Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
该文件整体描述、触发词和输出示例均默认以中文为中心，没有说明是否支持根据用户偏好切换语言。按规则，若技能隐含强制特定语言而未提供用户选择或明确合理限定，属于自然语言策略风险。
- Content
Security audit
Wave Project Evaluator
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent project evaluation and improvement guide, with repository changes and saved reports disclosed as part of its workflow.
Before installing, understand that this skill may inspect a project, propose and apply edits, create commits, revert changes, run validations, and save evaluation reports. Use it on repositories where those actions are acceptable, and require a clear preview before allowing any write, commit, revert, or saved report.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include broad, ordinary expressions such as project review/项目评分, increasing the chance the skill activates in contexts where the user did not intend repository inspection or modification. Because this skill can progress beyond assessment into edits and git operations, accidental activation is more dangerous than for a read-only skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is presented as an evaluator, but its workflow explicitly includes modifying project files, creating commits, and reverting history. This expands the capability from analysis into repository mutation, which can surprise users and cause unintended changes if the skill is invoked for what sounds like a read-only health check.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Mandating git commit and git revert introduces non-obvious write operations to version control metadata and project history. In a skill meant for project evaluation, these actions are higher-risk because they can alter audit trails, trigger hooks/integrations, or disrupt a user's intended workflow without strong necessity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill includes modification behaviors—editing code/documentation, writing reports, committing, and reverting—but does not present a prominent risk disclosure near the top-level description. Users may reasonably assume a health-check skill is observational, so missing warnings materially raises the risk of uninformed consent and accidental repository changes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The usage examples describe a wide range of natural-language requests without strong disambiguation, which increases misrouting risk. Given the skill's ability to edit files and manipulate git state, ambiguity in when it should activate can lead to unintended side effects from casual requests.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Writing reports into memory/project-evals introduces persistent storage outside the immediate conversational output, but that archival behavior is not clearly declared in the manifest. This can leak sensitive project details into a retained location and violates the principle of least surprise for an evaluation skill.
- Content
Static analysis
No suspicious patterns detected.