Security audit

X 内容策略

Security checks for vulnerabilities and agentic risk

Overview

This X/Twitter strategy skill is coherent, but it defaults to storing and silently reusing account diagnosis data, so users should review its data-retention behavior before installing.

Install only if you are comfortable with the agent saving X account diagnostics and strategy notes locally. Before using account diagnosis, decide what account data may be stored, avoid providing private analytics unless needed, and manually review or delete user-data/x-content-mentor/<username>/ when you no longer want prior strategy reused.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly describes persistent storage of account history, diagnostics, and strategy artifacts under a user-specific directory, but does not require user consent, notice, retention limits, or deletion controls. Because this skill handles potentially sensitive social-media history and analysis outputs, default background persistence can create privacy, cross-session disclosure, and unauthorized reuse risks.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the system to silently read and reuse previously stored account strategy/history, which creates a meaningful data retention and context-leak risk across sessions. Silent reuse is especially risky in a content/account-diagnosis skill because prior reports, post samples, and strategic notes may contain sensitive business context or personal account information that later users or prompts did not explicitly authorize for reuse.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The default_prompt is broadly scoped and encourages routing any X/Twitter-related task into the skill without defining clear activation boundaries, exclusions, or safety constraints. This can cause over-invocation, misrouting, or inappropriate use of the skill in contexts where a narrower or policy-aware capability should be selected instead, which is a real security-relevant prompt-scope weakness even if not overtly malicious.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The entire template is written in Chinese and prescribes Chinese section headings and output fields, which implies the skill's output must use a specific language. Under the policy, forcing a specific language without offering the user a language or locale choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The template headings and field labels are written in Chinese throughout the file, which implicitly forces use of a specific language. The policy allows locale constraints only when they are explicitly justified or when the user is offered a language choice, neither of which appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Line L03 states the usage condition entirely in Chinese and the document consistently prescribes the workflow in Chinese, with no indication that users may choose another language. This creates a language/locale policy concern because the skill appears to assume a fixed language rather than offering opt-in or choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document instructs collection and local archiving of account analytics, post history, profile summaries, and reports under a persistent user-data directory, but it provides no minimization, retention, consent, access-control, or deletion guidance. In an agent context, this can lead to unnecessary retention of personal or sensitive account data, accidental cross-user exposure, or processing beyond what the user expected.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The heading note is written as an instruction in Chinese, indicating the skill is intended to be used in that language/context. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified or optional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file contains user-facing instructions exclusively in Chinese, and there is no indication that the skill is intended only for Chinese-speaking users or a China-specific workflow. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This section explicitly instructs Chinese creators on how to produce content for '英文 X' and recommends what they should or should not post in that language context. Because the file does not present this as an optional mode or offer a language choice, it can be read as forcing a specific language/locale without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file mixes prescriptive Chinese instructions with a dedicated section on how to write for '英文 X', but nowhere indicates that language selection is optional or based on user preference. This can violate language/locale policy because it steers output style by language without explicit opt-in or a stated region-specific justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The default contract says output explanations use Chinese unless the user specifies otherwise. This is a language-policy constraint applied by default rather than offered as a user choice, which can violate locale or language preference expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The display name and short description are in Chinese, while the default prompt is in English, which implies a language preference or mixed-locale behavior without stating how the user's language is determined. This can violate language/locale policy expectations when no user opt-in or explicit locale handling is documented.
Content: No source excerpt is available for this finding.