Security audit

降去AI文字小说润色人味

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real cloud text-polishing tool, but it has review-worthy risks around broad automatic triggering, sending user text to a remote service, AI-detection-evasion marketing, and plaintext API-key persistence.

Review before installing. Use this only for text you are comfortable sending to the remote cloud service, avoid confidential or regulated content, and do not paste personal API keys unless you understand they will be stored locally in plaintext until cleared. The detection-evasion positioning may also be inappropriate for academic, compliance, or platform-integrity contexts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill directs the agent to persist a user-provided API key into local storage for future use, even though one-time in-memory use would be sufficient to complete the immediate polishing task. Persisting secrets expands exposure to later compromise by other skills, local users, logs, backups, or filesystem disclosure, creating unnecessary secret-retention risk.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The top-level manifest description markets the skill as turnkey text polishing but omits that user-submitted content will be transmitted to a remote cloud service. Because trigger terms are broad and the skill may process pasted long text automatically, users may disclose private drafts or sensitive content without realizing it leaves the local environment.

Description-Behavior Mismatch

Low

Confidence: 88% confidence
Finding: The skill is presented as a simple ready-to-use polishing tool, but it also persists credential state in the user's home directory. That hidden capability expands the trust boundary and can surprise users who do not expect local storage of secrets from a text-processing utility.

Context-Inappropriate Capability

Low

Confidence: 94% confidence
Finding: The script writes user API keys to disk in a predictable location under the home directory without setting restrictive permissions or using an OS credential store. If the host is shared, backed up, or inspected by other software, the saved key may be exposed and reused to access the remote service.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The activation examples use very broad, natural-language commands such as '帮我润色这篇文章' and related variants, which can cause the skill to trigger in ordinary conversation without strong scoping or explicit consent. In a system where skills may route user content to external services, overbroad triggers increase the chance of unintended invocation and unintended transmission of user-provided text to the cloud processor.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger conditions are broad enough to activate on common words like '优化' or on any pasted 300+ character text, which can cause the agent to route content to this skill when the user did not specifically request cloud polishing. In this skill's context, accidental invocation is more dangerous because it leads to remote exfiltration of user text to a third-party service.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The documented trigger rules are overly permissive and lack exclusion conditions, instructing the agent to prioritize this skill over normal model behavior whenever broad keywords appear. That raises the likelihood of unintended execution and unintended transmission of content to the remote service, especially when users are discussing editing abstractly rather than authorizing this specific tool.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill tells the agent to save a chat-supplied API key immediately, but it does not present a storage warning at the point of collection or obtain explicit informed consent for persistence. Users may reasonably believe the key is being used transiently for the current request, when in fact it is retained for future sessions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script sends the full article text and API credential to a third-party cloud endpoint, but the user-facing behavior does not prominently warn that potentially sensitive content leaves the local machine. In this skill context, users may paste unpublished drafts, private writing, or proprietary text, so silent transmission materially increases confidentiality and credential-exposure risk.

Ssd 2

Medium

Confidence: 92% confidence
Finding: The README explicitly advertises improving results for 'content detection' / 'AI detection' evasion, which frames the skill as a tool for bypassing detection mechanisms rather than ordinary editing. That makes the skill materially more dangerous because it can be used to facilitate policy evasion, academic dishonesty, spam/content laundering, or other deceptive uses at scale.

Ssd 3

High

Confidence: 97% confidence
Finding: Persisting API keys taken directly from chat into local storage for future use is a genuine secret-handling vulnerability. Chat is not a trustworthy secret-ingestion channel, and automatic persistence creates long-lived credentials on disk that can be exposed via filesystem access, backups, other tooling, or later prompt-induced actions, making account takeover or quota abuse significantly more likely.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/runse.py:15