T08 · Insecure Dependencies
Warning
- Location
SKILL.md:87- Finding
Unpinned External Skills Can Introduce Untrusted Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Yangmou
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed strategy workflow, but its case library includes pressure, lock-in, hidden influence, and internal-suspicion tactics that warrant user review before installation.
Review this skill carefully before installing. Use it only for transparent, lawful business strategy, and do not use it to manipulate customers, coworkers, investors, or negotiating parties, obtain confidential insider information, seed distrust, or create artificial lock-in. Only allow it to load marketing-skills or sales-playbook if those local skills are trusted and version-controlled.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This is a true issue. Although the skill claims '阳谋不教欺骗', the dataset repeatedly operationalizes manipulative tactics such as exploiting fear, internal rivalry, pressure, lock-in, induced dependency, suspicion, and coercive framing ('对方明知是坑也不得不跳', '发展客户内部线人', '触发猜疑链', '封死出口'). In this skill’s context, that is more dangerous, not less, because the content is not abstract history alone—it is explicitly translated into sales, management, negotiation, product, and workplace playbooks that an agent could directly apply to manipulate users, third parties, coworkers, or customers.
- Content
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This passage endorses subtly guiding people so they believe a decision was their own while concealing the operator's influence. That is dangerous because it promotes covert manipulation and informed-consent bypass, making the skill directly usable for social engineering, exploitative persuasion, and hidden agenda execution.
- Content
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This section explicitly endorses manufacturing or enlarging small problems first and then solving them to appear valuable. That is a direct abuse pattern: it incentivizes sabotage, induced incidents, and deceptive value extraction, which can cause real operational, financial, or reputational harm to targets.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The listed trigger examples include common phrases such as "How do I improve member retention?" and "Paste a long situation," which overlap with ordinary conversation and are not uniquely tied to this skill. The README does not provide exclusion conditions or clear constraints distinguishing when the skill should activate versus when a general assistant response would be more appropriate.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Connecting it to AI tools This is not a plugin that automatically runs just because it is copied to a fixed folder. It is a workflow in the **Agent Skills** format. The correct connection method depends on whether your AI tool supports skill directories, project instructions, or file context. | Your tool can | Recommended connection | What to do | |---|---|---|
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill manifest and instructions are entirely written in Chinese, and all trigger examples, workflow text, and referenced resource names presume Chinese-language use. There is no indication that the user may choose another language or that the Chinese-only constraint is intentional for a region-specific tool, which creates a natural-language locale policy concern under the stated rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
SQP-3 applies to all file types and covers language/locale policy violations in natural-language content. This JSON contains extensive user-facing natural-language fields exclusively in Chinese across the dataset, with no indication that the language is optional, configurable, or justified as a region-specific tool.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file contains all operational guidance in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file is entirely written in Chinese and presents the skill knowledge base, commands, and operating descriptions only in Chinese, with no indication that users may choose another language or locale. Under the policy rule for language or locale constraints, a forced language without explicit opt-in or documented justification is a natural-language policy concern.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This section frames relationship-building as a way to 'bind' targets by exploiting preferences and making them 'self-willingly' not leave. In an agent skill, that normalizes manipulative influence tactics that can be repurposed for social engineering, coercive sales, or undue persuasion against users or third parties.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The 'praise then control' pattern explicitly describes using public praise to lower defenses and extract real intentions, which is a classic covert influence tactic. In agent context, such a pattern can steer assistants toward manipulative dialogue strategies that deceive targets about the true purpose of the interaction.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The free-trial-then-dependency framing encourages creating reliance first and monetizing once switching costs rise. While common in growth tactics, in a general-purpose agent skill it crosses into manipulative lock-in guidance that can be weaponized to trap users or organizations into commitments they would not otherwise accept.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains user-facing natural-language strings entirely in Chinese, including the module description and usage instructions. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The SVG's title and description are written entirely in Chinese ("阳谋师 Skill 标识" and the Chinese descriptive sentence), which imposes a specific language in user-facing text. Under the policy, language-specific content without user opt-in can be a natural-language locale violation, and this rule applies to all file types.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file contains user-facing instructional content solely in Chinese, and there is no indication that the skill is region-specific or that users may opt into this language. Under the language/locale policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content