Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample
Security audit
爆款视频脚本拆解官（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local Chinese short-video script checker that reads a user-provided JSON transcript and prints an offline diagnostic report.
Install only if you want a Chinese-language, offline checker for spoken short-video scripts. It appears to keep transcript data local and does not use network access, but its output and rules are China-platform focused and the declared Write tool permission is broader than the inspected runtime needs.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file presents the skill name, summary, and primary usage guidance predominantly in Chinese, while only a minimal English description is provided. This effectively imposes a language preference without stating that the skill is Chinese-language only or offering the user a language-selection option.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file presents all guidance exclusively in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file’s natural-language instructions and examples define the engine entirely in Chinese and present Chinese-language analysis labels and outputs as the expected behavior. There is no indication that users can choose another language or locale, which matches the policy concern for forcing a specific language without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The function returns user-facing strings such as reasons, advice, status notes, disclaimers, and finding labels only in Chinese. Because the file provides no language-selection mechanism or documented locale constraint, it appears to enforce a single language on all users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file’s natural-language labels, comments, and matching lexicons are entirely Chinese and are tailored to Chinese short-video platforms and Chinese-script phrasing. There is no indication that language choice is optional or that the skill is explicitly scoped to Chinese-only users, which can violate a language/locale policy requiring user opt-in or clear justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file’s user-facing description, usage text, errors, and console output are entirely in Chinese, indicating a fixed language experience. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JSON file contains user-facing natural-language content that is exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation, and there is no indication here that the language is optional or region-specific.
- Content