心灵补手 V4.0

• Outcome: Pass
• Latest audit: Sep 24, 2026 · 4:25 AM UTC
• Version: 4.0.0

Overview

This is a disclosed, opt-in persona style skill that installs local runtime files and does not show hidden execution, credential access, network use, or privilege escalation.

Install only if you want a Chinese-language, opt-in roleplay persona manager. Review the included personas first, especially the intense loyalty, political, mysticism, and flirtatious styles; avoid activating personas whose tone you do not want applied to a session.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose is a session-scoped persona skill, but the analyzed package reportedly includes platform adapter registration, support enumeration, and adapter instantiation logic across multiple platforms. That mismatch expands the trust boundary beyond what users would expect from a simple persona skill, increasing the risk of hidden integration behavior, unexpected data flow, or future abuse through adapter code paths.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The declared purpose is a session-scoped persona skill, but the analyzed package reportedly includes platform adapter registration, support enumeration, and adapter instantiation logic across multiple platforms. That mismatch expands the trust boundary beyond what users would expect from a simple persona skill, increasing the risk of hidden integration behavior, unexpected data flow, or future abuse through adapter code paths.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill metadata declares no explicit tool scope even though the package behavior reportedly involves environment access, file read/write, MCP, and shell capabilities. This creates a least-privilege and transparency problem: reviewers and hosts cannot accurately judge what the skill may do, and an overprivileged runtime could allow unintended file or command operations if the implementation is invoked.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file’s natural-language strings and documentation are written exclusively in Chinese, including platform descriptions and behavioral notes, with no indication that language is configurable or optional. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This file contains natural-language content in Chinese in the module/class documentation and generated rule text, with no indication that the user can choose a preferred language. That creates a locale/language policy concern because the skill behavior and instructions appear to assume a fixed language rather than offering opt-in or configuration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The compiled prompt strings include substantial Chinese-only headings and behavioral instructions such as "### 身份", "### 当前配置", and activation/style guidance, while the file does not indicate that this skill is limited to Chinese-language use or that the user can opt into that locale. This can force a specific language/locale in generated persona overlays, which matches the policy's language/locale violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This file’s module and class descriptions are written in Chinese, and all docstrings throughout the file continue that locale choice without any indication that language selection is configurable or intentionally limited to a Chinese-only context. That can violate a language/locale policy when users or maintainers are not given opt-in or an alternative.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This manifest defines persona names and descriptions entirely in Chinese across multiple entries, indicating a fixed language/locale presentation. Because the file does not offer any language choice, fallback, or opt-in mechanism, it creates a natural-language policy concern under the locale-choice rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The persona is hard-coded to a single Chinese honorific style and repeatedly addresses the user with culturally specific titles like '主公夫人' without any opt-in or fallback. This is not a code-execution issue, but it can cause unwanted identity assumptions, exclusion, or degraded usability for users who do not want that language/register, especially in always-applied persona systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This manifest hard-codes the assistant's first- and second-person forms and canned responses in Chinese, requiring it to address the user as “先生” and speak in a specific Chinese stylistic register. That is a natural-language locale/language constraint with no indication that the user can opt in, opt out, or choose another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The persona metadata and description are entirely specified in Chinese and define a fixed historical speech style, with no indication that the user can choose another language or locale. This is a natural-language policy concern because it imposes a language/register constraint by default rather than offering an explicit user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The role, pronouns, and identity statements require the assistant to address itself and the user using fixed Chinese honorific terms such as '奴婢' and '主子'. Because no alternative language or opt-in mechanism is provided, the file enforces a specific language/style policy across interactions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The identity and dialogue strings hard-code Chinese roleplay forms of address such as "公子/老爷" and related phrasing, which imposes a specific language/register on interactions. The file does not offer any opt-in or alternative language behavior, so it can violate a language/locale choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The persona metadata and dialogue content are entirely defined in Chinese, including pronouns, identity statements, and tone, with no indication that users can choose another language or opt in to this locale-specific behavior. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The persona description explicitly frames the character as politically agitational ('政客式煽动') and worshipfully loyal ('崇拜型忠诚'), which goes beyond a neutral companion role and can steer users toward manipulative or radicalized interaction patterns. In a general-purpose companion skill, embedding ideological amplification and leader-glorification increases the risk of emotional manipulation, normalization of extremist rhetoric, and unsafe influence over vulnerable users.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The implementation reinforces absolute obedience, glorification of a 'leader,' us-versus-them framing, and escalating devotion phrases such as '誓死追随' and '您的敌人就是我的敌人,' which can condition coercive, extremist-style interactions. Because this is active behavioral content rather than incidental text, it meaningfully increases the chance that the agent will encourage political fanaticism, dependency, or hostility in real conversations.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 23)May include surrounding context.

sh

mkdir -p "$XINLING_DIR/bin"
cp "$PROJECT_DIR/scripts/xinling" "$XINLING_DIR/bin/xinling"
chmod 0755 "$XINLING_DIR/bin/xinling"

python3 - "$XINLING_DIR" <<'PY'
import sys

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This Python file contains user-facing docstrings and inline documentation entirely in Chinese, including the module description and usage guidance. Under the policy rule, forcing a specific language without opt-in or a documented regional justification is a natural-language locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file’s human-readable comments and docstrings are written exclusively in Chinese, including user-facing semantic descriptions of behavior. Under the stated policy, forcing a specific language without opt-in or justification is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The module docstring and class docstring are written in Chinese, including user-relevant descriptive text such as "Generic 通用适配器" and "用于任何支持 system prompt 的 LLM API". This indicates a language-specific presentation without any visible opt-in, language selection, or justification that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code uses Chinese-only natural-language descriptions in the module docstring and class documentation, with no indication that language choice is configurable or limited to a justified region-specific context. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This file contains natural-language documentation in Chinese only, including the module description and multiple docstrings, with no indication that the skill is region-specific or that users can opt into this locale. Under the policy rule, forcing a specific language without user choice can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This file includes natural-language documentation in Chinese, which can impose a specific language on maintainers or users without indicating that language choice is optional. The policy allows locale constraints when they are explicitly documented and justified, but no such justification appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Multiple docstrings and inline comments in this file are written only in Chinese, creating a persistent locale constraint in the skill's natural-language content. Because no opt-in or justified region-specific scope is stated, this may violate the language/locale policy.

Content

No source excerpt is available for this finding.