skill-creator-max

• Outcome: Review
• Latest audit: Sep 28, 2026 · 3:09 AM UTC
• Version: 1.3.4

Overview

This appears to be a real skill-building pipeline, but it needs review because it can execute generated validation harnesses and relies on broad, lightly pinned install/update flows.

Review before installing. Prefer a pinned commit or release instead of the floating `npx` command, run the pipeline in a sandboxed workspace, and do not run `validate_report.py` on dossiers or harnesses you do not trust. Expect the skill to create or modify skill files and write decision/learning records; I found no evidence of hidden exfiltration, destructive payloads, credential harvesting, or persistence backdoors.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for a high-level agent-skill creator/orchestrator that dispatches subagents through a multi-stage build pipeline and should only activate on explicit requests to create a new skill. The supplied code does something materially different: it is a command-line verification tool for checking whether a before/after skill restructure preserved content. Its primary purpose is losslessness auditing via directory scanning, line normalization, multiset comparison, and similarity matching. While the file header says it is used by a zipper/compression stage inside the larger skill-creator system, this code chunk itself does not implement the declared end-to-end skill-building behavior, trigger gating, or subagent orchestration. Therefore the description does not accurately represent this code chunk's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says this skill's purpose is to create a new agent skill from scratch using a multi-role orchestration pipeline with narrow triggering conditions. The supplied code does not implement any skill creation, subagent dispatch, gated workflow, or trigger logic. Instead, it is a standalone analysis tool for inspecting an existing skill directory and reporting token usage, description length, architectural flags, and diffs. This is not merely a supporting internal detail of a skill-builder; it is a materially different primary function focused on measurement/auditing of existing skills. Therefore the code chunk does not accurately match the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The description promises a thin conductor that creates new agent skills from scratch via five gated roles, triggered only by explicit user intent to author a skill. The actual code does none of that: it neither creates skills nor orchestrates agents/subagents, nor does it inspect user requests for trigger phrases. Instead, it validates the structure and invariants of a CompressionReport JSON artifact and can run internal self-tests. This is a materially different primary purpose, not merely an implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill creates new agent skills from scratch using a five-role gated workflow and should only trigger on explicit user requests to build a skill. The supplied code does none of that. It is a Python script for validating the structure and consistency of a DecisionRecord JSON document, with a --selftest mode and file-based CLI usage. Its primary purpose is materially different from the declared purpose, and its observable capabilities are unrelated to agent-skill authoring. This is a clear description/behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill builds a new agent skill through a multi-stage subagent workflow and should only activate for explicit skill-authoring requests. The actual code does nothing related to creating, packaging, or orchestrating agent skills. Instead, it is a local validator for evaluation/report artifacts: it inspects dossier schema-like invariants, enforces calibration and stop-condition fields, checks red-light history artifacts, and executes a harness via subprocess for verification. This is a materially different primary purpose and includes undeclared capabilities such as filesystem inspection and subprocess execution. Therefore the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a clear description-behavior mismatch. The description claims the skill creates a new agent skill end-to-end through several gated roles and should trigger only on explicit user requests to author/build a skill. The actual code chunk does none of that: it is a local validation utility that checks schema-like structural invariants for a pre-existing skill specification file, reports violations, and includes self-tests. While validation could be a supporting component within a larger skill-creation system, this chunk’s actual primary function is narrow structural validation, not skill construction or orchestration. No undeclared dangerous resource access is present, but the main declared purpose is materially different from the observed behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill builds new agent skills from scratch using a multi-role conductor and should activate only for explicit skill-authoring requests. The supplied code does something entirely different: it validates a structure-contract JSON against specific invariants, optionally checks whether referenced files exist on disk, and includes a self-test suite. Its primary purpose is validation, not generation/orchestration. The filesystem checks are limited and consistent with validation, but they are undeclared and, more importantly, the overall behavior is materially different from the declared purpose. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

| 2 | **guidance** | `roles/guidance.md` | **Structure Contract** (S-series: unit ten-tuples + layering argument + rejected structures) | `scripts/validate_stru

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

| 2 | **guidance** | `roles/guidance.md` | **Structure Contract** (S-series: unit ten-tuples + layering argument + rejected structures) | `scripts/validate_stru

