爻鉴版权登记与存证

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:45 AM UTC
• Version: 1.0.0

Overview

The skill appears to implement a real copyright evidence workflow, but it needs review because it handles login, identity data, file uploads, and payments with weak scoping and insecure local handling of sensitive data.

Install only if you are comfortable letting the skill authenticate to a Yaojian account, cache tokens and identity-owner records locally, read and possibly upload your original works, create a paid WeChat order, and send payment QR data to a third-party QR service. Avoid using it for highly sensitive unpublished works or identity data unless the publisher addresses plaintext credential storage, argument-based OTP handling, payment URL disclosure, and certificate filename sanitization.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:286
• Finding: Payment URL Disclosed to an Unrelated Third-Party QR Service## Vulnerability Details **File Location**: `SKILL.md`, lines 286-291 **Vulnerability Type**: Sensitive payment metadata disclosure **Risk Level**: Medium ### Vulnerable Code or Instruction ```text After order submission, obtain code_url from submit_order.py and convert it into a QR code: https://api.qrserver.com/v1/create-qr-code/?size=300x300&data={URL-encoded code_url} ``` ### Technical Analysis The workflow instructs the Agent to transmit the WeChat payment `code_url` to `api.qrserver.com`, which is a third-party service outside the declared Yaojian API gateway. The payment URL is placed in an HTTP query parameter. Query parameters may be retained in third-party access logs, monitoring systems, browser history, intermediary logs, or analytics. URL encoding changes only the representation of the value and does not provide confidentiality. This disclosure is not required for the declared workflow because QR codes can be generated locally without sending the underlying payment URL to another organization. ### Attack Path 1. The Agent submits an order to the Yaojian API. 2. The order response contains a WeChat payment `code_url`. 3. The Agent inserts the URL into the `data` parameter of a request to `api.qrserver.com`. 4. The third-party service receives and may log the complete payment URL. 5. A party with access to those logs can recover the payment reference and associated transaction metadata. ### Impact Assessment The issue can disclose payment-session metadata to an unrelated third party. If the returned payment URL behaves as a bearer-like transaction reference, a recipient may be able to inspect or misuse the payment session. At minimum, the disclosure enables transaction correlation and tracking outside the service boundary. This does not directly grant operating-system privileges, but it violates least-disclosure principles for payment data.
• Remediation: ## Remediation Suggestions - Generate the QR code locally with a reviewed QR encoding library. - If local generation is unavailable, use a trusted first-party endpoint controlled by the payment or Yaojian service. - Never place payment URLs, tokens, or transaction references in requests to public QR-generation services. - Document the approved network destinations and enforce an outbound allowlist. - Treat the payment URL as sensitive and remove it from logs after the QR code has been rendered.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/login.py:34
• Finding: Authentication Tokens and Full Identity Records Stored in Plaintext## Vulnerability Details **File Location**: `scripts/login.py`, lines 34-43; `scripts/init_credential.py`, lines 29-34; `scripts/common.py`, lines 141-145 **Vulnerability Type**: Insecure local storage of authentication secrets and identity data **Risk Level**: High ### Vulnerable Code ```python token_data = { "access_token": result["access_token"], "refresh_token": result.get("refresh_token", ""), "token_type": result.get("token_type", "Bearer"), "expires_in": expires_in, "mobile": mobile, "login_time": now.strftime("%Y-%m-%dT%H:%M:%S"), "expire_time": (now + timedelta(seconds=expires_in)).strftime("%Y-%m-%dT%H:%M:%S"), } save_json(AUTH_TOKEN_PATH, token_data) ``` ```python cache_data = { "credentials": data, "update_time": datetime.now().strftime("%Y-%m-%dT%H:%M:%S") } save_json(CREDENTIAL_CACHE_PATH, cache_data) ``` ```python def save_json(path, data): """Save data as JSON file (UTF-8, no BOM, indented)""" os.makedirs(os.path.dirname(path), exist_ok=True) with open(path, "w", encoding="utf-8") as f: json.dump(data, f, ensure_ascii=False, indent=2) ``` ### Technical Analysis The authentication cache contains the access token, refresh token, and user phone number. The owner cache stores the complete array returned by the identity-owner API rather than retaining only the fields needed for order submission. Both records are written as ordinary JSON files. The shared `save_json` function does not request restrictive permissions, encrypt the contents, or use an operating-system credential manager. Depending on the host's default umask and directory permissions, other local users or processes may be able to read these files. Adding files to `.gitignore`, as claimed by the Skill instructions, prevents accidental source-control inclusion but does not protect the files from local disclosure. ### Attack Path 1. A user authenticates th ...[truncated 910 chars]
