Security audit

reply-coach

Security checks for vulnerabilities and agentic risk

Overview

This skill openly reads copied chat text to help draft replies and does not show hidden execution, persistence, network transfer, or automatic message sending.

Install only if you are comfortable letting the agent read your current clipboard. Copy only the chat text you intend to analyze, avoid copying passwords or confidential material first, and use explicit requests such as reading the clipboard for reply suggestions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The changelog explicitly states that the skill reads clipboard chat content, but it provides no warning about the privacy sensitivity of copied messages or the possibility of collecting unrelated secrets that may also be in the clipboard. In a messaging-assistant skill, clipboard access is contextually expected, but documenting the capability without any consent, minimization, or privacy notice still creates a real privacy risk if users are unaware of what may be read.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README explicitly says the skill reads clipboard chat content, which commonly contains sensitive personal messages, contact details, or other private data, but it does not warn users about privacy risks, consent, or safe handling of copied content. In this context, the omission can lead users to expose third-party conversations or confidential information without realizing the sensitivity of clipboard access.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill description says it helps generate replies from chat content but does not warn users that it reads private chat material from the clipboard. This undermines informed consent and can lead users to expose sensitive personal conversations, names, or other private content without realizing clipboard data will be accessed.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrase "帮我接这句话" is broad and can match ordinary conversational requests, which increases the chance that the skill runs unexpectedly. Because the skill is designed to read clipboard content, accidental invocation could cause private chat data to be ingested without sufficiently explicit user intent at the moment of access.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The error message is hard-coded in Chinese, which imposes a specific language on all users without opt-in or an explanation that the skill is region- or locale-specific. This is a natural-language policy issue because the file provides no alternative language handling or documented locale restriction.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: The natural-language content in the file is entirely Chinese and does not offer any language choice or explain a region-specific restriction. This can violate language or locale policy when users are not given an explicit opt-in or alternative.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: The natural-language documentation and example usage are entirely in Chinese, suggesting the skill is intended to operate in that language only. The file does not mention that language choice is optional or explain a justified locale restriction, so this may violate language/locale policy expectations.

Description-Behavior Mismatch

Low

Confidence: 78% confidence
Finding: The manifest repeatedly claims the skill's core behavior is reading chat content from the clipboard and generating reply suggestions. However, the only concrete implementation detail present in this file is execution of `node {baseDir}/scripts/reply_from_clipboard.mjs`, while the actual clipboard-reading logic is not visible here, so the claimed behavior is not substantiated by the provided code artifact.

Natural-Language Policy Violations

Low

Confidence: 79% confidence
Finding: The skill’s natural-language description and invocation examples are entirely in Chinese, with no indication that language choice is optional or that the skill is intentionally restricted to a Chinese-speaking context. Under the policy, forcing a specific language without opt-in can be a locale/language policy concern.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/reply_from_clipboard.mjs:5