优稿公众号精美排版

• Outcome: Pass
• Latest audit: Nov 5, 2026 · 3:53 AM UTC
• Version: 1.4.0

Overview

The skill provides a coherent cloud formatting workflow with disclosed credential storage and user-directed controls.

Use a dedicated formatting-only API key. Article content is uploaded to Yougao during preview preparation, so submit confidential drafts only if that processing is acceptable. The key remains stored locally until disconnected, and website revocation is separate. Shared scripts include broader operations; keep requests limited to formatting. This review did not verify the remote service's retention practices or permission enforcement.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

These capabilities are reachable behavior, not merely unused names: the CLI accepts all six features, prepare() calls their preview endpoints, and execute() starts the selected feature. The script also explicitly handles publishing targets and workflow delivery modes of draft or publish. Approval gates reduce unintended execution but do not remove the undeclared capabilities. The code does not demonstrate publishing automatically by default; nevertheless, its supported publishing operations exceed the declared formatting-and-export scope. Connection configuration, task recovery, and local output files are supporting implementation details rather than independent mismatches.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The formatting and export functionality matches the description, and API authentication, local configuration, and file downloads are supporting implementation details. However, Client.call and the CLI explicitly expose unrelated generation, rewriting, and detection features, while dedicated publishing methods can initiate publishing workflows. These are callable capabilities, not merely unused imports. The code does not publish automatically upon launch, and actual publication depends on the server and supplied plan, but it is materially broader than the declared formatting-only, no-rewriting, no-automatic-publishing scope.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/vendor/mistune/list_parser.py (reported line 258)May include surrounding context.

python

]
    if "fenced_directive" in block.specification:
        rules.insert(1, "fenced_directive")
    return rules


def _match_list_item_break(

The formatting skill includes executable publishing operations unrelated to its stated formatting-and-export purpose.

High

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The skill is described as preparing editable manuscripts and HTML, not publishing them. Nevertheless, publishing_start sends a publishing start action, and the CLI makes that operation reachable through publish-start at L305–L306; the generic call command also exposes publishing actions without a skill-level restriction. This adds a remote publishing capability beyond what is needed to preview themes or export formatted content, even though this file does not establish that publishing happens automatically.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The formatting workflow does not warn that article content is sent to the external Yougao service.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The prescribed prepare command submits article content to Yougao for preview, before any later execution approval. Although the named service and API-key setup make cloud processing foreseeable, the workflow does not explicitly disclose this early transfer, which could expose confidential or unpublished material under an assumption that preview preparation is local.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/api.md (reported line 95)May include surrounding context.

md

## 各功能参数

| 功能      | input                                                                       | params                                                                                                                 |
| --------- | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| 文章生成  | brief 主题；可选 title、referenceText 参考正文、sourceImportId 已有导入记录 | style（最多200字）、prompt（6000字）、audience（200字）、length（100字）、titleRule（300字）                           |
| 文章改写  | text 原稿，可选 title；已有稿件用 manuscriptId 与 revision                  | 默认自然降 AI；style 可选深度降 AI、保留文风，prompt 补充要求                                                          |

The prepare-stage guidance omits disclosure that previewing sends article content to Yougao.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

The guidance emphasizes that prepare only validates and quotes, without stating that it sends the supplied article to the external API. Those statements do not literally promise offline processing, but they leave a material privacy distinction unclear: content leaves the environment before execute or its approval gate.

Content

No source excerpt is available for this finding.

The formatting skill exposes executable rewriting, generation, workflow, and publishing capabilities.

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The manifest limits this skill to formatting and editable/HTML delivery, explicitly excluding body rewriting and automatic publication. However, FEATURES at L021 and the CLI selection at L317–L318 expose unrelated operations, and L153 starts whichever feature the task specifies; the approval gate controls authorization but does not restrict this formatting skill's capabilities.

Content

No source excerpt is available for this finding.

The client exposes generation and rewriting operations despite the manifest's explicit promise not to rewrite article content.

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The manifest limits this skill to formatting and explicitly states “不改写正文” (do not rewrite the body). However, Client.call accepts generation and rewriting features and forwards arbitrary actions and parameters to those APIs; the CLI exposes these same features at L258–L260 and dispatches them at L296–L299 without a formatting-only restriction.

Content

No source excerpt is available for this finding.

The delivery instructions require a Chinese summary without offering a language choice.

Low

• Category: Output Handling
• Confidence: 96% confidence

Finding

The guide explicitly specifies that report.txt is a Chinese summary. It provides neither user opt-in nor a functional justification for fixing the summary language, so users requesting another language would still receive a mandated Chinese artifact.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/vendor/mistune/LICENSE (reported line 14)May include surrounding context.

text

* Neither the name of the creator nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.


THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/vendor/mistune/LICENSE (reported line 14)May include surrounding context.

text

* Neither the name of the creator nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.


THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/vendor/mistune/block_parser.py (reported line 108)May include surrounding context.

python

self.list_rules = list_rules
        self.max_nested_level = max_nested_level
        # register default parse methods
        self._methods = {name: getattr(self, "parse_" + name) for name in self.SPECIFICATION}

    def parse_blank_line(self, m: Match[str], state: BlockState) -> int:
        """Parse token for blank lines."""

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/vendor/mistune/inline_parser.py (reported line 118)May include surrounding context.

python

else:
            self.rules.append("softbreak")

        self._methods = {name: getattr(self, "parse_" + name) for name in self.rules}

    @property
    def max_nested_level(self) -> int:

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/vendor/mistune/plugins/__init__.py (reported line 48)May include surrounding context.

python

module_path, func_name = name.rsplit(".", 1)

    module = import_module(module_path)
    plugin = cast(Plugin, getattr(module, func_name))
    _cached_modules[name] = plugin
    return plugin