Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed defensive red-team skill with broad review powers, but its risky behaviors are mostly purpose-aligned and bounded to audit output rather than hidden persistence or destructive action.
Install from a trusted, pinned source when possible. Use this skill only for targets you are authorized to test, keep reproduction runs on branches or copies, avoid production data, and be aware that the Evidence lens may send search queries or fetched-source context to external services.
The language selector marks English as an alternate link while emphasizing only Simplified Chinese in the current document, and the file content is entirely in Chinese with no stated user choice or locale limitation. This creates a natural-language locale policy concern because the skill documentation is presented in a fixed language without opt-in or justification.
The skill presents itself as a broad, independent red-team attacker, but the analyzed behavior reportedly only performs narrow Markdown field extraction. That mismatch is dangerous because operators may rely on it for security review coverage it does not actually provide, creating false assurance and causing real vulnerabilities in targets to go undetected.
The file explicitly instructs the model to adopt an attacker persona and to treat embedded authority and reviewer guidance as non-authoritative, including directions to attack items even when the target says to skip them. This erodes normal safety and deference boundaries and can cause the agent to disregard legitimate limiting instructions in analyzed material, increasing the risk of harmful or policy-violating output.
The skill progressively directs the model from an attacker mindset into generating concrete, executable cheat scripts that bypass checks while avoiding detection. That is dangerous because it operationalizes abuse: rather than merely identifying weaknesses, it asks for runnable evasion playbooks and explanations of why defenses fail, which materially assists real-world circumvention.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- **Engineered independence (the entire value).** The defect this targets is the **false-positive result** — a green test suite sitting on a broken thing, because the check and the checked came from the *same mental model* (correlated error). The only cure is to run the attacker from a context that **never saw the build** — and at high stakes, from a model of a *different vendor*. **Independence tiers (KB K1, as of 0.8.0):** same model = `instance`; a different model of the same vendor (e.g. Opus attacking Fable-authored text) = `instance_plus`, **never** recorded as `model`; `model` requires a different vendor, declared with the resolved model IDs of both sides. Host-injected context that was not stripped (project CLAUDE.md, auto-memory index) is declared as "L-i incomplete" in the notes. Model-level blind spots stay invisible to same-vendor self-attack.
**As of 0.7.0 this is measured, not asserted**: PBT-Bench (2605.15229) finds the hardest defects are *model-specific* with **no single model covering all of them** — a one-model battery carries a structurally uncoverable residue, and a second vendor is the only thing that reaches it (KB anchor `WEB-VerifierEng` / E12, the first non-anecdotal quantitative support for the `model` tier). The counter-evidence from the same source line travels with it, so the claim is not overstated: MAS-ProVe finds an independent judge is *not* generally more capable than re-running the generator — different-vendor buys **different blind spots**, not more strength, and only the former is claimed here.
- **Fix-audit rotation (new in 0.7.0).** A fix is the least-attacked text in the whole target — it was written *after* the last attacker went home. So: if round N produced repairs, round N+1 **must** re-aim the five lenses at the **fix diff**, run from a context that did NOT write those fixes (a fixer auditing its own fix is an independence collapse). Four axes: (1) did the fix propagate to every sibling site, especially *higher-rank*
...[truncated 26 chars]
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
**What ships** — 1 `SKILL.md` + 5 lens prompts (`lenses/`) + 1 rubric with ≥16 golden samples and the four acceptance axes (`references/prove-or-flag.md`) + 1 seed-recipe note (`references/seed-recipes.md`) + 1 fix-audit mode note (`references/fix-audit.md`) + 1 extractor (`scripts/extract_shadow_map.py`, Python stdlib) + 1 output schema (`schemas/output.json`). No `rules/`, no per-target scaffolding.
**Install** — `npx skills add VincentJiang06/skills` (or `cp -R skills/attacker ~/.claude/skills/vince-attacker`). Findings / flags / ledger live under the **target project**'s `.loop/` (project-local).
**Honest coverage note** — Every round that shaped this skill was same vendor (Anthropic): `instance`-tier through 0.7.0 (one Fable family attacking its own KB), and the 0.8.x R20 wave is `instance` for its own new text (written and attacked by Opus 5.5), reaching `instance_plus` only against the Fable-authored legacy text. Per T11 the model-level blind spot is systematically invisible to all of them — and PBT-Bench now puts a number under that blind spot (hardest-defect coverage is model-specific, no single model covers all), so the residue is *measured to exist*, not merely feared. "Converged" here therefore means "converged against same-vendor attack," not "validated across models." This skill's pre-registered acceptance test is therefore: **run it once with a different-vendor attacker** (GPT / Gemini / DeepSeek / Kimi) against a real target, using the SEED hit-rate as a capability probe. Until that run exists, this skill is proven to *find things*, not proven to be *model-portable in the field*.
The README instructs users to install the skill via npx skills add VincentJiang06/skills without pinning a specific package/version or commit. This creates a supply-chain risk: a future malicious or compromised package/repository state could be fetched and executed at install time, and the attacker-themed nature of the skill makes reviewing provenance especially important rather than less important.
