Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed agent-evolution aid, but it asks to automatically turn session content into persistent skills or memories using broad triggers and unclear write permissions.
Install only where agent evolution and persistent memory/skill creation are intentionally enabled. Require explicit user or admin confirmation before any write-back, restrict triggers to a dedicated command, redact sensitive session content, and reconcile the declared permissions with the actual write/search behavior before allowing automation.
The document is written as a Chinese-only instruction set and presents itself as the agent manual without indicating any language choice, opt-in, or locale justification. This can constitute a language/locale policy violation when a skill effectively forces a specific language for use or maintenance.
The trigger list is broad and semantically fuzzy, including generic phrases like '复盘', '进化', and '沉淀经验', which can match many normal user requests unrelated to this specific skill. In an agentic system, this increases the chance of unintended invocation, causing the agent to write memories, update records, or alter skill artifacts when the user did not explicitly request those side effects.
The trigger conditions are very broad, including generic phrases like '复盘', '进化', '沉淀经验', and '能力提升', plus automatic activation after '完成一单任务'. This can cause the skill to run in many unrelated contexts, leading to unintended persistence of data, inappropriate capability mutation, or workflow hijacking if an attacker deliberately uses those phrases to invoke the skill.
The trigger phrases include common terms such as 'review', 'evolve', and 'solidify experience', which can appear in ordinary conversation. Overly broad activation raises the risk that the skill runs on unrelated sessions and extracts or persists content the user did not intend to canonize, including sensitive operational details.
The automatic activation conditions are loosely defined around high-value tasks and detected intent, without clear boundaries, roles, or consent checks. In a self-modification/evolution context, that ambiguity increases the chance of unreviewed capability drift or unauthorized recording of session-derived behavior.
The manifest claims the skill has no network, filesystem, or subprocess access and runs as text-only, yet the documentation says it will write back evolution records and update a capability card. This mismatch can mislead operators and policy engines about the skill’s real side effects, creating a governance gap where write operations may be trusted or auto-approved under false assumptions.
The interface declares a text CLI entry with plain-text stdout, while the documentation describes JSON evolution records and automatic write-back. This contract ambiguity is dangerous because downstream agents or wrappers may parse or invoke the skill incorrectly, leading to unintended automation, silent failures, or accidental persistence of sensitive session data.
The English usage section says the skill can auto-activate via pre-hook or trigger words like 'agent-evolution' without sufficient scope limits. This enables accidental or adversarial invocation through prompt content, which is especially risky because the skill is designed to distill behavior into durable skill or memory artifacts.
The Chinese usage section repeats automatic activation from detected intent and trigger words, again without exclusions or safety gating. Because the skill handles session content and promotes it into persistent team knowledge, ambiguous activation can turn routine dialogue into unauthorized memory/skill creation and amplify prompt-injected or sensitive content across future runs.
The trigger phrases include very common natural-language terms such as “复盘”, “进化”, “沉淀经验”, and “固化经验”, which can easily appear in ordinary user requests outside the intended skill scope. This can cause the agent to invoke the skill unexpectedly, leading to unintended memory/skill creation or modification of evolution records based on irrelevant or attacker-crafted prompts.
The package name at L03 is written in Chinese, which can reflect a language-specific constraint in user-facing metadata. Because this manifest provides no opt-in, alternative locale, or justification that the skill is region-specific, it may violate the language/locale policy for natural-language content.
No suspicious patterns detected.
