Security audit

广告与营销合规专家

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to run local video-script analysis, but its documentation overstates the compliance/table-routing purpose and it keeps an under-disclosed persistent trial counter that can block use and upsell a subscription.

Review this as a paid/trial local script-analysis tool, not a full advertising-compliance checker. Install only if you are comfortable with it writing a small persistent usage counter in your home directory and with its conclusions being structural script diagnostics rather than authoritative compliance findings.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明的主定位是“广告与营销合规专家”，但代码没有任何广告法、营销合规、违规词、平台规则之类的检测逻辑；其核心功能完全聚焦于短视频脚本拆解与优化建议。声明还强调用户贴入“表”后自动分诊，并在材料不足时说明缺失“列”，而代码只接受 text/transcript/script 等文本输入，对表格列、字段校验、子技能分诊均无实现。另一个明显偏差是“带原文行号”：代码内部保留的是句子分析与问题列表，run 输出中的 line 是 findings 的顺序编号，不是原文行号。虽然代码确实覆盖了“爆款视频脚本拆解官”这一子技能的大部分行为，但与整体声明的主目的和输入/输出方式存在实质不一致，因此应判定为描述与行为不匹配。

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --list # 看覆盖了哪些子问题
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --list # 看覆盖了哪些子问题
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --list # 看覆盖了哪些子问题
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --list # 看覆盖了哪些子问题
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --list # 看覆盖了哪些子问题
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The user-facing output claims all sub-skills are bundled locally and fully functional, while later logic can deny access because some engines are only available in a subscription version. In a security-sensitive agent ecosystem, this deceptive mismatch can mislead users and reviewers about what code is actually present and what capabilities are available, undermining trust and informed consent.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The documentation and list output say all sub-skills are bundled and local, but the runtime explicitly rejects some sub-skills as subscription-only. This contradiction is dangerous because it conceals the real trust boundary and distribution model, which can cause users to rely on inaccurate assurances about completeness and local-only behavior.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The skill’s primary display names, summary, and operational descriptions are entirely in Chinese, while the English description does not provide equivalent usage guidance or indicate that the skill is intentionally limited to Chinese-language users. This creates a natural-language locale constraint without user opt-in or clear justification, which matches the language/locale policy concern.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger keyword list contains broad terms such as '免费', '二创', and platform names that can match many unrelated user requests. In an agent-routing system, this can cause overbroad activation of the skill, leading to misrouting, unintended handling of user data, or policy-bypassing behavior if the wrong skill is invoked for sensitive requests.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: This code file contains extensive user-facing natural-language strings and comments describing behavior entirely in Chinese, including output messages later in the file. The policy allows locale constraints only when user choice or a justified region-specific limitation is stated, which is not present here.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: Returned fields such as reason, message, advice, note, and disclaimer are hardcoded in Chinese, which enforces a specific language in the skill's responses. There is no indication that users can opt into Chinese or select another locale.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The adapter claims outputs are traceable and line-based, but `run()` rewrites findings with synthetic `line: i + 1` values and drops real source/transcript positions. In a compliance-analysis skill, this undermines auditability and can cause users or downstream systems to trust incorrect evidence locations, leading to bad moderation or review decisions.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: This file’s natural-language comments, labels, and user-facing guidance are entirely in Chinese, including platform and CTA guidance. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a language/locale policy violation.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest describes a compliance-analysis skill that routes input to a sub-skill and returns line-referenced conclusions or states missing columns. In contrast, this code adds product-control behavior: it persists usage counts locally, blocks use after five runs, and later advertises paid subscription terms, which is not part of the described analysis function.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This file presents core CLI usage, errors, subscription notices, and results in Chinese only, which effectively forces a specific language for all users. The policy allows locale constraints only when explicitly justified or when the user is given a language/locale choice, neither of which appears in these runtime messages.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: The manifest presents the skill name only in Chinese via the "zh" field, with no indication elsewhere in the file that users can select another language or that the locale restriction is intentional and justified. This may conflict with language-choice policy if the skill is exposed to a broader audience without opt-in.

Description-Behavior Mismatch

Low

Confidence: 87% confidence
Finding: The stated skill description says one skill covers a broader advertising/marketing compliance category and will automatically route pasted tables to the appropriate subskill, but the manifest defines only one concrete subskill entry (`viral-script`) in this package. While coverage notes mention additional subscription-only subskills, the actual shipped manifest here does not implement the broader triage behavior it claims for this local package.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The only user-facing content in this template is written in Chinese, which implies a fixed language choice without any opt-in or alternative locale handling. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Static analysis

No suspicious patterns detected.