• Remediation: ## Remediation Suggestions - Store access and refresh tokens in an operating-system credential manager rather than plaintext JSON. - If a file must be used, create it atomically with owner-only permissions such as mode `0600`. - Restrict the containing directory to the current user. - Encrypt sensitive cached values using a key protected by the operating system. - Store only the minimum owner fields needed by the workflow, such as the selected owner ID and a redacted display name. - Do not cache complete identity API responses. - Delete expired tokens and stale owner caches automatically. - Avoid retaining the phone number unless it is operationally necessary. - Add tests that verify cache permissions and data minimization.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/login.py:49
• Finding: Phone Number and One-Time Authentication Codes Exposed Through Process Arguments## Vulnerability Details **File Location**: `scripts/login.py`, lines 49-57; `scripts/send_sms.py`, lines 101-116; `SKILL.md`, lines 78-101 **Vulnerability Type**: Authentication secret exposure through command-line arguments **Risk Level**: High ### Vulnerable Code ```python if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python login.py <mobile> <sms_code>") sys.exit(1) login(sys.argv[1], sys.argv[2]) ``` ```python if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python send_sms.py <mobile> [captcha_characters]") print(" Mode 1: python send_sms.py <mobile> - Get captcha only") print(" Mode 2: python send_sms.py <mobile> <captcha> - Send SMS using cached identity") sys.exit(1) mobile = sys.argv[1] ensure_dirs() if len(sys.argv) >= 3: characters = sys.argv[2] identity = load_cached_identity() send_sms(mobile, identity, characters) ``` ### Technical Analysis The workflow passes the user's phone number, image-captcha answer, and SMS one-time password as command-line arguments. Process arguments are not an appropriate secret-transport mechanism. Depending on the operating system and execution environment, arguments may be visible through process inspection utilities, parent-process telemetry, shell history, endpoint monitoring, crash reports, audit logs, or Agent execution logs. The short validity period of an OTP reduces the exploitation window but does not eliminate it. ### Attack Path 1. The user supplies a phone number and SMS verification code. 2. The Agent launches `login.py` with both values in the command line. 3. A local observer, monitoring agent, or log collector captures the process argument list while the process is running. 4. The observer extracts the still-valid OTP and phone number. 5. The ...[truncated 555 chars]
• Remediation: ## Remediation Suggestions - Read OTPs and captcha answers from protected standard input rather than `sys.argv`. - Pass structured non-secret input separately from secret input. - If standard input is unavailable, use an owner-only temporary file and securely delete it immediately after reading. - Disable shell command echoing and redact authentication values from Agent execution logs. - Never include phone numbers or OTPs in usage examples that may be copied into shell history. - Clear in-memory references as soon as practical after authentication. - Add automated checks that reject secret-bearing command-line arguments.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_cert.py:128
• Finding: Unsanitized Order Title Allows Certificate Output Path Traversal## Vulnerability Details **File Location**: `scripts/generate_cert.py`, lines 128-143 **Vulnerability Type**: Path traversal and arbitrary file overwrite **Risk Level**: High ### Vulnerable Code ```python def generate_single_cert(data): """Generate a single certificate image from data dict""" output_path = OUTPUT_PATH.format(title=data["title"]) os.makedirs(os.path.dirname(output_path), exist_ok=True) shutil.copy2(TEMPLATE_PATH, output_path) img = Image.open(output_path) draw = ImageDraw.Draw(img) font_title = ImageFont.truetype(FONT_TITLE, TITLE_FONT_SIZE) font_label = ImageFont.truetype(FONT_LABEL, LABEL_FONT_SIZE) font_value = ImageFont.truetype(FONT_VALUE, VALUE_FONT_SIZE) font_hash = ImageFont.truetype(FONT_VALUE, HASH_FONT_SIZE) font_case_no = ImageFont.truetype(FONT_CASE_NO, CASE_NO_FONT_SIZE) ``` The same function later executes: ```python img.save(output_path, "PNG") return output_path ``` ### Technical Analysis The output path is constructed by directly interpolating `data["title"]`, which originates from order details, into a filename template. The function does not remove path separators, reject traversal components, resolve the final path, or verify that the destination remains inside the intended certificate directory. A title containing components such as `../` or platform-specific absolute-path syntax can cause the resolved output location to escape the certificate directory. The function then calls both `shutil.copy2` and `img.save` on that path. The Skill documentation states that titles should have special characters removed, but this is only an Agent instruction and is not enforced at the file-write security boundary. The server response or a separately supplied order-detail JSON can still contain a malicious title. ### Attack Path 1. An attacker influences an order title or supplies a crafted order-detail JSON file. 2. The titl ...[truncated 999 chars]
