Security audit
Security checks for vulnerabilities and agentic risk
The skill is a writing helper for Bijian AI, but it loads workspace configuration as shell code and can send tokens and article content to an unpinned API destination.
Review before installing. Use only a trusted, private `.bijian_config`, do not place shell commands in it, and avoid workspace-supplied configs. Keep the API URL pinned to the legitimate Bijian HTTPS endpoint, use a limited-scope token if available, and do not provide confidential notes, credentials, unpublished business material, or private documents as reference content unless you intend to send them to Bijian.
SKILL.md:32Executable Workspace Configuration Enables Arbitrary Shell Command Execution
scripts/bijian_api.py:26Unrestricted API Base URL Can Redirect Credentials and Article Content
The skill invokes environment access and outbound network activity by sourcing a local config file and calling an external API, but it does not declare any explicit tool scope or permission boundary. This weakens reviewability and least-privilege controls, making it easier for a skill with code-like behavior to access secrets or transmit data without clear governance.
The manifest description specifies Chinese trigger phrases and the skill content consistently instructs the agent to interact in Chinese, but it does not offer any language choice or indicate that Chinese is an optional mode. This is a natural-language policy concern because it imposes a specific language/locale without explicit user opt-in or a documented region-specific justification.
The workflow instructs collecting user-supplied topic, viewpoints, and reference materials and sending them to an external AI service, but it does not clearly warn users that their content will leave the local system. This creates a real data-sharing risk, especially if users include private notes, unpublished material, credentials, or proprietary documents in the reference content.
The skill exposes API operations to list spaces, enumerate styles, poll tasks, fetch arbitrary article details, and list existing articles, which goes beyond the stated purpose of generating new content. In an agent setting, these read capabilities can be abused to inventory account resources and retrieve prior content without a clear user need, increasing the risk of unauthorized data access and prompt-driven exfiltration.
The articles command supports searching and listing content by space ID and keyword, enabling bulk discovery of existing account content unrelated to the writing-assistant workflow. In a conversational agent context, this is especially dangerous because a malicious or confused prompt could induce the agent to enumerate sensitive drafts or published materials and disclose them back to the user.