The README describes activation with phrases like "attack this", "try to break it", and "find what tests missed" without narrowing the context or giving exclusion examples. These are natural phrases that could plausibly appear in ordinary collaboration and may cause unintended invocation if used as trigger guidance.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
**装什么** —— 1 个 `SKILL.md` + 5 个镜头提示词（`lenses/`）+ 1 张评分卡含 ≥16 条黄金样本与四轴验收（`references/prove-or-flag.md`）+ 1 份种子配方（`references/seed-recipes.md`）+ 1 份修复审计模式说明（`references/fix-audit.md`）+ 1 个提取脚本（`scripts/extract_shadow_map.py`，Python 标准库）+ 1 份输出 schema（`schemas/output.json`）。没有 `rules/`，没有按目标定制的脚手架。
**安装** —— `npx skills add VincentJiang06/skills`（或 `cp -R skills/attacker ~/.claude/skills/vince-attacker`）。findings / flags / 台账写在**目标项目**的 `.loop/` 下（项目本地）。
**诚实的覆盖注记** —— 塑造这个 skill 的每一轮攻击都是同厂（Anthropic）的：0.7.0 及以前是 `instance` 级（Fable 家族攻击自己的知识库），0.8.x 这波 R20 升级：新写的文字由 Opus 5.5 写、也由 Opus 5.5 审，所以是 `instance`；只有对 Fable 写的旧文字才到 `instance_plus`。按 T11，模型级盲点对它们系统性不可见；PBT-Bench 现在还给这块盲区加了个数：最难缺陷 model-specific、无单一模型全覆盖 —— 也就是说这块残余是**被测出来存在**的，不只是被担心存在。所以这里的「收敛」是「对同厂攻击收敛」，不是「跨模型验证过」。本 skill 自己的预注册验收测试因此是：**用一个不同厂商的攻击者（GPT / Gemini / DeepSeek / Kimi）对一个真实目标跑一次**，用 SEED 命中率当能力探针。在那次运行存在之前，本 skill 被证明「能找到东西」，但尚未被证明「在真实场景里跨模型可移植」。
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
**装什么** —— 1 个 `SKILL.md` + 5 个镜头提示词(`lenses/`)+ 1 张评分卡含 ≥16 条黄金样本与四轴验收(`references/prove-or-flag.md`)+ 1 份种子配方(`references/seed-recipes.md`)+ 1 份修复审计模式说明(`references/fix-audit.md`)+ 1 个提取脚本(`scripts/extract_shadow_map.py`,Python 标准库)+ 1 份输出 schema(`schemas/output.json`)。没有 `rules/`,没有按目标定制的脚手架。
**安装** —— `npx skills add VincentJiang06/skills`(或 `cp -R skills/attacker ~/.claude/skills/vince-attacker`)。findings / flags / 台账写在**目标项目**的 `.loop/` 下(项目本地)。
**诚实的覆盖注记** —— 塑造这个 skill 的每一轮攻击都是同厂(Anthropic)的:0.7.0 及以前是 `instance` 级(Fable 家族攻击自己的知识库),0.8.x 这波 R20 升级:新写的文字由 Opus 5.5 写、也由 Opus 5.5 审,所以是 `instance`;只有对 Fable 写的旧文字才到 `instance_plus`。按 T11,模型级盲点对它们系统性不可见;PBT-Bench 现在还给这块盲区加了个数:最难缺陷 model-specific、无单一模型全覆盖 —— 也就是说这块残余是**被测出来存在**的,不只是被担心存在。所以这里的「收敛」是「对同厂攻击收敛」,不是「跨模型验证过」。本 skill 自己的预注册验收测试因此是:**用一个不同厂商的攻击者(GPT / Gemini / DeepSeek / Kimi)对一个真实目标跑一次**,用 SEED 命中率当能力探针。在那次运行存在之前,本 skill 被证明「能找到东西」,但尚未被证明「在真实场景里跨模型可移植」。
The README instructs users to run npx skills add VincentJiang06/skills without pinning an exact package version or commit. That creates a supply-chain risk: a future malicious or compromised package/update could be fetched and executed at install time, and the risk is heightened because this is an install command users may copy-paste directly.
Without declared permissions the skill's intent is opaque and cannot be validated.
The manifest says to use the skill when the user says "red-team/break this" or "$attacker", and the description also says "Attack any target". Phrases like "break this" are broad and can overlap with ordinary discussion or benign requests, and the file does not define clear scope boundaries or negative examples for when the skill should not activate.
The skill explicitly directs the agent to use web search and fetch external URLs, but it provides no user-facing disclosure or consent boundary around network access. In an agent setting, that can cause target content, prompts, citations, or other sensitive context to be transmitted to third-party services or untrusted sites during analysis, which is a real privacy and data-exposure risk.
The lens is activated with very broad scope ('attack any target') and minimal trigger constraints, which increases the chance it will be applied to inappropriate content or contexts. In combination with the rest of the file, this permissive framing widens misuse potential by normalizing adversarial analysis without clear boundaries or exclusions.
SQP-3 applies to all file types and covers natural-language language/locale policy violations. At L068, the file quotes an instruction only in Chinese, with no accompanying translation, user opt-in, or stated region-specific justification, which can force a specific language context on readers.
The prescribed output block begins with '[En]', which indicates a fixed language/locale requirement. The file does not offer user opt-in or explain why English is required, so this is a natural-language policy concern.