• Remediation: ## Remediation Suggestions - Convert the title to a safe basename before using it in a path. - Allow only a conservative set of filename characters. - Replace path separators, traversal components, control characters, and reserved platform characters. - Apply a maximum filename length. - Generate a random or server-issued identifier for the physical filename and use the title only as certificate content. - Resolve the destination with `Path.resolve()` and verify that it is a descendant of the resolved certificate directory. - Reject the operation if containment validation fails. - Use exclusive creation or explicit overwrite confirmation to avoid accidental data destruction. - Treat Agent-side title normalization as a usability measure, not as the security control.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_cert.py:185
• Finding: Certificate Generation Prints Complete Personal Identity Data to Execution Logs## Vulnerability Details **File Location**: `scripts/generate_cert.py`, lines 185-194; sensitive structure assembled at lines 96-108 **Vulnerability Type**: Personal information exposure through verbose logging **Risk Level**: High ### Vulnerable Code ```python return { "title": opus.get("title", ""), "realName": ownership.get("realName", ""), "certType": cert_type, "certNumber": ownership.get("certNumber", ""), "preservationTime": formatted_time, "fileHash": file_hash, "preservationId": str(preservation_id), } ``` ```python output_paths = [] for i, data in enumerate(all_data, 1): print(f"\n[{i}/{len(all_data)}] Generating: {data['title']}") print(f"Data: {json.dumps(data, ensure_ascii=False, indent=2)}") path = generate_single_cert(data) print(f"Certificate saved: {path}") output_paths.append(path) ``` ### Technical Analysis The `data` dictionary includes the owner's real name, government credential number, credential type, work title, preservation timestamp, complete file hash, and preservation ID. The complete dictionary is serialized and printed to standard output. Standard output from Skill scripts may be retained in Agent transcripts, execution telemetry, shell logs, orchestration logs, debugging systems, or support records. This behavior also contradicts the Skill's stated minimal-output principle. The log is unnecessary for certificate generation and exceeds the minimum data disclosure required by the declared functionality. ### Attack Path 1. A paid order response is saved to the local order-detail file. 2. `generate_cert.py` extracts ownership and preservation data from that response. 3. The script serializes the complete sensitive data structure. 4. The serialized identity data is printed to standard output. 5. An Agent runtime, log collector, terminal history mechanism, or support system retains the output. 6. Anyone with acc ...[truncated 559 chars]
• Remediation: ## Remediation Suggestions - Remove the complete `json.dumps(data)` output. - Log only a non-sensitive operation identifier and success or failure status. - Redact identity numbers, names, tokens, hashes, and preservation identifiers from all logs. - Make diagnostic logging opt-in and disabled by default. - Ensure production log retention and access controls are appropriate for personal information. - Add tests that fail when sensitive field names or values are written to standard output. - Review existing logs and securely delete previously retained identity data where applicable.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill claims to handle copyright/evidence workflows but also fetches CAPTCHA images, stores CAPTCHA state, and initiates SMS authentication tied to a phone number. Hidden authentication handling broadens the attack surface and can surprise users, especially when the skill directs the agent to conceal internal processing from them.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill claims to handle copyright/evidence workflows but also fetches CAPTCHA images, stores CAPTCHA state, and initiates SMS authentication tied to a phone number. Hidden authentication handling broadens the attack surface and can surprise users, especially when the skill directs the agent to conceal internal processing from them.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill claims to handle copyright/evidence workflows but also fetches CAPTCHA images, stores CAPTCHA state, and initiates SMS authentication tied to a phone number. Hidden authentication handling broadens the attack surface and can surprise users, especially when the skill directs the agent to conceal internal processing from them.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The description fails to warn users that uploaded files, hashes, metadata, and possibly original files may be transmitted to external APIs and optionally retained in cloud custody. For a file-handling skill, that is a material privacy and data-governance omission with potentially serious consequences if users assume processing is local or limited.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: Broad trigger phrases increase the chance that the skill activates during ordinary conversation and begins sensitive flows involving authentication, file handling, or external transmission without sufficiently specific user intent. In this context, accidental invocation is more dangerous because the skill can process personal data and upload files to third-party services.

