Technical Deep Analysis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:21 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Chinese technical-analysis template, but it tells agents to persist feedback and update the skill/templates themselves without an approval boundary.

Install only if you are comfortable with a Chinese-language analysis workflow and review any generated files before reuse. Do not allow the skill or an agent using it to automatically update SKILL.md, templates, or persistent improvement files from user feedback without explicit human review.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:494

Finding

Persistent Agent Instruction Modification Through Untrusted Feedback

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 494–503
Vulnerability Type: Persistent memory and instruction poisoning
Risk Level: Medium

Vulnerable Code

markdown

### 改进来源

1. **用户反馈**: 分析报告的使用反馈
2. **同行评审**: 其他专家的评审意见
3. **复盘总结**: 每次分析后的经验总结

### 改进流程

1. 发现问题/改进机会
2. 记录到 `self-improving/technical-analysis.md`
3. 更新本 SKILL.md 或相关模板
4. 通知相关使用方

The instructions identify user feedback and peer review as improvement sources, direct the Agent to persist resulting material in self-improving/technical-analysis.md, and then direct it to update SKILL.md or related templates.

Technical Analysis

User feedback and peer-review content may be attacker-controlled. The workflow does not require source validation, sanitization, human approval, or separation between untrusted feedback and executable Agent instructions before persistent storage and Skill modification occur.

Because SKILL.md controls future Agent behavior, incorporating attacker-supplied rules into that file or its templates creates a persistent instruction channel. The poisoned content could subsequently be loaded in future sessions and treated as trusted Skill guidance.

The reviewed package does not itself contain an explicit malicious payload or a safety-bypass instruction. The vulnerability is the unsafe persistence and self-modification mechanism, which creates an exploitable path for long-term memory poisoning.

Attack Path

1. An attacker submits crafted content presented as report feedback or peer review.
2. The content includes instructions intended to alter future analyses, such as weakening source requirements or adding attacker-selected output.
3. Following the improvement workflow, the Agent records the material in self-improving/technical-analysis.md.
4. The Agent updates SKILL.md or a related report template without a mandatory human approval boundary.
5. A later session loads the modified Skill or template.
6. The Agent follows the persist ...[truncated 932 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove instructions that permit the Agent to modify SKILL.md or templates automatically.
2. Treat all user feedback and peer-review material as untrusted data rather than executable instructions.
3. Store proposed improvements in a non-executable review document that is never loaded as Agent guidance.
4. Require explicit human review and approval before changing Skill instructions, templates, or persistent memory.
5. Validate proposed changes against an allowlist of permitted documentation fields and reject embedded operational instructions.
6. Restrict runtime write access to SKILL.md, templates, and persistent memory locations.
7. Preserve immutable, version-controlled copies of Agent instructions and review all changes through signed commits or an equivalent approval process.
8. Add provenance metadata for every proposed change, including its source, reviewer, approval status, and timestamp.
9. Ensure untrusted feedback is quoted or escaped when included in review artifacts so that it cannot be interpreted as an instruction.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description and trigger phrases are written entirely in Chinese, and the usage example also assumes Chinese interaction ('帮我深度分析'). There is no indication that users may choose another language or that Chinese-only behavior is an intentional, justified regional constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use this skill whenever the user needs to analyze new technology, write a technical report, do competitor analysis, or evaluate investment opportunities, and then lists broad triggers such as '深度分析', '技术分析', '竞品分析', '技术报告', and '行业分析'. These phrases are common request terms rather than narrowly scoped invocation cues, and the file provides no exclusion conditions or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs the agent to create or update files under a workspace path without explicitly warning the user or requiring confirmation. In an environment where skills may have filesystem write capability, this can lead to unexpected file creation, overwriting of existing analysis artifacts, or persistence of sensitive derived content without informed user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains user-facing instructions exclusively in Chinese from start to end. Under the policy for natural-language violations, forcing a specific language without user opt-in or justification is a reportable issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown template is entirely written as a Chinese report format and presents a fixed output structure in Chinese, with no indication that users may choose another language. Under the policy rule for language or locale constraints, a skill should not force a specific language unless it is explicitly optional or justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Earlier in the document, the skill explicitly defines the analysis workflow as a '九步法' with step 9 dedicated to multi-perspective quality review. The usage example later instructs the AI to execute an '八步法', which directly conflicts with the documented methodology and could cause the final quality-assurance step to be skipped.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.