Security audit
Security checks for vulnerabilities and agentic risk
The skill performs the advertised article analysis, with disclosed account access, fees, and local report storage.
Use a key limited to detection with an appropriate spending limit, especially when reusing a shared connection. Submitted articles go to Yougao, and local exports retain their full text. Broader publishing and rewriting commands are bundled but are not part of the detection workflow. This source review resolved the scanner's reported coverage gap; it did not test the live service's permission enforcement.
检测路径与声明基本一致：代码调用服务、验证三类占比的数值及总和，并导出送检原文和分段结果，异常时不会显示分数。但 FEATURES、prepare 命令及通用 execute 路径明确开放了检测之外的五类功能，没有将该技能限制为只读检测。尤其改写会改变正文，发布会产生外部操作，均属于未声明的实质能力。费用和发布确认机制虽提供保护，但不会消除能力范围与描述之间的不一致。连接管理、任务恢复和本地文件导出本身属于支持性实现细节，不作为独立不匹配项。
代码的实际用途是生成文章排版预览，没有调用 AI 特征检测接口，也没有处理三类占比或分段检测报告。虽然使用了同一优稿客户端，但所调用服务的主要功能与声明用途存在实质差异。
就所提供的代码块而言，其行为与声明用途存在明显差异。该文件仅处理目录指令、标题 ID 和 HTML 输出，没有检测服务调用或 AI 特征分析逻辑。它可能是更大项目中的辅助依赖，但当前片段没有体现其与声明检测流程的关联；此结论不代表对未提供代码的判断，也不表明存在恶意行为。
The detection capability is consistent with the description, but the executable CLI exposes several materially broader capabilities. The call command accepts generation, rewriting, formatting, workflow, and publishing features; workflow commands can submit replacement text; and publishing commands can start operations and submit delivery decisions. These are callable behaviors rather than merely supporting implementation details. They require explicit invocation, so the code does not automatically rewrite or publish articles, but its available functionality still exceeds the declared detection-only purpose. Credential storage, authenticated requests, and result downloads are supporting details and are not independently treated as mismatches.
所提供代码没有调用优稿检测服务、获取 AI 特征占比或生成检测分段报告的逻辑；其可执行入口明确用于 Markdown 转换。该文件位于 vendor 目录，可能只是完整技能的辅助依赖，因此不能据此断言整个技能没有实现检测功能；但就所给代码块本身而言，其实际用途与声明用途明显不同。代码中未见网络传输或伪造检测分数的行为。
The visible code processes Markdown syntax locally; recognizing URLs and email addresses does not involve contacting a detection service. It shows no network requests, article submission, or AI-analysis results. Although this vendored parser could support report formatting elsewhere in the skill, that connection is not demonstrated by the supplied chunk. The mismatch concerns the visible primary functionality, not malicious activity or unauthorized resource access.
The supplied chunk implements a local document-inclusion feature, not a detection-service integration or detection-report generator. Its concrete capability is accessing and embedding local file contents, which the declared purpose does not describe. Although the vendor path suggests it may be a supporting dependency, the supplied code does not establish a connection between this inclusion capability and the declared detection workflow. No network submission, AI scoring, or three-category reporting is shown.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
]
if "fenced_directive" in block.specification:
rules.insert(1, "fenced_directive")
return rules
def _match_list_item_break(
Without declared permissions the skill's intent is opaque and cannot be validated.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 各功能参数
| 功能 | input | params |
| --------- | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| 文章生成 | brief 主题；可选 title、referenceText 参考正文、sourceImportId 已有导入记录 | style（最多200字）、prompt（6000字）、audience（200字）、length（100字）、titleRule（300字） |
| 文章改写 | text 原稿，可选 title；已有稿件用 manuscriptId 与 revision | 默认自然降 AI；style 可选深度降 AI、保留文风，prompt 补充要求 |
The manifest limits this skill to analyzing AI characteristics and delivering reports without modifying the article. However, FEATURES at L021 and the CLI at L317–L323 accept other services, prepare forwards their requests at L108, and execute starts them at L153, enabling paid content creation, modification, and publication rather than detection alone. Approval checks and server-side key permissions constrain execution, but do not make these additional capabilities necessary for detection.
In scripts/vendor/mistune/directives/include.py, L030–L035 resolve a directive-supplied filename beneath the source directory, and L070–L095 read that file and incorporate its contents into parsed output. Reading supplementary files requested by document markup is not an obvious requirement of detecting AI characteristics or delivering the submitted original and segmented report; the directory restriction limits access but does not tie it to explicitly submitted material. This capability is conditional on registering the include plugin and providing a source-file context; the supplied source does not establish that the skill enables it.
The manifest limits the skill to AI-content detection and explicitly states that it does not modify the article body. However, L197–L205 accept generation and rewriting operations, exposed through the CLI at L258–L259 and L296–L299; L325–L331 additionally allow replacement text to be submitted to workflow approval, supply, and resume operations.
The CLI can enumerate publishing accounts and manuscripts, create publishing plans, start publishing runs, and submit publishing decisions at L300–L314. These authenticated publishing capabilities are not needed to analyze AI characteristics or deliver detection reports, and the manifest does not declare them.
The instruction specifies that report.txt is a Chinese summary, fixing the output language without offering a user choice. No justification is provided for requiring Chinese regardless of the user's preferred language.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
* Neither the name of the creator nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
* Neither the name of the creator nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
self.list_rules = list_rules
self.max_nested_level = max_nested_level
# register default parse methods
self._methods = {name: getattr(self, "parse_" + name) for name in self.SPECIFICATION}
def parse_blank_line(self, m: Match[str], state: BlockState) -> int:
"""Parse token for blank lines."""
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
else:
self.rules.append("softbreak")
self._methods = {name: getattr(self, "parse_" + name) for name in self.rules}
@property
def max_nested_level(self) -> int:
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
module_path, func_name = name.rsplit(".", 1)
module = import_module(module_path)
plugin = cast(Plugin, getattr(module, func_name))
_cached_modules[name] = plugin
return plugin