confirmation tells the user to reply with Chinese text ("是") or a Chinese slash command, which presumes a specific language in the interaction flow. Because no alternative language or locale handling is provided, the prompt may violate language-choice expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.