图文笔记发布

• Outcome: Review
• Latest audit: Aug 14, 2026 · 6:05 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent publishing helper, but it can send local note content and images to a user-chosen backend and bulk-publish without a confirmation step.

Review this before installing if the backend is not fully trusted. Use only a backend you control or trust, avoid sensitive drafts, check exactly which file or directory will be published, and be careful with batch mode because it has no confirmation or dry-run safeguard.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill instructs use of environment variables, local file reads, and shell commands, but does not declare permissions for those capabilities. In a skill that orchestrates publishing from local markdown and images to a user-supplied backend, these capabilities are expected, but undeclared access weakens transparency and policy enforcement and can lead to unintended exposure of local content or configuration if the skill is executed in a permissive runtime.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: To recover note_id, the skill calls get_my_profile and reads the user's feed history, which exceeds the stated minimal publishing scope and may expose more account data than necessary. In this skill context, that is more dangerous because users are told it only handles login/publish orchestration, creating a privacy and over-collection mismatch.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly instructs users to configure an arbitrary MCP backend and describes sending markdown content, images, and login-state-dependent publishing through it, but does not clearly warn that all post content and associated media will be transmitted to that backend. In this skill’s context, the backend is user-specified and potentially untrusted, so missing disclosure increases the risk of accidental data exfiltration, credential/session abuse, or publication through a malicious service.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The trigger phrases include broad terms such as ‘笔记发布’, ‘登录发布’, and ‘发布失败重试’, which can overlap with ordinary user requests and cause the skill to activate unexpectedly. In this skill’s context, accidental activation is more concerning because it can read local files and initiate publishing workflows against a configured backend, increasing the chance of unintended actions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Batch mode publishes every .md file in a directory to the configured remote backend without a confirmation or dry-run step. In a publishing skill, this increases the chance of accidental bulk disclosure of markdown content and local image paths, especially if the directory contents are broader than intended or the backend is misconfigured.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Single-note publish transmits the full note text and resolved image paths to a remote MCP endpoint immediately after local parsing, with no execution-time confirmation or trust disclosure. In this skill's context, that matters because the backend URL is user-configurable, so content may be sent to an unintended or malicious service if misconfigured.

Unvalidated Output Injection

High

• Category: Output Handling

Content

"-X", "POST", MCP_URL, "-H", "Content-Type: application/json",
        "-d", json.dumps(init_payload),
    ]
    p = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
    sid = ""
    for line in p.stdout.splitlines():
        if line.lower().startswith("mcp-session-id:"):

• Confidence: 76% confidence
• Finding: subprocess.run(cmd, capture_output

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.