Security audit

小红书种草笔记（自动配图）

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese article-and-image generation skill that sends user-provided parameters to the AI Skills API, with no evidence of hidden execution, persistence, local data harvesting, or destructive behavior.

Install only if you are comfortable sending the supplied topic, audience, keywords, and brand requirements to ai-skills.ai using your API key. Avoid confidential drafts, customer data, or unreleased business plans unless that external service is approved for them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill requires network access and reads environment-based secrets but does not declare any explicit tool scope or permissions boundary. That makes the skill harder to review and govern, and increases the risk that it can transmit user input and API credentials to an external service without sufficiently visible consent or policy enforcement.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger description is broad enough that the skill may activate for loosely related content-creation requests, causing users to invoke an external API when they may not expect it. Overbroad routing increases the chance of accidental data sharing, especially when prompts may contain unpublished drafts, brand guidance, or sensitive business material.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The usage scenarios remain very open-ended and do not constrain what kinds of source material may be submitted. In context, this skill is designed for content generation and analysis, so users may paste internal plans, customer information, or embargoed marketing text into a workflow that forwards data off-platform.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The documentation describes direct calls to the AI Skills API but does not clearly warn users that their inputs are transmitted to an external third-party service. This is a meaningful transparency and privacy failure because users may submit sensitive drafts, brand requirements, or audience data without informed consent.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The deliverables specify a '完整中文图文文章', which indicates the skill is constrained to Chinese output. The document does not present this as a user-selectable option or explain a justified region-specific requirement, making it a natural-language locale policy concern.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The skill display name and description are entirely in Chinese, and the default prompt also references the skill in Chinese without offering any language choice. This can violate language/locale policy expectations when users are not explicitly opting into a Chinese-only experience or when no region-specific justification is documented.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: This JSON schema contains user-facing labels and descriptions in Chinese, beginning with fields such as the advanced settings label. The file does not indicate that the skill is region-specific or provide any user opt-in or language-selection mechanism, which can violate a language/locale policy requiring user choice.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger question "自动公众号和种草?" is broad and overlaps with normal user requests about content creation, social posting, or marketing help. This can cause unintended auto-invocation of the skill in situations where the user did not explicitly choose it, increasing the chance of over-collection of user context or unexpected downstream API execution.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The HTTP 402 handling hard-codes a Chinese-language message (`余额不足，请前往 ... 充值后重试`) for all users. This is a natural-language locale policy issue because the script does not offer a language choice or document that it is intentionally limited to Chinese-speaking users.

Natural-Language Policy Violations

Low

Confidence: 75% confidence
Finding: Natural-language fields such as the invocation question, titles, labels, and descriptions are exclusively in Chinese, and the manifest does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-language audience. This can amount to forcing a specific language without explicit opt-in.

Static analysis

No suspicious patterns detected.