Landing Page Angle Tester

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:15 AM UTC
• Version: 1.0.0

Overview

This looks like a landing-page copywriting helper, but its bundled script contains unrelated local audit and sensitive-pattern scanning functions that are not well matched to that purpose.

Review before installing. Use it only with non-sensitive landing-page inputs, avoid pointing the script at broad project directories or credential-containing files, and prefer stdout or a controlled output path. The package does not show exfiltration or destructive behavior, but the unrelated local-audit code should be removed or clearly re-scoped before treating it as a low-risk copywriting skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的是营销文案生成类能力，核心应是围绕单一产品产出多种 landing page 叙事角度及受众/证据标注。但代码并未实现任何与产品营销叙事生成、受众细分、证据要求标注相关的专门逻辑。相反，它加载 resources/spec.json，根据 mode 执行 structured_brief、directory_audit、csv_audit、pattern_audit、skill_audit 等通用审计任务：扫描目录中的文本文件、统计扩展名、抽取 Markdown 标题、读取 CSV 字段概览、用正则查找 curl|bash、rm -rf、secret/token/private URL 等模式，并检查 Skill 文件完整性与 SKILL.md frontmatter。虽然 structured_brief 会把输入文本切分成项目符号并套入 sections，表面上可用于生成某种结构化文稿，但这是通用模板化摘要，不足以支撑“landing page 叙事角度生成”的声明。故其主要目的与实际能力均与声明明显不符。

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script implements arbitrary directory auditing, file enumeration, CSV inspection, pattern-based secret scanning, and skill-package validation that are unrelated to the declared purpose of generating landing-page narrative angles. In a skill ecosystem, this kind of scope mismatch is dangerous because it enables collection and analysis of unrelated local project content, which can expose sensitive files, internal URLs, credentials, or repository structure under the guise of a marketing tool.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code contains security-oriented regex scanning for secrets, private/admin URLs, and dangerous shell command patterns, which is unjustified for a landing-page angle tester. Even though it does not exfiltrate data by itself, this functionality materially increases the skill's ability to inspect sensitive local content and surface confidential snippets, making the mismatch with the declared purpose a serious trust and privacy risk.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger examples are generic enough that they can match ordinary user requests about landing pages, messaging, or product positioning rather than clearly signaling invocation of a bounded skill workflow. That increases the chance of accidental routing, causing the skill to process requests outside its intended context and potentially bypass more appropriate review or policy controls.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises executable capabilities, including a shell invocation of python3 and use of local input/output files, but does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization gap where a host may permit broader filesystem or command execution than users expect, increasing the chance of unintended reads, writes, or command misuse.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The manifest description and primary skill instructions are written in Chinese and present the skill identity and outputs exclusively in that language, with no indication that users may choose another language. This can violate a language/locale policy when a skill implicitly forces a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This markdown file presents all headings and instructions exclusively in Chinese, which can impose a specific language on users without any stated opt-in or justification. The policy requires offering a language/locale choice or clearly documenting why a locale restriction is necessary.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The generated report strings are written in Chinese literals such as '结果', '摘要', and follow-up instructions, and similar hard-coded locale-specific text appears throughout the file. This enforces a specific language/locale in user-facing output without any opt-in or documented regional constraint, which matches the natural-language policy violation criteria.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The ability to recursively audit arbitrary directories and inspect repository/package structure is outside the stated marketing use case and broadens local visibility into unrelated user data. In context, this is suspicious because a landing-page messaging skill should not need to inventory files, sample headings, or validate package completeness across a filesystem path supplied by the user.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The file presents all user-facing documentation in Chinese and does not mention any language choice, opt-in, or region-specific justification. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The entire template, including the title and instructional text, is written only in Chinese and implies the skill output should follow that language. This can violate a language/locale policy when no user opt-in or documented locale justification is provided.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This markdown file contains all user-facing instructions in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. That creates a natural-language policy concern under the locale/language rule because the skill implicitly forces a specific language without user opt-in.

Static analysis

No suspicious patterns detected.