Security audit

Podcast Production Ops

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly a local Chinese-language podcast production drafting tool, with some overbroad dormant audit code but no evidence of exfiltration, persistence, destructive behavior, or deception.

Install this only if you want a Chinese-language podcast production drafting helper. It can run a local Python script that reads the input path you provide and may write or overwrite the output path you provide, so use a dedicated project file and review the generated draft before publishing or sharing. The bundled script contains inactive generic audit code that should ideally be removed or documented in a future version.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 描述强调播客内容生产与发布辅助，但代码并未体现播客领域特有逻辑，例如生成 show notes、标题建议、剪辑要点、发布清单、节目结构整理或音频相关处理。相反，代码核心是一个可切换模式的通用报告工具：既能做结构化摘要，也能做目录审计、表格数据审计、代码/文本风险模式扫描，以及 Skill 规范检查。这些能力与播客生产流程并不相符，且属于未声明的重要功能范围。虽然 structured_brief 模式表面上可把输入文本整理成分节报告，勉强有一些“内容整理”成分，但其实现非常泛化，不能支撑声明中的播客专用用途，更无法证明其主用途是播客生产。因此描述与实际行为存在明显不匹配。

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script exposes multiple generic audit modes in build_report, including directory, CSV, pattern, and skill auditing, which substantially exceed the declared podcast-production purpose. This broadens the skill into a general-purpose local inspection tool that can enumerate files and analyze arbitrary user-supplied paths, increasing the chance of unauthorized workspace discovery or misuse in unrelated security-review tasks.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger examples are broad natural-language phrases like '把这期播客整理成完整生产包' and '给我标题和 show notes', which are common requests that could accidentally invoke this skill in unrelated podcast-assistance contexts. This can cause misrouting or over-application of the skill, especially in agent systems that rely on loose semantic matching rather than explicit invocation.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises executable capabilities via a local Python script and implies file read/write and shell use, but the manifest does not declare any explicit tool scope or permissions boundary. That makes the effective privilege surface ambiguous, which can lead to overbroad execution in hosts that infer capabilities from instructions rather than enforce least privilege.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims it is 'default read-only' and does not execute high-risk commands, yet it explicitly authorizes shell/exec use of a Python script that writes an output file. This inconsistency can mislead users and reviewers about what the skill is permitted to do, increasing the chance of unintended code execution or filesystem modification.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: This markdown file presents the skill's example output almost entirely in Chinese, which can impose a language choice on users without any indication that they can select another locale. The policy explicitly flags language or locale constraints when they are forced without user opt-in or justification.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The template is written entirely in Chinese and presents fixed Chinese section headings and instructions, which implies the skill output is expected in Chinese by default. There is no indication that users can opt into another language or that the Chinese-only constraint is required for a specific justified locale-bound use case.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The generated report strings in `make_structured_report` are fixed in Chinese, which forces a specific language for users regardless of preference. This matches the policy category for language or locale violations because there is no opt-in, fallback, or justification for a Chinese-only output.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: `directory_report`, `csv_report`, `pattern_report`, `parse_frontmatter`, and `skill_audit` all emit Chinese user-facing text and error messages. Because the script does not offer language selection or explain a region-specific requirement, it violates the natural-language locale policy.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The embedded pattern scanner searches arbitrary files for secrets, private URLs, and shell-dangerous constructs, which is unrelated to podcast production operations. In this context, it creates an unnecessary capability to inspect local content for sensitive material, making the skill more dangerous than advertised and increasing data exposure risk if pointed at broad directories.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill_audit functionality performs package/compliance checks on skill directories, including required file presence and frontmatter parsing, which has no clear relation to podcast production workflows. This hidden cross-domain auditing capability expands the skill into a generic repository inspection utility and undermines least-privilege expectations for users invoking a podcast tool.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This markdown file presents all test instructions and expected outputs in Chinese, which effectively forces a specific language for users interacting with the skill materials. The policy allows language constraints only when users are given a choice or when the locale limitation is clearly documented and justified, neither of which appears here.

Natural-Language Policy Violations

Low

Confidence: 87% confidence
Finding: This markdown file presents all headings and audit conclusions only in Chinese, with no statement that the skill is Chinese-language only or that users can choose another language. Under the policy rule for language or locale constraints, forcing a specific language without opt-in can be a natural-language policy violation.

Description-Behavior Mismatch

Low

Confidence: 83% confidence
Finding: L04 and L14 describe a workflow skill for organizing podcast production artifacts such as show notes, titles, and checklists. L33-L35 expands this into operational code execution via shell/exec, which goes beyond the plain-language description of generating and organizing content, even if used to implement the workflow.

Natural-Language Policy Violations

Low

Confidence: 77% confidence
Finding: The manifest description is written in a mixed Chinese/English form and the rest of the skill instructions are primarily Chinese, but the skill does not state that users may choose their preferred language. This can create an implicit language policy constraint without explicit opt-in or choice.

Natural-Language Policy Violations

Low

Confidence: 89% confidence
Finding: The entire skill example is written only in Chinese and does not offer any language choice or indicate that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.