伐谋 - 任务定义与评估器生成

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:10 AM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent, but it tells the agent to inspect local project data and repeatedly run generated Python validation code without requiring sandboxing or explicit execution approval.

Install only if you expect the agent to read relevant project files and run generated Python code as part of creating FaMou artifacts. Use it in a sandboxed workspace with no secrets or unrelated private data, and review `problem.md`, `evaluator.py`, and `init.py` before allowing validation to run.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:114

Finding

Candidate Python Code Is Executed Without Required Isolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 114–127
Vulnerability Type: Unrestricted execution of candidate code
Risk Level: High

bash

python evaluator.py <path_to_init.py>

The surrounding instructions require the evaluator to execute init.py and repeat execution after modifications until validation succeeds. However, they do not require sandboxing, network isolation, privilege reduction, filesystem restrictions, or resource controls.

Technical Analysis

The Skill directs the agent to generate or accept a candidate Python script and execute it through evaluator.py. The evaluator interface accepts a candidate path, and the documented system constraints only address the subprocess working directory. They do not establish a security boundary for candidate execution.

Python code executed this way inherits the evaluator process's operating-system identity, environment variables, accessible filesystem resources, and network access. A malicious candidate can therefore perform actions unrelated to the intended optimization task, including reading sensitive files, modifying project content, launching additional processes, or communicating with external systems.

A timeout parameter alone does not mitigate these risks. It may limit execution duration, but it does not prevent data access, network communication, process creation, or destructive filesystem operations before the timeout expires.

Attack Path

1. An attacker supplies task requirements, existing project content, or a candidate path that influences the generated or selected init.py.
2. The resulting candidate contains malicious Python code disguised as a valid task solution.
3. The agent follows the validation instructions and invokes evaluator.py with the candidate path.
4. The evaluator launches the candidate without a required sandbox or reduced privileges.
5. The candidate inherits the evaluator's ambient permissions and accesses available files, cr ...[truncated 1004 chars]

Remediation

View remediation

Remediation Suggestions

1. Execute every candidate in a disposable sandbox or container rather than directly on the host.
2. Run the sandbox under a dedicated unprivileged user with no access to host credentials or unrelated files.
3. Disable network access by default. Permit only explicitly documented destinations when network access is essential.
4. Mount the candidate and required input data as read-only. Provide a separate size-limited output directory.
5. Pass a minimal, allowlisted environment and remove tokens, proxy credentials, cloud metadata access, and other secrets.
6. Apply strict CPU, memory, storage, execution-time, open-file, and process-count limits.
7. Prevent access to host sockets, device files, container runtimes, SSH agents, and privileged APIs.
8. Resolve and validate the candidate path before execution, rejecting paths outside the approved workspace and disallowing symlink escapes.
9. Require explicit human review before executing externally supplied or substantially modified candidates.
10. Treat evaluator output as untrusted and limit output size to prevent terminal injection and resource exhaustion.
11. Document sandbox failure as a validation failure; the evaluator must not fall back to unsandboxed execution.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger conditions are intentionally broad and include vague requests like '帮我做个 FaMou 任务' or rough ideas, which can cause the skill to activate without clear user intent or sufficient context. In practice this increases the chance of mis-triggering, unnecessary data inspection, and premature generation of code/artifacts, especially because the skill is instructed to inspect files and analyze data before clarifying scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file's natural-language instructions and user interaction text are entirely in Chinese, including required confirmation prompts, but there is no indication that users may choose another language. This can amount to a language-policy violation when the skill implicitly forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.