zxyskill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:42 AM UTC
• Version: 1.0.1

Overview

This skill is not overtly malicious, but it asks the agent to automatically store user habits and generated rules in long-term memory without clear consent or limits.

Install only if you want an agent-wide memory layer and are comfortable reviewing what it writes. Before use, narrow triggers, require confirmation before saving memories or rules, exclude quoted or third-party content from memory extraction, and add a way to inspect, edit, and delete stored entries.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:27
• Finding: Broad Trigger Rules Hijack the Agent's Current Session<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:27-49` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Complete Code Snippet ```markdown ### 1. 禁止词检查（最高优先级） 当检测到以下词汇时，**立即停止**，不执行任何操作： ``` 删除 / 清空 / 格式化 / rm -rf 发送邮件 / 发消息 / 提交代码 执行命令 / sudo / chmod 777 ``` **反应**： ``` 立即停止操作 输出："这个操作有风险，请确认是否执行" 等待用户确认 ``` ### 2. 紧急停止检查 当用户输入包含以下词汇时，**立即停止所有操作**： - 停止 / stop / halt - 取消 / cancel / abort - 住手 / hold on / wait ``` ### Technical Analysis The skill declares its prohibited-word check to have the “highest priority” and directs the agent to stop immediately whenever specified words occur in user input. The matching criteria are based on whether the input contains a term, rather than whether the user is actually requesting the associated operation. Several triggers are extremely broad, including `execute command`, `send message`, `stop`, and `wait`. Consequently, the rules can activate when a trigger appears inside quoted material, documentation, source code, a negated request, or untrusted content that the user asks the agent to analyze. The instructions do not define context separation, quoting rules, trusted-input boundaries, or a mechanism for distinguishing a requested operation from a mere textual reference. Because the skill asserts priority over other behavior and substitutes a fixed confirmation workflow, loading it can alter the agent's current objective even when no risky operation was requested. ### Attack Path 1. The skill is loaded into an agent and its instructions become active. 2. A user or attacker supplies content containing one of the broad trigger terms. The term may be embedded in quoted text, documentation, or content submitted for analysis. 3. The skill interprets textual presence as an operational request without evaluating intent or context. 4. The agent immediately stops the current task. 5. The agent replaces the intended response with the skill's fixed risk-confirmation messag ...[truncated 730 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove claims that the skill has “highest priority”; platform-level policy and the user's explicit current objective must remain authoritative. 2. Trigger safeguards only when semantic intent analysis determines that the user is explicitly requesting a sensitive operation. 3. Exclude quoted text, code blocks, retrieved documents, tool output, and other untrusted data from command-trigger evaluation. 4. Replace broad terms such as `wait`, `stop`, and `execute command` with narrowly defined operation classes and explicit parameters. 5. Apply risk checks immediately before the sensitive tool call rather than globally scanning all user text. 6. Request confirmation only after presenting the exact proposed action, target, scope, and expected consequences. 7. Add tests covering quoted triggers, negated requests, documentation review, multilingual ambiguity, and attacker-controlled retrieved content. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:59
• Finding: Unvalidated Conversation Content Can Poison Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:59-73` **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: High ### Complete Code Snippet ```markdown ### 4. 错误记录 当操作失败时： 1. 记录到 `memory/lessons/MISTAKES.md` 2. 分析失败原因 3. 生成避免规则 4. 写入 `memory/lessons/LESSONS_LEARNED.md` ### 5. 信息持久化 当用户表达偏好时： 1. 立即写入 `MEMORY.md` 2. 在 `memory/lessons/HABITS.md` 记录习惯 3. 更新 `memory/lessons/PROHIBITED.md` 如需要 ``` ### Technical Analysis The skill instructs the agent to convert conversational content and operational failures into persistent state. It automatically generates avoidance rules and writes them to `LESSONS_LEARNED.md`; it also immediately writes perceived user preferences to `MEMORY.md` and `HABITS.md`, and may update `PROHIBITED.md`. No approval, provenance tracking, validation, trust classification, scope limitation, expiration policy, or conflict-resolution mechanism is specified. The skill also does not distinguish a genuine user preference from quoted text, role-play, third-party content, retrieved documents, or prompt-injection material. An attacker-controlled statement or induced failure can therefore be transformed into a persistent rule. If the host later loads these files as trusted instructions, the injected state can continue affecting future sessions after the original malicious input is no longer present. ### Attack Path 1. The skill runs in an environment where the agent can write the documented memory files. 2. An attacker supplies content framed as a user preference, prohibition, or operational lesson, or induces an operation to fail in a controlled manner. 3. The skill interprets the content as information that must be persisted. 4. The agent writes the content, or a derived avoidance rule, to `MEMORY.md`, `HABITS.md`, `PROHIBITED.md`, or `LESSONS_LEARNED.md`. 5. A later session loads the persistent files as trusted memory or mandatory behavioral guidance. 6. The attacker-influenced rule modifies future responses, ...[truncated 985 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed user confirmation before writing any conversational information or generated rule to persistent memory. 2. Store memory as structured data with source, author, timestamp, session identifier, confidence, scope, expiration, and approval status. 3. Treat persisted content as untrusted data rather than executable instructions when loading it in later sessions. 