Security audit

Wukong — 名人思维蒸馏框架（72变版）

Security checks for vulnerabilities and agentic risk

Overview

This markdown-only skill creates reusable celebrity-style thinking notes locally, with disclosed persistence and no hidden code or network behavior found.

Install only if you want the agent to create and reuse local persona-thinking notes. Review generated files before relying on them, avoid putting private or sensitive details into personas, and ask the agent to confirm before creating or updating wukong/personas or wukong/registry.md.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill advertises very broad trigger phrases such as '思维模型', 'Think Like', '像XX一样', and 'XX会怎么做', which are common in ordinary conversation and can cause unintended activation. In an agent setting, accidental invocation can lead to the model entering this skill flow unexpectedly, including producing persona-driven advice and initiating follow-on actions like file reads/writes described elsewhere in the skill.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to save outputs to 'wukong/personas/[人物名-领域].md' and update 'wukong/registry.md' without any consent, confirmation, or warning about persistence. This is dangerous because unintended or repeated activation could modify local files, create untrusted content on disk, overwrite existing persona data, or be abused through crafted names/inputs to produce unsafe file operations.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The phrase pattern for creating new personas is very broad and lacks clear authorization, validation, or scope constraints. In an agent skill that can create or update files under `personas/`, ambiguous triggers can be abused to cause unintended activation, unauthorized persona generation, or prompt-injection-style manipulation through user phrasing.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The example trigger phrases are semantically broad and overlap with normal conversational requests, making accidental or adversarial activation more likely. Because this skill supports arbitrary historical and public figures, vague examples can let an attacker steer the agent into generating untrusted personas or performing unintended workflow steps under the guise of ordinary discussion.

Static analysis

No suspicious patterns detected.