AI搜索引擎诊断助手

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.0

Overview

This skill sends SEO/AEO article-review inputs to ai-skills.ai for analysis, and I found no hidden persistence, destructive behavior, or unrelated data access.

Install only if you are comfortable sending the article text, uploaded files, public URLs, and related SEO context to ai-skills.ai using your AISKILLS_API_KEY. Avoid submitting confidential, regulated, or secret-bearing material unless that external processing is approved.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill requires environment access for an API key and performs outbound network calls to an external service, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where a host agent may permit broader capabilities than users expect, increasing the risk of unintended secret use and external data transmission.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The top-level description uses broad natural-language triggers like helping whenever users ask whether an article can be cited by AI, without clearly defining boundaries or exclusions. Broad triggers can cause the skill to activate on loosely related prompts and route sensitive article text, files, or URLs to an external API when the user did not explicitly intend that behavior.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The description and instructions are entirely in Chinese, which effectively forces a specific language for users without stating that the skill is Chinese-only or offering an alternative language path. This is a natural-language locale constraint that is not explicitly justified as region-specific.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The 'when to use' section lists multiple broad scenarios and does not provide counterexamples or hard constraints on activation. In a host environment that auto-selects skills, this increases the chance of over-invocation and unnecessary disclosure of proprietary drafts, internal links, marketing plans, or URLs to the external API.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation describes submitting text, files, and URLs and shows that a runner sends parameters to the AI Skills API, but it does not warn users that their content will be transmitted to an external third-party service. This is dangerous because users may provide confidential drafts, unpublished content, credentials embedded in files, or internal URLs without informed consent, resulting in privacy, compliance, or data leakage issues.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill enables implicit invocation without any trigger constraints, exclusions, or narrowing conditions, which means it may be auto-selected in broader conversations than intended. This increases the risk of unintended activation, prompt-scope expansion, and misuse of the skill in contexts where SEO/AEO analysis is irrelevant or where user content could steer the skill in unsafe or privacy-impacting ways.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This JSON schema contains user-facing labels, descriptions, and messages exclusively in Chinese, such as the placeholder, field titles, and validation message. Because the file does not indicate that the skill is region-specific or offer a language/locale choice, it may violate the language/locale policy requiring user opt-in for forced language selection.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The user-facing question and skill name are written only in Chinese, and the rest of the form labels and descriptions continue this pattern. For a general skill manifest, this imposes a language/locale constraint without any visible opt-in, fallback, or statement that the skill is intended only for Chinese-speaking users.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: This code serializes the provided params and sends them to a remote HTTPS endpoint using API authentication headers. While the behavior may be expected for a runner, the file itself contains no docstring, comment, or user-facing log disclosing that user-supplied data is transmitted to an external service.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The billing error branch replaces the server-provided message with a hard-coded Chinese message. This imposes a specific language on users regardless of their locale or preference, which is a natural-language policy violation under the stated rules.

Static analysis

No suspicious patterns detected.