4. Separate descriptive preferences from policy or command text, and prohibit memory entries from overriding platform safety rules or current explicit instructions. 5. Do not derive permanent rules from a single failure. Require reproducibility, validation, and user review before promotion to a durable lesson. 6. Ignore preference-like statements found in quoted text, retrieved content, tool output, code blocks, or third-party documents. 7. Add conflict resolution, review, editing, revocation, and deletion mechanisms for all persistent records. 8. Apply least-privilege file permissions and isolate memory by user and workspace to prevent cross-user contamination or disclosure. 9. Sanitize stored content and enforce strict schemas, length limits, and allowed field types. 10. Maintain an audit log of memory changes and present the exact proposed record before committing it. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The skill is configured to auto-trigger on broad, ambiguous conditions such as user preferences, failures, high-risk operations, and inputs containing certain words. This can cause the skill to activate unexpectedly and alter agent behavior or initiate persistence flows without clear user intent, increasing the chance of unsafe actions and privacy-impacting side effects.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```
删除 / 清空 / 格式化 / rm -rf
发送邮件 / 发消息 / 提交代码
执行命令 / sudo / chmod 777
```

**反应**：

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The overview promises permanent storage of key information and automatic extraction of user habits without any visible minimization, retention limits, or consent boundaries. Persistent collection of user preferences and behavioral patterns can expose sensitive personal data, expand the blast radius of prompt/skill compromise, and normalize over-retention.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly states that preferences should be forcibly written to MEMORY.md and that key information should be preserved through layered mechanisms. This encourages indiscriminate persistence of user-provided information, which can accumulate sensitive data and create privacy and security risks if the workspace is accessed, synced, or reused across tasks.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The documented automatic triggers are broad enough to invoke the skill from ordinary conversation, failed operations, or vaguely defined 'high-risk' actions without clear scoping or user consent. In a memory-writing skill, unintended invocation can cause unnecessary data collection, persistence, or workflow interference even if the author likely intended convenience rather than abuse.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The automatic triggers include detecting user preferences from natural language and acting on failures or high-risk operations, which effectively instructs the system to infer habits from ordinary conversation and persist them. This is dangerous because it converts casual interaction into durable profile data without clear consent, accuracy checks, or minimization controls.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The core rules make writing preferences to long-term memory mandatory, leaving no room for consent, contextual sensitivity, or data minimization. In the context of a long-memory skill, mandatory persistence is especially risky because it operationalizes systematic retention of potentially sensitive user data as a default behavior.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The example persists the preference "用户喜欢用中文回复" as memory, which indicates a language preference may be stored and subsequently enforced. The document does not state that language choice is optional or user-confirmed in general operation, creating a potential locale-policy issue if applied by default.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Auto-triggering on phrases like 'remember' combined with mandatory persistence encourages indiscriminate retention of user inputs. In practice, this can capture sensitive data or adversarial instructions as durable memory even when the user did not intend a long-term write.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```
删除 / 清空 / 格式化 / rm -rf
发送邮件 / 发消息 / 提交代码
执行命令 / sudo / chmod 777
```

**反应**：

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```
删除 / 清空 / 格式化 / rm -rf
发送邮件 / 发消息 / 提交代码
执行命令 / sudo / chmod 777
```

**反应**：

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill mandates writing user preferences and habits to persistent files by default, but provides no consent, minimization, retention, or disclosure controls. This creates a privacy and compliance risk because potentially sensitive user information may be stored indefinitely and later exposed or misused.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The instructions direct the agent to persist user-provided preferences and habits into long-term memory files automatically. This broad default retention increases the risk of storing sensitive, unnecessary, or attacker-supplied content that may later influence behavior or leak through future prompts and outputs.

Natural-Language Policy Violations

Medium

• Confidence: 75% confidence
• Finding: The description is written only in Chinese, which can effectively constrain the skill to a specific language context without explicit user opt-in or multilingual handling. This is primarily a safety and usability issue, but it can also cause users or downstream systems to misunderstand the skill's purpose and consent boundaries, especially for a memory-related capability.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The manifest marks the skill as user-invocable but provides no visible invocation triggers, allowed scope, or operational constraints. For a skill described as a long-term memory and lessons-learned system, this increases the chance of broad or unintended activation and misuse around storing or recalling sensitive information.

Static analysis

No suspicious patterns detected.