优稿本机一键分发

• Outcome: Pass
• Latest audit: Nov 5, 2026 · 4:15 AM UTC
• Version: 1.4.0

Overview

This skill provides a disclosed, user-directed publishing workflow with shared account access and optional automatic delivery.

Use a publishing-only key and verify the manuscript, destination accounts and draft/publish mode before authorizing execution. Content goes through Yougao, and the saved connection is shared with its other skills. Set spending limits for any paid tools and enable automatic delivery only intentionally. Disconnecting locally does not revoke the key. This review covers the bundled files, not the separate server or PC client.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (19)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code calls the 'formatting' service's 'preview' operation. It does not specify platform accounts, deliver content to a local PC, create drafts, submit content, or query delivery receipts. Its demonstrated purpose is formatting preview, which materially differs from the declared distribution workflow; the snippet does not establish that formatting is a supporting step in that workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Publishing behavior aligns with the description: the code starts publishing tasks, queries individual destination receipts, and explicitly distinguishes submission from public availability. However, FEATURES and the prepare/execute CLI also expose five other service categories, including standalone generation, rewriting, detection, formatting, and general workflows. These are independently executable content-processing capabilities, not merely implementation details supporting manuscript delivery. Connection management, task persistence, cost confirmation, and local exports are supporting functionality and are not independently flagged.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The publishing functionality substantially matches the description, including separate preview/start operations and subsequent status queries rather than treating task creation as publication. However, the executable CLI also exposes non-publishing features through its generic call command and general workflow commands. These are substantive additional capabilities, not merely implementation details supporting manuscript distribution. API authentication, local connection storage, and network requests are supporting mechanisms and are not independently treated as mismatches. The supplied code delegates publishing to the API; it does not itself automate local platform sessions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The chunk implements input parsing, Markdown rendering, and local output. It contains no PC delivery mechanism, platform-account interaction, draft submission, publication continuation, or receipt queries. Markdown rendering could support a broader publishing workflow, but this file exposes a standalone converter and does not establish that integration. The mismatch concerns the supplied chunk's primary behavior, not evidence of malicious activity or a conclusion about unseen skill code.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied code's implemented purpose is document inclusion and rendering. It contains no PC delivery mechanism, platform-account interaction, draft or publishing operations, or receipt queries. Although a vendored Markdown component could support a larger application, the supplied chunk does not establish that connection. The mismatch is functional scope, not evidence of malicious behavior or unrestricted filesystem access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied chunk registers Markdown parsing rules and HTML renderers. It contains no local-PC communication, platform-account operations, draft saving, submission, task continuation, or receipt queries. Markdown rendering could support a larger publishing application, but this chunk alone implements a materially different function and does not substantiate the declared workflow. No network access, credential access, or other sensitive side effects are shown.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied chunk's purpose is document formatting. It contains no local-PC communication, platform-account handling, draft submission, publishing-task continuation, or receipt queries. Although the vendor path suggests a dependency that could support a larger application, this chunk provides no connection to the declared workflow. The mismatch concerns the functionality shown, not evidence of malicious behavior or a conclusion about unseen code.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The supplied code implements a materially different function from the declared workflow. It contains no local-PC delivery, platform-account interaction, publishing-task continuation, or receipt querying. Its location under vendor/mistune suggests it could be a supporting dependency, but no connection to the declared workflow is demonstrated here. This assessment is limited to the supplied chunk; it does not establish that the complete skill lacks the declared functionality or performs malicious actions.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/vendor/mistune/list_parser.py (reported line 258)May include surrounding context.

python

]
    if "fenced_directive" in block.specification:
        rules.insert(1, "fenced_directive")
    return rules


def _match_list_item_break(

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/api.md (reported line 95)May include surrounding context.

md

## 各功能参数

| 功能      | input                                                                       | params                                                                                                                 |
| --------- | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| 文章生成  | brief 主题；可选 title、referenceText 参考正文、sourceImportId 已有导入记录 | style（最多200字）、prompt（6000字）、audience（200字）、length（100字）、titleRule（300字）                           |
| 文章改写  | text 原稿，可选 title；已有稿件用 manuscriptId 与 revision                  | 默认自然降 AI；style 可选深度降 AI、保留文风，prompt 补充要求                                                          |

The publishing skill exposes executable content-generation, rewriting, detection, and formatting operations unrelated to its stated publishing purpose.

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

In scripts/skill_client.py, L351–L388 construct and preview standalone creation and transformation requests, including article generation; L021 exposes these features alongside publishing. These are operational capabilities, not just reference documentation: L153 starts the selected feature and can incur charges. Delivering existing manuscripts and continuing saved publishing tasks does not require exposing standalone paid content-creation operations.

Content

No source excerpt is available for this finding.

Publishing skill exposes unrelated content-processing and workflow execution capabilities.

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The manifest describes delivering existing manuscripts to local publishing accounts and querying publishing receipts. However, L197–L220 implement calls to generation, rewriting, detection, formatting, and general workflow execution, exposed through the CLI at L258–L259 and L296–L299. These are independent content-processing capabilities, not necessary implementation details of publishing delivery, and can initiate operations outside the stated purpose.

Content

No source excerpt is available for this finding.

The delivery instructions require report.txt to contain a Chinese summary without offering a language choice.

Low

• Category: Output Handling
• Confidence: 96% confidence

Finding

L46 specifies that report.txt is a Chinese summary (「中文摘要」), imposing a particular output language. The file provides neither user opt-in nor a justification requiring Chinese-language summaries.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/vendor/mistune/LICENSE (reported line 14)May include surrounding context.

text

* Neither the name of the creator nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.


THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/vendor/mistune/LICENSE (reported line 14)May include surrounding context.

text

* Neither the name of the creator nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.


THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/vendor/mistune/block_parser.py (reported line 108)May include surrounding context.

python

self.list_rules = list_rules
        self.max_nested_level = max_nested_level
        # register default parse methods
        self._methods = {name: getattr(self, "parse_" + name) for name in self.SPECIFICATION}

    def parse_blank_line(self, m: Match[str], state: BlockState) -> int:
        """Parse token for blank lines."""

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/vendor/mistune/inline_parser.py (reported line 118)May include surrounding context.

python

else:
            self.rules.append("softbreak")

        self._methods = {name: getattr(self, "parse_" + name) for name in self.rules}

    @property
    def max_nested_level(self) -> int:

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/vendor/mistune/plugins/__init__.py (reported line 48)May include surrounding context.

python

module_path, func_name = name.rsplit(".", 1)

    module = import_module(module_path)
    plugin = cast(Plugin, getattr(module, func_name))
    _cached_modules[name] = plugin
    return plugin