快速草稿

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:56 AM UTC
• Version: 1.0.0

Overview

This drafting skill is useful and not malicious, but it automatically keeps full draft history in plaintext without enough privacy controls or clear user consent.

Install only if you are comfortable with generated drafts being stored locally in plaintext. Avoid using it for confidential customer, HR, legal, financial, or internal meeting content unless you first add clear opt-in history, a way to disable or delete saved drafts, retention limits, and restrictive file permissions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:27

Finding

Plaintext Persistence of Potentially Sensitive Draft Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27 and 95-122
Vulnerability Type: Plaintext storage with environment-dependent file permissions
Risk Level: Medium

Vulnerable Code

python

DRAFT_FILE = os.path.join(os.path.dirname(__file__), "quick_drafts.json")

python

def _save(self):
    with open(DRAFT_FILE, "w", encoding="utf-8") as f:
        json.dump(self.drafts, f, ensure_ascii=False, indent=2)

python

draft = {
    "id": len(self.drafts) + 1,
    "template": template_key,
    "format": tmpl["format"],
    "subject": subject,
    "body": body,
    "params": params,
    "created": datetime.now().isoformat(),
    "finalized": False
}

self.drafts.append(draft)
self._save()

Technical Analysis

Every generated draft is automatically retained in quick_drafts.json, including the rendered subject and body as well as the complete original params dictionary. Depending on the selected template, these values may contain recipient identities, customer or project details, meeting participants, internal discussions, action items, schedules, and business risks.

The file is written in unencrypted JSON and is created with permissions determined by the process umask. The implementation neither explicitly applies owner-only permissions nor checks whether an existing file is accessible by other users. On systems with permissive umasks, shared skill directories, or incorrectly inherited permissions, another local user or process may be able to read the stored drafts.

The documented draft-history feature makes this persistence non-covert, and no network exfiltration was identified. Nevertheless, there is no opt-in control, retention limit, deletion mechanism, data minimization, or warning describing the sensitivity and location of the stored information.

Attack Path

1. A user generates an email, weekly report, or meeting note containing confidential information.
2. The generate() method places both the rendere ...[truncated 1183 chars]

Remediation

View remediation

Remediation Suggestions

1. Disable draft persistence by default and require explicit user opt-in before storing content.
2. Create the storage file using owner-only permissions, such as mode 0600, rather than relying on the process umask.
3. Validate and correct permissions on an existing storage file before reading or writing it.
4. Store the history in a private, user-specific application-data directory instead of the package or skill directory.
5. Minimize retained data by omitting the raw params dictionary and storing only fields required by the history feature.
6. Add configurable expiration, maximum-history limits, and secure deletion controls.
7. Clearly document the storage path, retained fields, retention behavior, and privacy implications.
8. Use operating-system-backed encrypted storage when drafts require protection from local filesystem disclosure.
9. Write updates atomically through a securely created temporary file to reduce corruption and permission-inheritance risks.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation phrases are extremely generic (e.g. '草稿', '写邮件', '写消息', '生成'), which can cause the skill to trigger during ordinary conversation and capture or act on content the user did not intend for this skill. In context, this increases the chance that sensitive business or personal text will be drafted and persisted unexpectedly, especially because the skill also stores history locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advertises '保存草稿历史' but does not clearly warn users that all generated draft content and parameters are written to a local JSON file. Because this skill is meant for emails, reports, and meeting notes, the saved content may include sensitive names, business details, deadlines, or internal discussions that users may reasonably expect to be ephemeral.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The implementation stores every draft, including full body text and raw input parameters, in plain JSON without minimization, redaction, encryption, or access controls. Given the templates target emails, weekly reports, and meeting minutes, this creates a realistic privacy and confidentiality risk if the host is shared, backed up, synced, or later compromised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.