Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 文档与理论文本 | 本 `SKILL.md`、`README.md`、其中「理论依据」段与一切理论表述 | **不在 MIT 覆盖范围内**：保留所有权利（All rights reserved） |
Security audit
agent-learn-external-skill
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a documentation-only external skill comparison workflow, but it grants file-writing authority despite repeatedly describing itself as read-only.
Review this before installing if you expect a strictly read-only skill. The main issue is not malicious code, but that the skill grants Write even though its own description says it should only read and compare external skills. Prefer installing only after Write is removed or clearly limited to explicit user-approved edits.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is explicitly described as a read-only external-learning workflow, but it requests the Write tool, creating a capability mismatch between stated behavior and actual privileges. This expands the attack surface because an agent invoking the skill may assume non-mutating behavior while the skill can still alter local files or artifacts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger keywords are extremely broad and generic, increasing the chance that the skill activates in contexts unrelated to its intended purpose. Overbroad activation can cause accidental invocation of a skill with unnecessary privileges, especially when combined with tools like Write or WebSearch.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation claims the package is purely documentation with no independent code files, yet the manifest declares operational capabilities including Write and WebSearch. That inconsistency can mislead reviewers and downstream agents about the skill's real operational reach, increasing the chance of unintended outbound access or file changes under a seemingly passive package.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest includes many broad trigger phrases such as comparative and benchmarking requests that can overlap with normal user intent, increasing the chance this skill is invoked when the user did not explicitly request this workflow. In a skill that analyzes external packages, unintended activation can steer conversations toward external-skill comparison behavior and potentially bypass more appropriate or narrower tools.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The leading policy-like notice is written in Chinese and imposes important usage constraints before the English MIT text, but the file does not offer an alternate language choice or explain a justified locale restriction. Under the stated policy, forcing a specific language for operationally relevant instructions can be a natural-language policy concern.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This markdown file includes a scoped applicability statement that says the MIT license applies only to
.pyfiles while other listed documents are excluded, but it does not clearly define how mixed-content files or other file types in the package should be treated. Because SQP-1 applies to markdown files, this broad scope language may create ambiguity about when the stated license terms do and do not apply.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The natural-language description and example invocations are presented entirely in Chinese, while also including some English trigger terms, but there is no statement that the skill supports multiple languages or that Chinese is an intentional user-selected locale. This can create a language-policy issue if the skill effectively assumes a specific language without opt-in.
- Content