maozedong-founder-coach（毛泽东思想式创业教练）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:28 AM UTC
• Version: 1.0.0

Overview

This business-coaching skill is mostly disclosed advice content, but it grants file, shell, editing, and network tools that its conversational purpose does not need and uses broad trigger phrases that could invoke it unintentionally.

Review this carefully before installing. The advice content is visible and coherent, but the skill should not need shell execution, file editing, or network access for business coaching. Prefer a version with no tool permissions, or only tightly scoped tools with explicit user confirmation, and invoke it only when you intentionally want Mao-themed business strategy guidance.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:6

Finding

Unnecessary High-Risk Tool Permissions Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 6
Vulnerability Type: Excessive tool authorization
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: Read, Write, Edit, Bash, WebFetch

Technical Analysis

The skill is a documentation-only business coaching assistant. Its declared workflow consists of asking contextual questions and returning strategic recommendations and action items. This conversational functionality does not require filesystem access, file modification, shell execution, or outbound network access.

Nevertheless, the skill authorizes five powerful tools:

• Read can access local files available to the agent.
• Write and Edit can create or alter local files.
• Bash can execute operating-system commands within the agent's security context.
• WebFetch can communicate with external resources and retrieve remote content.

Granting these capabilities without a legitimate functional requirement violates the principle of least privilege. The reviewed instructions do not directly command malicious tool use, but the excessive authorization increases the consequences of malicious user input, indirect prompt injection, or future changes to the skill.

Attack Path

A plausible exploitation path is:

1. A user loads or invokes the skill, causing its broad tool authorization to become available.
2. The attacker supplies business context containing adversarial instructions or prompt-injected content.
3. The injected content attempts to persuade the agent that reading local files, running shell commands, modifying files, or contacting an external endpoint is necessary for its coaching task.
4. If the agent follows those instructions without adequate authorization checks, it invokes one or more of the unnecessarily permitted tools.
5. The attacker may obtain information exposed in tool output, cause unauthorized file changes, execute commands, or induce outbound communication within the permissions of the ...[truncated 800 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the allowed-tools declaration entirely if the platform treats an omitted declaration as no tool access.
2. Otherwise, replace it with an explicitly empty tool allowlist.
3. Do not grant Bash, Write, Edit, Read, or WebFetch because none is necessary for the documented conversational workflow.
4. If a future feature requires a tool, authorize only the narrowest tool needed for that specific operation.
5. Require explicit user confirmation before any future filesystem modification, command execution, sensitive file access, or outbound network request.
6. Apply host-level sandboxing, path restrictions, command allowlisting, outbound network controls, and sensitive-output filtering as defense-in-depth measures.
7. Reassess tool permissions whenever the skill's functionality changes, documenting the business justification for each granted capability.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill is described entirely in Chinese and presents Chinese-language interaction patterns without indicating that users may choose another language. This can create user-control and transparency issues by implicitly forcing language behavior, which may confuse users, degrade safety review quality, or cause the skill to respond in a language the user did not request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises 50+ broad natural-language trigger phrases such as generic startup and strategy questions that are likely to appear in ordinary business conversations. This can cause the skill to activate unintentionally, steering users into ideology-branded guidance when they did not explicitly request it and increasing the chance of prompt-routing collisions with other business skills.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is framed purely as a business-strategy coaching/advice assistant, yet it requests Write, Edit, Bash, and WebFetch. Those capabilities materially exceed what is needed for conversational coaching and increase the blast radius if the skill is invoked unintentionally or if downstream prompt injection causes tool use on local files, shell, or remote content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad, generic startup/business queries that many unrelated users could say, making accidental invocation likely. In combination with the skill's over-privileged tool access, this raises the chance that a user seeking ordinary advice is silently routed into a skill with unnecessary file, shell, and network capabilities.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The natural-language metadata presents the skill identity and description entirely in Chinese, with no indication that users may choose another language or locale. This can violate language-choice policy because it implies a fixed language experience without documented opt-in or region-specific justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This is a manifest file, so vague-trigger checks apply. The file marks the skill as user-invocable and gives only a generic argument hint of "[business-stage-or-challenge]" without any explicit trigger phrases, scope boundaries, or exclusion conditions, which makes it unclear when the skill should or should not be invoked.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.