Poetry

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:03 AM UTC
• Version: 1.0.1

Overview

This is a coherent Chinese classical poetry skill with a disclosed dataset download step and no evidence of credential access, persistence, exfiltration, or destructive behavior outside its own data folder.

Before installing, be aware that setup.sh downloads a large public dataset from GitHub and does not pin or verify the exact revision. This is not evidence of malicious behavior, but users who need reproducible or high-integrity results should pin a reviewed commit or verify the dataset themselves.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: setup.sh:19
• Finding: Mutable and Unverified Dataset Dependency## Vulnerability Details **File Location**: `setup.sh`, line 19 **Vulnerability Type**: Unpinned and unverified third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash git clone --depth 1 https://github.com/chinese-poetry/chinese-poetry.git "$DATA_DIR" ``` ### Technical Analysis The setup script clones the current default branch of a third-party GitHub repository without pinning a reviewed commit, tag, or release and without validating a cryptographic checksum or signature. The installed dataset can therefore change after this skill has been reviewed. Although the script does not execute files from the downloaded repository, it treats the downloaded corpus as trusted input for later poetry queries and generation. A compromised upstream repository, maintainer account, or distribution path could introduce manipulated or adversarial corpus content. The subsequent deletion of the `.git` directory also removes useful provenance information that could otherwise help determine the installed revision. This is a supply-chain integrity weakness rather than direct remote code execution. ### Attack Path 1. An attacker compromises the upstream repository or an authorized maintainer account. 2. The attacker modifies content on the repository's default branch. 3. A user runs `./setup.sh`. 4. The script shallow-clones the mutable default branch without checking an expected commit or checksum. 5. The downloaded content is accepted and stored in `data/`. 6. The agent later consumes the manipulated corpus during poetry queries or as reference material for generated responses. ### Impact Assessment The attacker does not obtain operating-system privileges through the code shown because the downloaded files are not executed. The direct impact is limited to the integrity and reliability of the skill's dataset and resulting responses. Potential effects include corpus poisoning, inaccurate attribution or text, manipulated query output, and exposure of the ag ...[truncated 186 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to a reviewed immutable commit SHA rather than cloning the current default branch. 2. Fetch that specific revision and verify that the checked-out commit exactly matches the approved SHA. 3. Prefer a versioned archive with a published SHA-256 checksum or a cryptographically signed release. 4. Fail closed when signature, checksum, or commit verification fails. 5. Maintain an allowlist or manifest of expected dataset paths and reject unexpected executable files, symbolic links, or other unapproved content. 6. Record the installed revision and verification result in a local provenance manifest before removing Git metadata. 7. Periodically review and deliberately update the pinned revision rather than accepting upstream changes automatically.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Clean up unnecessary files
echo "🧹 Cleaning up unnecessary files..."
rm -rf "$DATA_DIR/.git" \
       "$DATA_DIR/.github" \
       "$DATA_DIR/.gitignore" \
       "$DATA_DIR/.travis.yml" \

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The prompt is entirely written as a Chinese-only operating specification and defines the assistant as a specialist in Chinese classical poetry, but it does not state that the user may choose another language for interaction or output. This can violate language/locale policy when a skill implicitly forces a specific language without offering opt-in or an alternative.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The generation-mode trigger is defined with broad natural-language cues such as any expression that suggests creative intent, which can cause the skill to activate on loosely related requests. In an agent environment, this raises prompt-routing and capability-confusion risk: ordinary conversation may be incorrectly steered into poem generation, leading to unintended behavior and reduced reliability.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The query-mode activation rules include open-ended patterns like any natural language implying a search for poetry, which are insufficiently constrained. This can lead to accidental invocation, incorrect tool selection, or retrieval behavior on requests that were not intended for this skill, especially in multi-skill agent systems.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The natural-language description and examples are presented entirely in Chinese, and the skill does not state that language is user-selectable or limited to a justified region-specific context. This can constitute a language/locale policy issue because it implicitly forces a specific language without opt-in.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation rules use very broad natural-language phrases such as '写诗', '找诗', and similar implied intents, which can cause the skill to trigger outside a narrowly scoped poetry workflow. Over-broad activation increases the chance of accidental invocation, prompt hijacking of unrelated conversations, or unintended handling of user requests that were not meant for this skill.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The README presents all user-facing instructions, examples, and operational guidance exclusively in Chinese. Under the stated policy, forcing a specific language without giving users a language or locale choice can be a natural-language policy violation unless the locale restriction is clearly documented and justified.

Static analysis

No suspicious patterns detected.