Security audit

COS后期提示词

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed COS photo prompt generator, with some local file-writing and learning behavior users should understand before installing.

Install this if you want a Chinese COS photo-editing preset generator. Be aware it may save generated JSON preset files into Downloads and can persist confirmed new style entries into its own learned-style reference file; review learned entries before accepting them and avoid using the skill for unrelated general style discussions.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to write files into the user's Downloads directory by default, even though its core function is generating JSON text. Unnecessary local file writes expand the skill's side effects, can create user confusion or overwrite/clutter files, and normalize filesystem access beyond what is needed for the task.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill includes a self-modification path that appends new entries to 'references/styles-learned.md'. Allowing a skill to persist user-influenced content into its own knowledge base creates a prompt/policy injection surface for future runs and can poison later outputs in ways that are hard to audit.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs local file creation in the user's Downloads folder without prominent warning or a clear consent flow. Even if the content is only JSON, undisclosed filesystem side effects reduce user control and can be abused or misapplied when the skill is triggered too broadly.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The file instructs the agent to activate on very broad style-related phrases such as everyday aesthetic descriptors, which can cause the skill to trigger even when a user is making a general request rather than asking for this specific skill. Overbroad activation increases the chance of unintended tool use, response hijacking, and poor routing, especially because the skill is framed as something that should '务必使用' whenever these terms appear.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger-word cheat sheet lists many broad keywords without guardrails, making activation likely for unrelated conversations about art style, aesthetics, or image analysis. Because the list lacks constraints, disambiguation, or examples of when not to trigger, the skill can overtake normal assistant behavior and invoke itself in contexts outside its intended scope.

Static analysis

No suspicious patterns detected.