Vague Triggers

High

• Confidence: 98% confidence
• Finding: Several triggers are generic conversational phrases that can easily match benign user statements. Because the skill can start login, read files, classify content, and transmit data externally, accidental activation meaningfully raises privacy and consent risks.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This script implements a captcha retrieval and SMS verification workflow that is unrelated to the declared copyright-evidence functionality of the skill. Hidden account-verification or phone-targeting capabilities inside an unrelated skill are a strong indicator of deceptive or unauthorized behavior, and they could be used to facilitate account creation, account takeover workflows, or abuse of third-party SMS infrastructure.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The send_sms function allows SMS verification codes to be sent to arbitrary mobile numbers with no visible authorization, ownership check, or linkage to copyright evidence operations. In the context of a copyright-evidence skill, this is unjustified and dangerous because it can enable targeted SMS abuse, support fraudulent verification flows, or be repurposed for account-related attacks against third-party services.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no explicit tool scope or permission boundary even though it clearly performs file reads/writes and outbound network access. That increases the chance of over-privileged execution, makes review harder, and prevents users or the host platform from understanding the data-access surface up front.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The description fails to warn users that uploaded files, hashes, metadata, and possibly original files may be transmitted to external APIs and optionally retained in cloud custody. For a file-handling skill, that is a material privacy and data-governance omission with potentially serious consequences if users assume processing is local or limited.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The instructions explicitly hide CAPTCHA recognition and authentication-data handling from the user. Concealing security-relevant processing reduces transparency, weakens informed consent, and can enable silent handling of sensitive data in ways users would not expect from a content-protection tool.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill directs the agent to persist access tokens and credential caches locally for reuse. Long-lived local storage of authentication material and identity-linked records increases the risk of token theft, unintended cross-session access, or leakage from the host environment.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

AI 根据文件扩展名、文件名特征、用户上下文，以及**视觉识别（识图）**自动判断分类，规则如下：

| 分类 | 值  | 判定策略                                                                                                                                                                                                                                           |
| ---- | --- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 文章 | 101 | 扩展名为 `.txt`, `.doc`, `.docx`, `.pdf`, `.md`                                                                                                                                                                                          |
| 设计 | 103 | 扩展名为 `.psd`, `.ai`, `.sketch`, `.fig`, `.xd`                                                                                                                                                                                         |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| 分类 | 值  | 判定策略                                                                                                                                                                                                                                           |
| ---- | --- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 文章 | 101 | 扩展名为 `.txt`, `.doc`, `.docx`, `.pdf`, `.md`                                                                                                                                                                                          |
| 设计 | 103 | 扩展名为 `.psd`, `.ai`, `.sketch`, `.fig`, `.xd`                                                                                                                                                                                         |
| 摄影 | 102 | 1. 扩展名为RAW格式（`.raw`, `.cr2`, `.nef`）；`<br>`2. 文件名含相机特征（`IMG_`, `DSC_`）或用户明确说是“照片”；`<br>`3. 对于普通的 `.jpg`, `.png` 图片，**启用视觉识别**，画面为真实拍摄场景（如实景、人像摄影）归此类。 |
| 绘画 | 104 | 1. 文件名含“手绘/插画/画板/oc/线稿”等，或用户明确说是“画的”；`<br>`2. 对于普通的 `.jpg`, `.png` 图片，**启用视觉识别**，画面为板绘、手绘、插画、二次元、CG原画等非真实拍摄内容归此类。                                             |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| 分类 | 值  | 判定策略                                                                                                                                                                                                                                           |
| ---- | --- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 文章 | 101 | 扩展名为 `.txt`, `.doc`, `.docx`, `.pdf`, `.md`                                                                                                                                                                                          |
| 设计 | 103 | 扩展名为 `.psd`, `.ai`, `.sketch`, `.fig`, `.xd`                                                                                                                                                                                         |
| 摄影 | 102 | 1. 扩展名为RAW格式（`.raw`, `.cr2`, `.nef`）；`<br>`2. 文件名含相机特征（`IMG_`, `DSC_`）或用户明确说是“照片”；`<br>`3. 对于普通的 `.jpg`, `.png` 图片，**启用视觉识别**，画面为真实拍摄场景（如实景、人像摄影）归此类。 |
| 绘画 | 104 | 1. 文件名含“手绘/插画/画板/oc/线稿”等，或用户明确说是“画的”；`<br>`2. 对于普通的 `.jpg`, `.png` 图片，**启用视觉识别**，画面为板绘、手绘、插画、二次元、CG原画等非真实拍摄内容归此类。                                             |
| 其它 | 199 | 无法明确判断时兜底使用                                                                                                                                                                                                                             |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| 设计 | 103 | 扩展名为 `.psd`, `.ai`, `.sketch`, `.fig`, `.xd`                                                                                                                                                                                         |
| 摄影 | 102 | 1. 扩展名为RAW格式（`.raw`, `.cr2`, `.nef`）；`<br>`2. 文件名含相机特征（`IMG_`, `DSC_`）或用户明确说是“照片”；`<br>`3. 对于普通的 `.jpg`, `.png` 图片，**启用视觉识别**，画面为真实拍摄场景（如实景、人像摄影）归此类。 |
| 绘画 | 104 | 1. 文件名含“手绘/插画/画板/oc/线稿”等，或用户明确说是“画的”；`<br>`2. 对于普通的 `.jpg`, `.png` 图片，**启用视觉识别**，画面为板绘、手绘、插画、二次元、CG原画等非真实拍摄内容归此类。                                             |
| 其它 | 199 | 无法明确判断时兜底使用                                                                                                                                                                                                                             |

