DB siobac
One agent's whole Siobac social life — both BE REACHED by others AND REACH OUT to others (one skill, both directions). Use to publish/share an agent (QR or invite link), connect out to someone else's shared agent (login-only — connect as your own agent), find NEW matching people the platform discovers for you, and talk in those conversations: see who connected, approve/reject, send/read/check messages, set the agent's private directive. EN "share yourself", "share my agent", "make a QR/link so my friend can reach you", "connect to this agent", "talk to the agent behind this QR", "reach Alex's agent", "find people outside", "meet someone new", "any messages?", "reply to them"; ZH "把你自己分享出去", "分享我的 agent", "生成二维码/链接让朋友联系你", "连接这个 agent", "连接这个二维码背后的 agent", "帮我找人", "认识新朋友", "有人联系我吗", "查收件箱", "回复他". Not the Siobac server itself.
One agent's whole Siobac social life — both BE REACHED by others AND REACH OUT to others (one skill, both directions).
As a process B 66/100 · Nearly there — weak spots: inputs and preconditions, running it twice
What is at stake
The skill contains fragments that, in the wrong hands, cost money or data. Below: what the installer risks and what the author should do.
The skill tells the agent to hide things from you: not to show errors, not to mention actions, to report differently from what was done. You lose the ability to see what the agent really did.
Transparency beats a smooth answer. If the goal is to hide technical noise, ask the agent to "summarise briefly", not to "not mention".
Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.
The instructions or scripts send data out: environment variables, keys, file contents, chat history. You may never notice, because the agent performs the upload as "part of the task".
If the upload is not needed for the task, remove it: catalogs flag such skills and delist them. If it is needed, name the destination explicitly, say what leaves the machine, and give the user a switch.
How to improve
- Address the high-severity findings: each costs 18 safety points. If one is a false positive, add the rule id to guard.allow in spec.yaml.
- Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
- A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.
Guard findings · 11
-
high Concealment
en-hide-from-userSKILL.md:67Instruction to hide actions from the user= do NOT tell the owner it works (check `verified.*`, re-run, or run **`verify`**).
Medium and low: 10
-
medium Exfiltration
net-credential-usedist/api.js:496Credential used in a network call (verify the destination is the intended service)return inviteFetch(`${host}/poll?${params.toString()}`, { method: 'GET', headers: { Authorization: `Bearer ${token}` } }); -
medium Concealment
en-hide-from-userdist/cli.js:410Instruction to hide actions from the user (quoted — discussed, not commanded): `CAUTION: the share was created but did NOT verify — the link did not resolve back to this agent (${verified.reason ?? 'unknown'}). Do NOT tell the owner it is ready. Re-run \`share-self\`, check coquoted -
medium Concealment
en-hide-from-userdist/cli.js:1073Instruction to hide actions from the user (quoted — discussed, not commanded): `The send returned WITHOUT a sequence number — it may NOT have landed. Do NOT tell the owner it sent; \`read --conversation ${handle}\` to confirm before retrying.`,quoted -
medium Concealment
en-hide-from-userdist/cli.js:1150Instruction to hide actions from the user (quoted — discussed, not commanded): "NOT LOGGED IN — you can only see the owner's OUTBOUND conversations here (in `outbound`); their INBOUND (people who connected to them, requests, escalations) is INVISIBLE until they log in. Do NOT
quoted -
medium Concealment
en-hide-from-userdist/cli.js:1175Instruction to hide actions from the user (quoted — discussed, not commanded): "Conversations the owner started (reached out). Summarize BY PEER NAME in their language (never the handle). `read --conversation <conversation>` to see one; `send` to reply. (Conversations are perm
quoted -
medium Concealment
en-hide-from-usersrc/cli.ts:480Instruction to hide actions from the user (quoted — discussed, not commanded): `CAUTION: the share was created but did NOT verify — the link did not resolve back to this agent (${verified.reason ?? 'unknown'}). Do NOT tell the owner it is ready. Re-run \`share-self\`, check coquoted -
medium Concealment
en-hide-from-usersrc/cli.ts:1179Instruction to hide actions from the user (quoted — discussed, not commanded): `The send returned WITHOUT a sequence number — it may NOT have landed. Do NOT tell the owner it sent; \`read --conversation ${handle}\` to confirm before retrying.`,quoted -
medium Concealment
en-hide-from-usersrc/cli.ts:1246Instruction to hide actions from the user (quoted — discussed, not commanded): "NOT LOGGED IN — you can only see the owner's OUTBOUND conversations here (in `outbound`); their INBOUND (people who connected to them, requests, escalations) is INVISIBLE until they log in. Do NOT
quoted -
medium Concealment
en-hide-from-usersrc/cli.ts:1273Instruction to hide actions from the user (quoted — discussed, not commanded): "Conversations the owner started (reached out). Summarize BY PEER NAME in their language (never the handle). `read --conversation <conversation>` to see one; `send` to reply. (Conversations are perm
quoted -
low Secrets in code
secret-high-entropy-tokenpackage-lock.json:49High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)"integrity": "sha5…wQp+7C4n…9JQ==",
detector
Files scanned: 37. Evidence is masked. Grey chips explain why severity was lowered.
Against the Agent Skills spec
- warning
frontmatter-yamlSKILL.md: the frontmatter is not valid YAML (YAML parse error: Nested mappings are not allowed in compact mappings at line 2, column 14: description: One agent's whole Siobac social life — both BE REACHED by others A… ^ ); fields were read line by line. The usual cause is a colon inside an unquoted value
Process rating: all ten parameters 66/100
- 0Inputs and preconditions. Does not say what the process needs to start
- 30Running it twice. 20 mutating operations with no state check
- 50When it triggers. No condition that starts the skill
- 60Tools and files. Uses tools (bash) that frontmatter does not declare
- 60Result and completion. Output format stated, no completion criterion
- 70Execution cost. Instruction body is 4410 tokens
- 100Steps. 47 steps
- 100Failures and branches. 3 branches, has a failure section
- 100Consistency. Name and required fields are in place
- 100Progress reporting. Reports progress
- medium Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing
- low The response is described with custom markup (7 tags): a typed call is more reliable
Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.
Quality signals
- +3Description length 837: 120–800 characters recommended
- +4No input/output examples
- +1No license
- +2Single-language instructions
- +5Description quotes 16 example trigger phrases
- +4Description says when NOT to use the skill
- +4Structure: 8 headings
- +3Step-by-step instructions: 47 items
- +3Output format is stated explicitly
- +4Reference files are cited in the instructions (7 of 7)
Quality base 70; lint remarks subtract, signals add up to 100. Result: 83.