Security audit

Creator Campaign Planner

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a Chinese-language campaign-planning helper that reads user-provided input and can write an optional report, with no evidence of network access, persistence, or destructive behavior.

Use this for Chinese-language campaign planning drafts and point it only at files you intend it to summarize. It does not show evidence of networking or hidden persistence, but because it can read a user-supplied local file and write a report, avoid using sensitive unrelated documents as input.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是营销/达人合作工作流规划能力，但代码实际实现的是一个面向本地文件、目录、CSV 和 Skill 包结构的通用审计与报告生成器。它会读取 resources/spec.json 决定模式，并可执行 directory_audit、csv_audit、pattern_audit、skill_audit 等与 influencer/campaign 节奏规划无直接关系的分析。其主要资源访问对象是本地路径、文本文件、CSV、Markdown 和 Skill 目录，而不是达人合作计划、素材排期或目标映射数据模型。虽然“structured_brief”模式可以把任意文本整理成结构化报告，但这只是通用文本组织能力，不能支撑声明中的特定营销规划用途。因此属于主要目的和能力上的明显不匹配。

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The built-in pattern scanning capability inspects arbitrary files or directories for secrets, private URLs, and shell-danger patterns, which is not justified by a creator campaign planner. Even though it does not execute matches, it enables local content reconnaissance and may expose sensitive snippets from unrelated files into generated reports, making the skill materially more dangerous in context.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The script’s core dispatch logic supports generic directory auditing, CSV inspection, pattern scanning, and skill package auditing that are unrelated to the declared creator campaign planning purpose. This creates a capability mismatch: a user invoking this skill may unintentionally grant filesystem visibility and analysis powers beyond the expected business workflow, which increases the risk of misuse for local reconnaissance or data harvesting.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The README presents all user-facing instructions, examples, and warnings exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language option or justification is provided.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill declares executable capability via `python3` and references reading local resources and producing output files, but it does not define an explicit tool/permission scope such as allowed tools or file-access boundaries. This creates an authorization ambiguity: a caller or runtime may permit broader shell or filesystem access than intended, increasing the chance of unintended file reads/writes or command execution.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The generated report strings are hard-coded in Chinese, including section headings, prompts, and next-step guidance. This enforces a specific language/locale in user-facing output without offering a choice or documenting a justified locale constraint.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill_audit functionality performs filesystem package compliance checks over arbitrary skill directories, including reading SKILL.md and enumerating expected files, which is unrelated to campaign planning. In this context it broadens the skill into a local auditing tool, creating unnecessary access to local project structure and contents that could be abused for reconnaissance or cross-skill inspection.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: This markdown file presents all instructions and test criteria only in Chinese, which can constitute a language-policy violation when a skill forces a specific language without user opt-in. The file does not indicate that the locale is region-specific or that users may choose another language.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: The file is entirely written in Chinese and presents the skill input format without indicating that language selection is optional or user-driven. Under the language/locale policy rule, a skill that appears to require a specific language without opt-in can be a policy concern unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: This markdown file consists entirely of Chinese headings and instructions, and it does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The template headings and instructions are entirely in Chinese, which implies a fixed output language for the skill. Under the policy, language constraints should either offer user choice or be clearly documented as justified; this file does neither.

Static analysis

No suspicious patterns detected.