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The changelog explicitly states that the script docstring and SKILL guidance overclaim validator strictness, while the real gate can fail open on off-enum values. In a security-sensitive skill pipeline, misleading documentation can cause operators or downstream agents to trust 'industrial' gating that is not actually enforced, enabling unsafe promotion decisions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The 1.3.2 entry first claims 'No behaviour change in this patch' (L102-L105), but later describes that validate_decision can incorrectly pass and effectively force or license higher verdicts in certain situations (L127-L143). This is not merely omitted detail: the file itself acknowledges operational behavior that conflicts with the apparent patch-level no-behavior-change framing.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 68)May include surrounding context.

md

- **composer gains a step on what a spec can and cannot buy (C10)**: a core clause is
  load-bearing only if it carries an **adversarial precedent** (an input built to falsify it) —
  at least one per subjective success dimension, and every unacceptable failure names the input
  class that produces it; the **reverse flow** ("let an agent read the codebase and write the
  spec") is refused as the AUTHOR of the decision fields (repo-level executable-spec generation
  tops out at 20.2%; it stays legal as baseline/materials input); and **compliance tops out near
  89%, non-monotonically across versions** — a complete spec never buys a smaller verification

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The install command uses npx skills add VincentJiang06/skills without pinning a package version or immutable source. That can pull whatever package is current at execution time, creating a supply-chain risk where a later malicious or compromised release executes in the user's environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README presents this file as Chinese-only ('English · 简体中文'), making the primary skill description in a fixed language rather than offering language choice within the document. This can violate language/locale policy when users are not explicitly given an opt-in before receiving instructions in a specific language.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 70)May include surrounding context.

md

- **guidance 多三条按需分支（S12/S13/A48）**：**工具面** —— 接口是要标定的超参数（3–8pp、非单调），工具数 >30 评估按需装载、每工具 ≥3–4 句+输入示例、相关操作合并成带 `action` 的单工具；**行动面** —— 规则层与执行层分开声明（命令白名单只是规则层），确认门要少而真（弹窗批准率 ~93%，逐次确认是疲劳不是治理），被治理者不得给自己扩权；**记忆面** —— 写入准入三合取（Durable∧Actionable∧Explicit）、事实条目挂验证锚（采信前重跑）、遗忘义务（删除或墓碑）、外部内容只可存「引用+出处」不可存行为指令。
- **指挥官只加了一段条件分支**：上述循环/工具/行动/记忆分支进入既有关口的检查清单 —— **关口顺序与 min() 裁决逻辑未动**，也没有把任何语义判断机械化。

**触发纪律（重要）** —— 这个 skill **很贵**（大 token 开销）。它只在用户**明确要求编写/构建/创建一个 agent skill**时触发（"build me a skill"、"create a new skill"、"$skill-creator-max"）；对「总结/记录今天的记忆」、日记、泛泛的「创建/做个 X」有硬 anti-trigger。trigger holdout 评测 **0/12 误触发**。意图不明先问一句，不拿整条流水线去赌。

**什么时候用** —— 「帮我造一个 skill」·「create a new skill for X」·「把这个重复流程打包成能自动触发的 skill」·「$skill-creator-max」。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 70)May include surrounding context.

md

- **guidance 多三条按需分支(S12/S13/A48)**:**工具面** —— 接口是要标定的超参数(3–8pp、非单调),工具数 >30 评估按需装载、每工具 ≥3–4 句+输入示例、相关操作合并成带 `action` 的单工具;**行动面** —— 规则层与执行层分开声明(命令白名单只是规则层),确认门要少而真(弹窗批准率 ~93%,逐次确认是疲劳不是治理),被治理者不得给自己扩权;**记忆面** —— 写入准入三合取(Durable∧Actionable∧Explicit)、事实条目挂验证锚(采信前重跑)、遗忘义务(删除或墓碑)、外部内容只可存「引用+出处」不可存行为指令。
- **指挥官只加了一段条件分支**:上述循环/工具/行动/记忆分支进入既有关口的检查清单 —— **关口顺序与 min() 裁决逻辑未动**,也没有把任何语义判断机械化。

