Daily Poem

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:01 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent poetry helper with disclosed optional scheduling and no evidence of hidden code execution, credential access, exfiltration, or destructive behavior.

Install only if you want a Chinese-first poetry assistant. Enable the cron commands only when you intentionally want recurring daily and weekly poem prompts, and use the documented cron list/delete commands to review or remove them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description presents a fairly full-featured daily poem agent with scheduled delivery, weekly collections, poem sourcing, and specialized literary annotation features. The actual code chunk only implements a narrow on-demand query helper: it parses CLI arguments, sanitizes a keyword, and prints a formatted instruction for selecting and presenting a poem. This partially overlaps with the declared on-demand query capability, but the primary advertised features—daily morning delivery, weekly digest, rotation policy, and meter/tonal marking—are absent from the supplied code. There are no suspicious undeclared permissions or external resource accesses, but the behavior shown is materially narrower than the description, so this is a mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

node scripts/morning-push.js

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

node scripts/morning-push.js

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

node scripts/morning-push.js

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

node scripts/morning-push.js

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

node scripts/weekly-digest.js

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

node scripts/weekly-digest.js

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

node scripts/weekly-digest.js

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description lists broad trigger words such as "poetry", "poem of the day", and "send me a poem" without clear constraints or exclusion conditions. These phrases can easily occur in ordinary conversation and may cause unintended invocation because the skill does not define when it should not activate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The "何时使用" section mixes direct user commands with broad phrases like "唐诗宋词" and automatic behaviors like weekly sending, but it does not clearly distinguish explicit invocation from background push behavior. This ambiguity makes it unclear when the skill should activate versus when it should remain inactive.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill advertises automatic daily and weekly scheduled pushes and includes cron setup commands, but it does not clearly foreground consent, persistence, and environmental effects before enabling recurring tasks. In an agent environment, silent or poorly disclosed scheduling can create unwanted persistent behavior, notification spam, or modification of the user's automation setup without informed approval.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file’s user-facing descriptions and command guidance are entirely in Chinese, including usage explanations and operational status messages. For a general-purpose toggle script, this imposes a specific language without any opt-in, fallback, or documented regional justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script sets the default language to 'zh' when the user does not provide a --lang option. This imposes a specific language by default rather than offering a neutral choice or prompting for user preference, which is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sets the default language to 'zh' when no --lang argument is provided. This imposes a specific language choice by default rather than offering a neutral prompt or explicit user opt-in, which matches the locale policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The language rule specifies "默认中文；用户英文提问切英文", which imposes a default language behavior rather than offering the user an explicit language or locale preference. This can violate language-choice policy expectations when the skill is bilingual and not clearly limited to a Chinese-only context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The script sets the default language to 'zh' when no --lang argument is provided, and the generated prompts are then entirely Chinese unless the caller explicitly opts into English. This creates a language-policy concern because the skill behavior forces a specific language by default rather than presenting a neutral choice or clear opt-in.

Content

No source excerpt is available for this finding.