Security audit
Security checks for vulnerabilities and agentic risk
This skill mainly edits and stores local article drafts, but it advertises public auto-publishing and AI-authorship concealment without enough safeguards or accurate implementation.
Review carefully before installing. The shipped code appears locally scoped, but the skill text encourages AI-authorship concealment and describes high-impact public publishing actions that are not implemented or sufficiently bounded. Do not provide account credentials or authorize publishing unless the skill is revised to require explicit previews, confirmations, privacy handling, and accurate feature claims.
The README advertises '自动发布文章' but provides no warning that the skill may post content to an external public platform. For a publishing assistant, this is especially risky because users may not understand that generated or modified content could be pushed live, causing unintended public disclosure, reputational harm, or unauthorized posting.
The skill description promises automatic publishing, image generation, and broad official-account automation, while the implementation reportedly only performs lightweight local draft management. This mismatch is dangerous because users may authorize sensitive actions or provide credentials under false assumptions, creating a trust gap that can conceal overclaiming, shadow functionality, or future bait-and-switch behavior.
The invocation examples are generic natural-language phrases like '写一篇公众号文章' and '自动发布文章' without any explicit trigger prefix, confirmation requirement, or scope limitation. In an agent environment, broad phrases can be invoked accidentally during normal conversation and may cause the skill to perform sensitive actions such as drafting or publishing content without clear user intent boundaries.
The skill advertises capabilities that imply file-based helper scripts, but the manifest does not declare any explicit tool scope or permissions. Missing scope declarations reduce transparency and can cause the agent runtime to grant broader-than-expected local file access, making it harder for users and reviewers to understand what the skill can touch.
The skill explicitly markets rewriting AI-generated content so it appears fully human-authored and 'cannot be recognized as AI-written.' This is deception-oriented functionality that can facilitate academic dishonesty, platform policy evasion, undisclosed synthetic content, and fraud by helping users conceal the true origin of generated material.
The skill promotes automatic publishing, scheduled pushes, and one-click bulk sending without a prominent warning that these are high-impact account actions. In the context of a public-account assistant, this increases the risk of accidental mass posting, reputational damage, and abuse of a linked account if the feature is triggered unintentionally or by a misleading prompt.
The examples and techniques go beyond neutral editing by teaching users to fabricate personal experiences, emotional reactions, colloquialisms, and 'imperfect' expression specifically to disguise AI authorship. In context, this materially increases the deceptive nature of the skill because it instructs users how to simulate human provenance rather than merely improve readability.
The workflow instructs users to grant API access, upload content and images, and analyze user behavior, but it provides no privacy, retention, or data-handling notice. Because this involves account credentials, content assets, and behavioral analytics, the lack of disclosure can lead to unauthorized collection, oversharing, or mishandling of sensitive operational data.
The article promotes a '生活记忆记录器' that stores birthdays, anniversaries, preferences, allergies, and commitments—personal data that can be sensitive, especially health-related dietary restrictions/allergies. It presents collection and retention of this data as a feature without mentioning consent, minimization, retention limits, access controls, or privacy notice requirements, which creates privacy and compliance risk if implemented as described.
The skill explicitly promotes making AI-generated content appear human-authored ('AI 降味'). While not a technical exploit primitive, this is a policy and trust/safety issue because it facilitates deceptive content generation and can be used to mislead audiences about authorship or authenticity. In a content-publishing assistant, that context makes the behavior more concerning because it directly supports scalable distribution of disguised synthetic text.
The manifest describes support for '自动发布文章' and '智能配图生成', which imply publication workflows and image creation. In this file, main() exposes only text rewriting, title generation, local article creation, and article listing; there are no network calls, publishing APIs, or image-generation routines anywhere in the implementation.
The user-facing help text encourages users to submit text to be made 'more like human writing,' reinforcing deceptive use rather than neutral editing. Because this is presented as a primary feature in an article assistant, it lowers friction for misuse in public-facing publishing workflows and increases the likelihood of deceptive content at scale.
The natural-language instructions and usage examples are entirely in Chinese, and the file does not indicate that language choice is optional or that the skill is intentionally restricted to a Chinese-speaking or region-specific audience. This may constitute a language policy issue if users are not given a choice or informed of the locale limitation.
The inline feature description presents automatic typesetting as a current capability. However, the implementation only prepends metadata and truncates content in format_article(), without performing substantive layout or formatting operations that match the claim.