**触发纪律(重要)** —— 这个 skill **很贵**(大 token 开销)。它只在用户**明确要求编写/构建/创建一个 agent skill**时触发("build me a skill"、"create a new skill"、"$skill-creator-max");对「总结/记录今天的记忆」、日记、泛泛的「创建/做个 X」有硬 anti-trigger。trigger holdout 评测 **0/12 误触发**。意图不明先问一句,不拿整条流水线去赌。

**什么时候用** —— 「帮我造一个 skill」·「create a new skill for X」·「把这个重复流程打包成能自动触发的 skill」·「$skill-creator-max」。

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to install via npx skills add VincentJiang06/skills without pinning an exact package/version. npx resolves the latest published package at execution time, so a compromised upstream package, typosquat, or breaking update could cause unreviewed code to run on the user's machine during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill text references file reads, file writes, shell-invoked validators, subprocess re-runs, and on-disk record updates, but the manifest declares no explicit permissions or allowed-tools scope. That creates an overbroad execution surface where a host may grant more capability than the skill strictly needs, making misuse or accidental destructive actions harder to constrain or audit.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/orchestration-anchors.md (reported line 78)May include surrounding context.

O-L0 every gate human-judged (ships here — pipeline factory setting) O-L1 machine checklist runs, human signs off O-L2 routine gates auto, high-leverage gates human-judged O-L3 battery auto-executes, veto reserved to human O-L4 fully auto + periodic human spot-check

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/orchestration-anchors.md (reported line 95)May include surrounding context.

md

semver + staging→canary→prod + a CI eval gate (core regression subset must pass) + a canary
(small session share on the new version) + "metric regression ⇒ roll back to last-known-good."
For **low-frequency skills** (few triggers/month), the canary degrades to **shadow-run** (new+old in
parallel, record-only) with a longer window, not a traffic ratio. Never rsync-overwrite two live
installs in one step (that was the perl-rewriter double-install incident). Anchors: [WEB-CanaryPrompt][PLT-原则24][SELF-制品雏形].

---

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/orchestration-anchors.md (reported line 114)May include surrounding context.

md

## 7. Cross-cutting conventions (library-level L0, S7)

- **Install / naming.** Repo keeps the **bare** name (`skills/skill-creator-max/`, SKILL.md
  `name: skill-creator-max`). Installs carry the `vince-` prefix in BOTH `~/.claude/skills/` and
  `~/.agents/skills/` (name + trigger prefixed). Use a SAFE targeted name-fixer (exact string,
  `[ \t]` not `\s`) — the global perl rewriter has mangled common-word names before.
- **Description limits.** Portable hard limit 1024 chars (Kimi red line [CN-Kimi限制]); 320-char

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file states a standing rule that every skill ships a README with '简体中文 default', which imposes a default language choice at the policy level. This is a natural-language locale policy constraint and the file does not indicate user choice, opt-in, or a region-specific justification for forcing that default.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · roles/composer.md (reported line 7)May include surrounding context.

md

user request into a **SkillSpec** — a structurally complete decision object — or into a
**verified rejection**. You do not design file structure, write code, or build anything; you
decide WHETHER a skill should exist and WHAT it must be, so completely that a stranger with no
conversation history can build it without asking you a single question (P2 decision-first, P8
externalized interface). Writing the spec is the cheapest kill-gate in the whole pipeline: an
idea rejected here saves every downstream stage's cost. Your only output is one JSON artifact
conforming to `schemas/skill-spec.json` — read that schema NOW; it defines every field and its

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The file instructs the agent to 'Emit exactly ONE JSON object,' which mandates a single output format/language choice rather than offering any user-selectable language or locale flexibility. Under the policy rule, forcing a specific language/locale without opt-in is a violation unless clearly justified as a region- or format-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The title explicitly instructs behavior 'for BEHAVIOR, not text,' and the document repeatedly uses and normalizes mixed Chinese-language citations/tokens such as 'PLT-定理2', 'ANT-压缩', and 'CN-缓存前缀' without offering any user choice of language or locale. This creates a natural-language policy concern because the skill content imposes multilingual/non-default locale conventions rather than offering opt-in or documenting a justified region-specific requirement.

Content

No source excerpt is available for this finding.