Security audit

Social Post Batcher

Security checks for vulnerabilities and agentic risk

Overview

This looks safe to install for drafting social post series, though the packaged script contains unused audit helpers that should be documented or removed.

Use this for draftable social-media content plans, not for automatic posting. Avoid feeding it sensitive or private material unless you are comfortable with that content appearing in the generated output. The maintainer should remove or clearly document the unused audit modes in scripts/run.py to reduce confusion during review.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个内容生成类技能：把单一主题拆成固定数量的系列帖子，并控制重复度与叙事连续性。但实际代码没有任何与“7/14/30 条帖子生成”“叙事连续性控制”“重复度控制”“社媒文案批处理”直接相关的实现。相反，代码核心行为由 spec.json 的 mode 驱动，可对目录、CSV、文本/代码模式、Skill 目录结构进行扫描和审计，生成的是分析/检查报告，不是社媒帖子序列。代码还包含对敏感模式（如 curl|bash、rm -rf、secret/token/password、private URL）的检测，这属于安全/合规审计能力，明显超出且偏离了声明用途。因此这是明显的描述与行为不符。

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The recursive file enumeration function can inspect arbitrary directories and gather local text files, which is unnecessary for generating social-media post series. In an agent environment, this broad filesystem access can expose sensitive project contents, notes, configs, or credentials if the tool is pointed at a large or unintended path.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The regex-based pattern scanner reads file contents and searches for command execution patterns, private URLs, and secrets, which is a security-audit capability unrelated to the skill's stated function. Even though it only reports matches, it still processes potentially sensitive local data and could surface snippets from confidential files into output visible to a user or calling system.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The dispatcher enables multiple analysis modes such as directory auditing, CSV auditing, pattern scanning, and skill auditing that are unrelated to the declared purpose of batching social-media posts. This creates capability overreach: a user invoking the skill can repurpose it to inspect local files and repositories, increasing the risk of unintended data exposure and abuse beyond the advertised scope.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger examples are short, generic natural-language requests and do not define clear activation boundaries or exclusions. In a skill-loading system, overly broad routing cues can cause the skill to activate on loosely related prompts, leading to unintended handling of user content and possible misuse in workflows the skill was not meant to support.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares executable capability via `python3` and references local files/templates, but does not declare an explicit tool scope such as allowed tools or permissions. That creates an ambiguity gap where an agent may permit shell, file read, or file write operations beyond what a reviewer or policy engine expects, increasing the chance of unintended filesystem access or script execution.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The manifest description and the entire skill documentation are written as if the skill operates in Chinese, with no indication that users may choose another language. This can violate a language/locale policy when a skill implicitly forces a specific language without user opt-in or justification.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: This markdown file is entirely written as a Chinese-language example input and does not indicate that language choice is optional. Under the policy for natural-language violations, a skill artifact that enforces a specific language without user opt-in can be a locale-policy issue.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The title, category label, summary, examples, and risk text are all written in Chinese, which indicates the skill is intended to operate in a specific language/locale. The file does not provide any indication that users can opt into this language or that the locale restriction is documented as region-specific, which matches the language/locale policy violation criteria.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The entire template, including the title and all section instructions, is written only in Chinese and presents the expected output format in that language. This can constitute a language/locale policy violation if the skill is expected to support user choice, because no opt-in or alternative language option is mentioned in the file.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The generated report text is hard-coded in Chinese, including headings and guidance, with no option for the user to choose language or locale. This is a natural-language policy concern because it imposes a specific language on all users regardless of preference or context.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill_audit path inspects repository structure and parses SKILL.md metadata for other skills, which is unrelated to social-post batching and expands the tool into a repository inspection utility. This broadens the accessible data surface and can reveal internal project organization and metadata without clear justification tied to the advertised task.

Natural-Language Policy Violations

Low

Confidence: 94% confidence
Finding: This markdown file presents all user-facing headings and instructions in Chinese, but does not state that the user can choose another language or that Chinese is required for a justified region-specific purpose. That creates a natural-language policy concern because the skill implicitly forces a specific language without documented opt-in.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: This markdown test file presents all instructions and expected behavior exclusively in Chinese. Under the policy rule for natural-language constraints, forcing a specific language without offering a user choice or documenting a justified locale limitation can be a policy violation.

Static analysis

No suspicious patterns detected.