### 步骤3：展示确认信息并询问存储选项

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

下单成功后，从 `submit_order.py` 输出中获取 `code_url`，转为二维码输出：

```
https://api.qrserver.com/v1/create-qr-code/?size=300x300&data={URL编码的code_url}
```

### 步骤7：查询订单支付状态

• Confidence: 89% confidence
• Finding: The skill sends payment QR data to an unrelated third-party QR generation service, creating an extra external transmission path. Even if the payload is only a payment URL, this leaks transaction-related data to another domain and introduces tracking, availability, and integrity dependencies outside the primary service boundary.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to receive user files, compute hashes, and upload content for optional cloud custody and blockchain evidence creation, but it does not require an explicit privacy/transmission warning before those actions. In a copyright-evidence workflow, users may submit sensitive unpublished works, so failing to clearly disclose third-party transmission and storage creates meaningful privacy, confidentiality, and consent risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The workflow proceeds to submit an order, display a payment QR code, and check payment status without an explicit safety warning or strong confirmation for a real-world financial transaction. This can cause accidental purchases or socially engineered payments, especially because the output rules emphasize minimal disclosure and hiding execution details from the user.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: 技能清单将本技能描述为“版权保护与数据存证工具”，触发词也集中在版权、DCI、存证、确权等场景。但该文件在L209-L211提供短视频商标分类建议，在L215-L228提供专利驳回复审处理建议，属于不同知识产权领域的独立咨询能力，而非实现版权存证所必需的实现细节。

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: L313-L367整段围绕“LOGO太像注册不了商标怎么办”“何时再申请商标”“提高商标申请成功率”等商标策略展开。虽然其中建议先做版权登记，但整体能力已扩展为商标申请策略咨询，与 manifest 所声明的版权确权、区块链存证工具不一致。

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The function reads an arbitrary local file and uploads its contents to a remote endpoint, which is a safety-relevant data transmission. Although the docstring says it uploads a file, there is no user-facing disclosure such as a prompt, warning, or log message in this code indicating that local file contents will be sent off-host.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The usage docstring states the output filename uses the Chinese term "证书", and the rest of the script renders fixed Chinese labels and certificate text. This imposes a specific language/locale on all users with no opt-in or alternative, which matches the policy category for forced language selection.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script retrieves identity credential records from a remote API and writes the returned data to a local JSON cache, which likely contains sensitive personal information such as credential IDs and names. Storing this data locally without minimization, encryption, access controls, or an explicit user-facing notice increases the risk of privacy exposure if the host is shared, compromised, or logs/artifacts are collected.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 84% confidence
• Finding: The single-word trigger '确权' is overly short and can match legitimate discussion that does not intend to invoke a sensitive workflow. In a skill that can initiate authentication and external data handling, even low-complexity accidental triggers create avoidable consent and privacy risk.

Static analysis

No suspicious patterns detected.