reorganize-logic

• Outcome: Pass
• Latest audit: Sep 28, 2026 · 3:04 AM UTC
• Version: 0.3.4

Overview

This is a disclosed documentation-rebuild skill with a local verification gate; its broad project reading and doc-writing are purpose-aligned and no hidden deletion, exfiltration, or persistence was found.

Install only from the reviewed revision, expect the skill to read the target project broadly, write contract files and gitignored review artifacts, and run the local verifier. Review the deletion manifest yourself before deleting or overwriting any legacy documentation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Yes, this is a clear mismatch. The declared description presents a specialized code-analysis and contract-reconstruction skill for rebuilding a project's DESIGN-CONTRACT layer from source code. The actual code shown only defines two arithmetic helper functions. There is no evidence of project inspection, contract derivation, architecture reconstruction, verification logic, file operations, or legacy deletion. The code's primary purpose is materially different from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a high-level repository-analysis and contract-rebuilding capability. The actual code chunk only implements two arithmetic functions in a standalone math file. There is no evidence of code that inspects a project, reconstructs contracts, verifies them, or deletes legacy artifacts. This is a material mismatch in primary purpose and capabilities.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

the code's public surface by `scripts/verify_contracts.mjs`, and the new contracts

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

the code's public surface by `scripts/verify_contracts.mjs`, and the new contracts

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

the code's public surface by `scripts/verify_contracts.mjs`, and the new contracts

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md

the code's public surface by `scripts/verify_contracts.mjs`, and the new contracts

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

the code's public surface by `scripts/verify_contracts.mjs`, and the new contracts

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md

the code's public surface by `scripts/verify_contracts.mjs`, and the new contracts

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Text artifact contains embedded NUL bytes

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 26)May include surrounding context.

md

- Status: release candidate (release check passed, no open P0/P1; adversarial testing reached same-model instance-tier independence only).
- Head-to-head against a bare model (3 cases), the skill was never less accurate and never edited legacy docs, but the bare model was more complete in all three.

**When to use** — "reorganize/rewrite the logic" · "rebuild the contracts from scratch" · "rewrite the architecture/structure/interface docs"; or call `/reorganize-logic`.
**Not for** — incremental doc sync / session cleanup (→ neat, the sharpest boundary: this skill DELETES legacy rather than keep-and-sync); designing an agent loop (→ loop-constructor); editing the implementation code (it rebuilds the contract/doc layer, not the logic); a greenfield project with no existing contracts (nothing to clean).

**Install** — `npx skills add VincentJiang06/skills` (or `cp -R skills/reorganize-logic ~/.claude/skills/`).

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are broad natural-language requests such as "reorganize/rewrite the logic" and "rewrite the architecture/structure/interface docs," which can overlap with ordinary user requests. In an agent ecosystem, overly broad invocation cues can cause accidental activation of a destructive skill whose documented behavior includes deleting legacy contract documentation behind a review gate, increasing the chance of unintended workflow changes or data loss.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.en.md (reported line 29)May include surrounding context.

md

**When to use** — "reorganize/rewrite the logic" · "rebuild the contracts from scratch" · "rewrite the architecture/structure/interface docs"; or call `/reorganize-logic`.
**Not for** — incremental doc sync / session cleanup (→ neat, the sharpest boundary: this skill DELETES legacy rather than keep-and-sync); designing an agent loop (→ loop-constructor); editing the implementation code (it rebuilds the contract/doc layer, not the logic); a greenfield project with no existing contracts (nothing to clean).

**Install** — `npx skills add VincentJiang06/skills` (or `cp -R skills/reorganize-logic ~/.claude/skills/`).

Full spec: [SKILL.md](SKILL.md)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to install the skill via npx skills add VincentJiang06/skills without pinning a specific version or immutable source. That creates a supply-chain risk: future upstream changes or a compromised package/source could alter what gets fetched and installed, and users following the documented command would implicitly trust the latest remote content.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

md

**什么时候用** —— 「reorganize/重写 logic」·「从代码重新推导一套契约」·「重写架构/结构/接口文档」；也可用 `/reorganize-logic` 显式调用。
**不适用** —— 增量同步 / 会话收尾（→ neat，最锐的边界：本 skill 会*删*遗留，不是保留并同步）；设计 agent loop（→ loop-constructor）；改实现代码（重建的是契约/文档层，不是逻辑）；没有既有契约的全新项目（无可清理）。

**安装** —— `npx skills add VincentJiang06/skills`（或 `cp -R skills/reorganize-logic ~/.claude/skills/`）。

完整说明见 [SKILL.md](SKILL.md)。

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

md

**什么时候用** —— 「reorganize/重写 logic」·「从代码重新推导一套契约」·「重写架构/结构/接口文档」;也可用 `/reorganize-logic` 显式调用。
**不适用** —— 增量同步 / 会话收尾(→ neat,最锐的边界:本 skill 会*删*遗留,不是保留并同步);设计 agent loop(→ loop-constructor);改实现代码(重建的是契约/文档层,不是逻辑);没有既有契约的全新项目(无可清理)。

**安装** —— `npx skills add VincentJiang06/skills`(或 `cp -R skills/reorganize-logic ~/.claude/skills/`)。

完整说明见 [SKILL.md](SKILL.md)。

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to install from a remote source via npx skills add VincentJiang06/skills without pinning a specific immutable version or commit. That creates a supply-chain risk: future changes to the package/repository could alter what gets installed, and users following the documentation may fetch unreviewed code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown states the skill was 'Specialized ... for Claude 4.8 in Claude Code' and replaces vendor-neutral wording with 'Claude', which is a natural-language policy constraint affecting platform/model choice. The file does not present this as a user-selectable option or clearly justify it as a necessary region/compliance limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The README presents Chinese as the active/default language and only links out to an English version, which can be read as a fixed language choice in the skill description. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.