抖音口播爆款文案生成-教育类

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:13 AM UTC
• Version: 2.0.0

Overview

This skill is a Chinese Douyin education-copywriting workflow with local quality-check scripts and no hidden install, persistence, or data-exfiltration behavior.

Install this only if you want a Chinese-language Douyin education-copywriting workflow. Review any generated claims and platform-rule citations manually before publishing, since the scripts flag items for review but do not prove factual accuracy or current compliance.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a content-generation skill for education-focused short-video copywriting with multiple specialized features: a golden six-part structure, hook templates, methodology, fact/data verification, quality gates, and compliance updates. The actual code does not generate any copy at all. Its primary function is to score an existing text for 'AI smell' using hardcoded keyword lists, structure heuristics, and connector-density metrics. While this could be considered a supporting component of a broader quality gate, the supplied chunk alone is materially different from the declared primary purpose and does not implement most of the advertised capabilities. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

There is a clear description-behavior mismatch. The description promises a content-generation skill for education Douyin scripts, including specific writing frameworks, hook templates, methodology, data checking, and machine-verifiable quality gates. The code provided does none of that generation work. Instead, it implements a local Python CLI tool that reads text and checks it against hardcoded keyword lists for compliance risks such as absolute claims, promised outcomes, third-party traffic diversion, exaggeration, anxiety-selling, variants, and value/redline phrases. While compliance checking loosely relates to the declared mention of quality/compliance, it is not the declared primary purpose, and several core promised capabilities are missing entirely. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

描述把技能定位为“生成教育类抖音口播爆款文案”的创作工具，并强调结构化生成、钩子模板和教育方法论。可实际代码仅是质量门禁入口：读取文本或文件，调用 check_ai_tone.py、verify_facts.py、check_compliance.py 三个子脚本，对现有文案进行检测并给出判定结果。虽然描述中也提到‘数据核验 + 质量门禁’，与代码部分吻合，但当前代码片段的主要行为并不是生成文案，而是审核文案质量。因此该片段与声明的核心用途存在实质性偏差。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

声明的核心能力是“生成教育类爆款口播文案”，并强调结构化生成、钩子模板、方法论、数据核验和质量门禁。但这段代码的实际功能非常单一，只是一个离线文本分析工具，用正则和关键词扫描文案中的数字、年份和政策相关词，生成待人工核验的清单。它明确写明“不负责准确性判断”，也没有联网搜索、来源校验、合规更新、文案生成或风格控制逻辑。因此，代码行为只覆盖声明中的一个很小的辅助子功能（事实核验提示），与所宣称的主要用途和主要能力存在明显不匹配。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire skill documentation is written in Chinese and describes a China-specific Douyin copywriting workflow, but it does not explicitly state that the skill is limited to Chinese-language output or offer users a choice of language/locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring, command help, output messages, and detection vocabulary are all written specifically for Chinese, and the detector logic itself relies on Chinese phrases and punctuation. This imposes a fixed language/locale behavior without any opt-in or documented limitation, which matches the language-policy concern for files of any type.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring, CLI description, usage text, and all user-facing output are written only in Chinese, which imposes a specific language on users without any opt-in or alternative locale support. The policy explicitly calls for flagging language or locale constraints when the skill forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring, CLI description, usage examples, status labels, and explanatory text are all presented only in Chinese. This creates a natural-language locale constraint without any opt-in, fallback, or indication that the tool is intentionally region-specific.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/quality_gate.py (reported line 27)May include surrounding context.

python

"""调用子脚本，返回 (exit_code, parsed_json)"""
    cmd = [sys.executable, os.path.join(SCRIPT_DIR, script), "--json", text]
    try:
        proc = subprocess.run(cmd, capture_output=True, text=True, encoding="utf-8", timeout=30)
        data = json.loads(proc.stdout) if proc.stdout.strip() else {}
        return proc.returncode, data
    except Exception as e:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The argparse description, argument help strings, and usage/error output are all hard-coded in Chinese. Because the file provides no user choice of language and no documented region-specific justification, this is a locale policy violation under the natural-language policy rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code file contains natural-language instructions and output that assume Chinese-language use exclusively. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in is a violation unless the regional/language limitation is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document explicitly states "中文：为教育类抖音口播提供..." as the operating language, but nowhere offers a language or locale choice for users. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation unless clearly justified as region-specific and documented as such.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that humans must approve at interrupt points and that the AI must not self-finalize, but the fallback logic later permits fully automatic completion after repeated non-cooperation. This creates a governance bypass: a user can intentionally give invalid or empty replies to force the model into autonomous generation, weakening the intended safety review for factual accuracy and compliance-sensitive education marketing content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file's natural-language content is exclusively Chinese, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.