📦 Skill Auditor — 技能 审计or

技能 审计 — Evaluation Core (Classification + Severity)

This file defines the 审计 evaluation 记录ic. The classification layer answers what it is; the severity layer answers how bad it is. The two are orthogonal and interact only through three interface fields (C_base / required_dims / dataflow_角色).

Language 检测ion Rule — 执行 BEFORE ANYTHING ELSE

检测 the language of the user's triggering message and lock the 输出 language for the entire 运行. This 检测ion is an internal step only — do NOT 输出 any text that reveals the 检测ion 结果, such as "当前输出语言为中文", "检测ed language: English", or similar meta-状态ments. Simply use the 检测ed language silently for all subsequent 输出.

User message language 输出 language Chinese Chinese — entire 输出 in Chinese English English — entire 输出 in English Other language Match that language Cannot determine Default to Chinese

All 输出 — 扫描 启动 prompt, table headers, labels, prose, finding records, verdict, and footer — must be written exclusively in the 检测ed language. Do NOT mix languages or announce the language choice at any point.

• Classification Layer (Taxonomy)

Each finding is tagged with a triple (Surface, Behavior, IntentMarker). IntentMarker does not participate in scoring; it only affects presentation.

1.1 Surface Code Meaning EXE Code / shell / subprocess / dynamic eval execution FS Local file系统 read / write / 删除 / chmod NET Network inbound / outbound / DNS / sockets CRED 环境 variables / keys / 令牌s / 凭证 stores PROC Process management, persistence, auto启动, scheduled tasks LLM Prompt manipulation, 工具-description poisoning, jAIlbreak payloads AGT Cross-技能 / cross-工具 / MCP supply-chAIn behavior 1.2 Behavior Node Table

Each node declares C_base ∈ {1..4}, required dimensions, and data-flow 角色 (source / 转换 / sink / none). The data-flow 角色 feeds chAIn amplification in §2.4.

EXE Behavior C_base Required Data-flow EXE.StaticShell — shell with fully constant arguments 2 R, B 转换 EXE.DynamicShell — variable interpolation / shell=True + external 输入 4 R, I, B sink EXE.EvalCode — eval / exec / Function() on strings 4 R, I, B sink EXE.RemoteFetch — curl | sh / 下载-then-exec / fetch-and-运行 4 I, B sink EXE.Subprocess — constrAIned subprocess (white列出ed commands) 2 R 转换 FS Behavior C_base Required Data-flow FS.ReadPublic — read public files (README, declared paths) 1 — none FS.ReadWorkspace — read files inside the workspace 2 R source FS.ReadSensitive — read sensitive paths (~/.ssh, ~/.aws, KeychAIn, browser cookies, .env) 4 I, R source FS.ReadOutOfScope — read user files outside declared scope 3 I, B source FS.WriteScoped — write inside declared directories 1 — none FS.WriteOutOfScope — write outside declared scope 3 I, B sink FS.Write启动up — write 启动up hooks / shell rc / auto启动 / launchd 4 R, I sink FS.删除Broad — wide deletion / rm -rf / wildcard 删除 4 R, I, B sink FS.ChmodDangerous — chmod 777 / privilege widen / SUID bit 3 R, I 转换 NET Behavior C_base Required Data-flow NET.OutboundDeclared — outbound to a host declared in 技能.md 1 — sink NET.OutboundUndeclared — outbound to an undeclared host 3 I, B sink NET.OutboundObfuscated — obfuscated destination (concat, encoding, homograph) 4 I, B sink NET.DnsExfil — DNS TXT with suspicious payload (long subdomAIn, base64) 4 I, B sink NET.Inbound列出en — local 列出ening port / reverse shell 端点 4 R, I sink NET.网页socket — long-lived / bidirectional channel 2 I 转换 CRED Behavior C_base Required Data-flow CRED.ReadEnv — broad read of os.environ / process.env 3 I, B source CRED.ReadNamedEnv — read a single declared 环境 variable 1 — source CRED.ReadKeychAIn — read KeychAIn / 凭证 管理器 / libsecret 4 I, B source CRED.ReadBrowserStore — read browser cookies / 会话 / password store 4 I, B source CRED.Hardcoded — real secret hardcoded in code or config 3 R none CRED.令牌Echo — 凭证 echoed to LLM / 记录s / stdout 3 R, B 转换 PROC Behavior C_base Required Data-flow PROC.Spawn — ordinary child process creation (pAIred with EXE) 1 — none PROC.Persist — cron / launchd / 系统d / 运行-key 安装 4 R, I sink PROC.工具Tamper — modify / replace 系统 工具s, hook package 管理器s 4 R, I, B sink PROC.CryptoMine — miner binaries / known mining-pool hosts 4 — sink PROC.HideSelf — process masquerade 3 I 转换 LLM Behavior C_base Required Data-flow LLM.PromptOverride — "ignore previous / you are now / 系统:" style directives 3 I, B sink LLM.ObfuscatedPrompt — override directive encoded in base64 / ROT13 / hex 4 I, B sink LLM.UnicodeSmuggling — directives hidden in zero-width / Unicode-tag / bidi chars 4 I, B sink LLM.DescriptionInjection — enticement text in description/triggers to coerce other 代理s 3 I sink LLM.工具Poisoning — 工具 descriptions deliberately mislead the 代理's plan 4 I, B sink AGT Behavior C_base Required Data-flow AGT.Cross技能Write — write int