viral-article-deconstructor

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:00 AM UTC
• Version: 1.0.0

Overview

This is a Markdown-only skill for analyzing viral Chinese articles, with no evidence of code execution, persistence, hidden authority, or data exfiltration.

This skill is reasonable to install for Chinese-language content analysis. Users should treat its persuasive-writing advice as analytical, not proof of intent, and the publisher should remove or sanitize the token-like query parameter from the captured URL before redistribution.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

• Location: url-to-markdown/mp.weixin.qq.com/page.md:2

Finding

Plaintext URL Token Stored in Captured Content

Content

View full analysis

Vulnerability Details

File Location: url-to-markdown/mp.weixin.qq.com/page.md, line 2
Vulnerability Type: Plaintext exposure of token-like URL data
Risk Level: Low

Vulnerable Code

yaml

url: https://mp.weixin.qq.com/s/9zw_m0pwL0pzOy_8efy_aQ?poc_token=HHx0smmjqqNTpt4KMwjMSd1ae1ZrbcnqNQj0S_8g

Technical Analysis

The captured page metadata stores a poc_token query parameter in plaintext. URL query parameters may be copied into repositories, logs, generated documents, browser history, analytics systems, and downstream exports. If this value provides access control or request validation and remains valid, anyone who can read the project could attempt to replay it.

Static analysis cannot establish whether the token is currently valid, secret, or privileged. The finding is therefore rated Low, but the value should still be treated as potentially sensitive and removed according to secure data-handling practices.

Attack Path

1. An attacker obtains read access to the project or a derived artifact.
2. The attacker opens url-to-markdown/mp.weixin.qq.com/page.md.
3. The attacker extracts the poc_token value from line 2.
4. The attacker replays the complete URL in a request to the remote service.
5. If the token remains valid and conveys access, the service returns the associated resource or permits whatever operation the token authorizes.

This path is conditional on the remote service accepting the token and the token conferring access.

Impact Assessment

The maximum obtainable privileges cannot be determined from the repository alone. Plausible impact is limited to the remote resource or request scope authorized by the exposed token. No evidence indicates local code execution, host compromise, privilege escalation, persistence, or broader account access.

Remediation

View remediation

Remediation Suggestions

1. Remove the query string and retain only the canonical article URL:

   yaml

   url: https://mp.weixin.qq.com/s/9zw_m0pwL0pzOy_8efy_aQ
   

2. Revoke or rotate the exposed token if the remote service supports doing so.
3. Review repository history and generated artifacts for retained copies, removing them where practical.
4. Add URL sanitization to the capture process so sensitive parameters such as tokens, signatures, session identifiers, and access keys are stripped before content is persisted.
5. Maintain an allowlist of query parameters that are safe to retain rather than relying only on a denylist.
6. Add secret scanning to the commit or publication workflow to detect token-like query parameters.

SkillSpector

Vulnerability Patterns

• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · url-to-markdown/mp.weixin.qq.com/page.md (reported line 4)May include surrounding context.

md

---
url: https://mp.weixin.qq.com/s/9zw_m0pwL0pzOy_8efy_aQ?poc_token=HHx0smmjqqNTpt4KMwjMSd1ae1ZrbcnqNQj0S_8g
title: "聊聊某科的这次大瓜：关于规模化及其他"
description: "耐人寻味的大瓜！"
author: "吃瓜的"
captured_at: "2026-03-12T13:44:04.709Z"
---

# 聊聊某科的这次大瓜：关于规模化及其他

![图片](https://mmbiz.qpic.cn/sz_mmbiz_jpg/jlfc4uXeleuVIZffoGLLSNeWfpPb0DyicXyH1pLxCgPRlrUufdDAgBEzgO6iafBOLyb8WpLM7OExLTOSRgv5nibEg/640?wx_fmt=jpeg&from=appmsg&tp=webp&wxfrom=5&wx_lazy=1#imgIndex=0)

![图片](https://mmbiz.qpic.cn/mmbiz_png/AuErFTB1xOhDMjnp90Id7T0nj8EuxicxnphjalWAS8OcVaFCaHMmjcibPtPhiaibTGLOenON9DCKgZ9zKXVEE6eRbrEXhLXLc6yodEh0Aic3jfFY/640?wx_fmt=png&from=appmsg&tp=webp&wxfrom=5&wx_lazy=1#imgIndex=1)

一早起来

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file consistently presents the skill description and operating instructions only in Chinese, which effectively forces a specific language on users. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The analysis fabricates a '社群引流' and overseas tour promotion that do not appear in the quoted source article. In a skill whose purpose is to deconstruct persuasive tactics, invented evidence is dangerous because it misattributes manipulative or commercial intent to the source and can systematically mislead downstream users relying on faithful content analysis.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The emotional-curve section claims a final lead-generation/action-conversion step that is absent from the original article. This introduces fabricated behavioral intent into the analysis, which can distort reader judgment and reduce trust in the skill's outputs, especially when users may reuse the analysis for research or marketing decisions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The reusable 'viral logic' section asserts a content-to-community-to-commercial funnel not evidenced in the article. Because this skill is designed to teach repeatable '爆款' patterns, unsupported claims are particularly risky: they can propagate false analytical heuristics and cause users to imitate strategies that were never actually present.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown file is entirely written in Chinese and does not indicate that Chinese is optional, user-selected, or required for a documented region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file contains user-facing content exclusively in Chinese and does not offer an alternative language or state that the skill is intentionally limited to a Chinese-language audience. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.