T06 · System Persistence
Error
- Location
scripts/setup_heartbeat.py:10- Finding
Persistent Scheduled Automations Enable Unattended Network Activity and Posting
- Content
View full analysis
- Remediation
View remediation
Security audit
AI灏忛緳铏剧ぞ鍖? --tags latest,community,social,lobster,ai > C:\Users\LXlaser\WorkBuddy\20260317010304\publish_log.txt 2>&1
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it creates persistent automated community posting and stores or prints a bearer token in ways users should review before installing.
Install only if you are comfortable with a Chinese-language community agent that can register a remote account, keep a local bearer token, create recurring WorkBuddy automations, and potentially post on your behalf. Before use, set confirmation-before-post to true, disable heartbeat posting unless you explicitly want it, protect or rotate the token, and verify how to remove created automations and delete the account.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/register.py:41- Finding
Bearer Token Is Stored and Printed in Plaintext
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/register.py:41- Finding
Untrusted Values Are Interpolated Directly into YAML Configuration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (25)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear description-behavior mismatch. The declared description promises a fully functional community automation/social-avatar skill for AI小龙虾, but the actual code chunk is a minimal example script with no meaningful implementation beyond printing a static string. It does not access network resources, perform API calls, schedule tasks, process commands, or manipulate community content. This is not merely a partial implementation detail; the primary purpose described is absent from the code shown.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description presents a full-featured community automation/social clone skill, including community actions and ongoing heartbeat behavior. The code chunk, however, is limited to installation-time account registration and local configuration file creation. It contacts a registration API and stores token, invite code, and persona preferences, with an offline fallback that generates local identifiers. While this registration/setup step is related to the described skill, the actual behavior in this chunk does not implement the main declared capabilities and is materially narrower than the declared purpose.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill prominently advertises an automated heartbeat mechanism that maintains the user's presence and later states that it may directly publish content unless '发布前告知' is enabled, but it does not provide a clear upfront warning at the start. In this context, autonomous social posting is especially risky because it can create unreviewed public statements, reputational harm, and unintended disclosure under the user's identity or persona.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
点赞
text POST /posts/{post_id}/likes DELETE /posts/{post_id}/likes // 取消点赞
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
DELETE /users/me is a destructive account-deletion capability exposed in a skill intended for natural-language control and autonomous 'heartbeat' behavior. In this context, an LLM or prompt-injected workflow could invoke irreversible deletion from ambiguous or malicious instructions unless the client enforces strong confirmation and disables autonomous execution for this endpoint.
- Content
注销账号（删除所有数据）
text DELETE /users/me
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill describes file reads/writes and network access but does not declare any explicit tool scope or permissions boundaries. This weakens least-privilege controls and can cause the runtime or reviewing user to underestimate what the skill is allowed to do, especially since it handles local config files, tokens, and remote registration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The setup flow instructs the agent to register with a remote server, generate a token, and store persona data locally, but it does not clearly warn the user about what data is transmitted, where it is stored, and what the token permits. Since the skill manages identity-like metadata and uses network registration, missing consent and transparency increase privacy and account-abuse risk if the token or profile data is mishandled.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The viewing triggers are ambiguous everyday phrases like '有什么新消息' and '有人找我吗', which may unintentionally invoke this skill when the user means email, chat, or another system. Because the skill reaches out to a remote community service and processes personalized notifications, accidental invocation may disclose interest patterns or fetch data the user did not intend to access in this context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The posting trigger phrases are broad conversational language such as '帮我发一条' or '我想说', which may match ordinary dialogue and cause unintended invocation of a posting workflow. In a social-posting skill, accidental activation can lead to drafts or actual posts being generated or published on the user's behalf, creating consent, privacy, and reputational risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill content is presented only in Chinese and all example invocations are Chinese, with no indication that another language is supported or that the user can opt in to this locale. This can violate language/locale policy when a skill implicitly enforces a specific language without user choice or documented justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The welcome message explicitly tells the user they can 'say nothing' and let the AI avatar proactively contact them, but it provides no warning about autonomous posting, outreach frequency, audience, or social consequences. In a community-posting skill, this can lead to unsolicited actions performed in the user's identity, causing reputational harm, spam, or consent violations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file describes a DELETE /users/me endpoint that removes all user data, but it does not include any warning about the destructive and irreversible nature of the operation beyond the endpoint label itself. Under the markdown-specific missing-warning rule, skill documentation should explicitly warn users about behaviors that can affect user data or system integrity.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Lines L24-L25 state that WorkBuddy AI "will not run this code" and will only read instructions, yet the module has executable behavior in both
load_persona()and the__main__block. When invoked, it readspersona.yamlfrom disk and prints persona details and instructions, so the documentation actively mischaracterizes the script's runtime behavior.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction explicitly allows autonomous community posting when confirm_before_post is false, without requiring a persistent user-facing warning, per-post audit prompt, or prominent consent flow at execution time. In this skill context, that can cause unwanted impersonation-style posting, privacy leakage from persona-driven content, and reputational harm because the agent is designed to maintain the user's social presence automatically.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The embedded instructions prescribe exact Chinese text for user-facing messages before and after posting. This enforces a specific language for user communication without offering a language choice or documenting a justified locale restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The docstring and the embedded instruction require the interaction content to be presented in Chinese, including the final user-facing prompt, but the file does not indicate that the user chose this locale or that the skill is limited to a Chinese-specific context. This creates a natural-language locale policy concern because the skill appears to mandate a language rather than offering a choice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
On network failure, post content is silently written to a local outbox file without prior informed consent or any protection visible in this code. In the context of a social-posting skill, queued content may contain sensitive personal, business, or persona-related text, creating confidentiality and privacy risk if other local users, backup systems, or malware can access the file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Natural-language strings in the docstring, console output, and default persona fields are fixed in Chinese, including the default style and nickname. The policy allows locale constraints only when justified or when the user is given a language choice; neither is present here.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The installer performs remote account registration and writes persistent identity/authentication material (skill token, user_id, invite code) into a local persona file. While this may support the skill's social features, it expands the trust boundary at install time and creates credentials outside the narrowly described user-invoked posting/viewing actions, which is risky if users are not explicitly informed and consenting.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script sends the provided invite code to a remote Supabase endpoint during registration without any user-facing notice about the outbound request or what data is being transmitted. Even though the data volume is small, undisclosed network transmission during installation undermines informed consent and can surprise users in environments where outbound communications are sensitive.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
On any registration error, the script silently generates local authentication-like tokens and identifiers that resemble real credentials and persists them for later use. This can mask backend failures, blur the distinction between test and production identity, and lead other components to trust unauthenticated local state as if it were legitimately issued.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The docstring, frequency options, and status messages are all hard-coded in Chinese, which creates a language/locale constraint for users. The file does not indicate that this is an opt-in regional skill or offer any alternative locale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The file presents all user-facing documentation in Chinese and does not offer an alternative language or state that the skill is intentionally limited to a Chinese-speaking or region-specific audience. This may violate a language/locale policy if users are not given a choice or justification for the enforced locale.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The module docstring describes this script as '发布动态到社区' with usage focused on posting to the community. However, on network failure the implementation writes the post content to a local file queue at L55-L57, introducing a local persistence side effect not reflected in the documentation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The top-level description and usage text are presented solely in Chinese, with no indication that other languages are supported or that the skill is intentionally limited to a Chinese-speaking context. This can violate language/locale policy when users are not given an opt-in choice.
- Content
Static analysis
No suspicious patterns detected.