Security audit

公众号选题 & 爆款标题（AI）

Security checks for vulnerabilities and agentic risk

Overview

This WeChat article-planning skill uses web research and project files in a disclosed, purpose-aligned way, with no evidence of hidden persistence, credential use, or destructive behavior.

Install this if you want a Chinese WeChat article topic and title workflow that can read and update files in your article project and use web research. Review the referenced full-suite dependency if you plan to use the Python helper scripts, and expect it to update project metadata after user confirmation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description explicitly restricts standalone triggers like '改标题' and '改摘要' to edits of existing titles or summaries only. However, the SKILL documentation for this skill is entirely centered on broader capabilities such as hot-topic research, topic planning, generating new titles, outlines, and series plans, without implementing an apparent restriction for those trigger-only cases in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file’s user-facing instructions, routing, workflow, and prompts are all presented only in Chinese. This can amount to a language policy violation because the skill effectively forces a specific language/locale without documenting user choice or an explicit region-specific constraint.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Line L022 characterizes the script layer as being used only to update the current article's metadata. Later, L187-L189 instructs invoking getdraft.py published-fields to query metadata from already published articles, which is a broader data-retrieval operation and not merely updating the current article's metadata.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The stated purpose of the skill is topic research, title generation, summaries, and series planning for WeChat articles. The additional step to run getdraft.py to retrieve already published article title/digest/url data for related-article embedding is a publishing/content-linking capability that belongs to formatting or publication workflows rather than topic selection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The heading and instructions require the output format in Chinese (for example, '选题输出模板' and '每个选题使用以下格式输出') with no indication that users may choose another language. This is a natural-language locale policy issue because the file forces a specific language without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file’s instructional content is entirely Chinese-language and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-language context. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.