优稿降 AI 改写

• Outcome: Pass
• Latest audit: Nov 5, 2026 · 4:03 AM UTC
• Version: 1.4.0

Overview

The rewriting workflow is coherent and controlled, but requesting a price quote already sends your article to Yougao.

Use a Key limited to rewriting, adding detection only if needed, and set a spending limit. Only supply articles you authorize Yougao to receive: preparation uploads the text even if you never approve execution. Credentials and article files remain locally until removed; disconnecting does not revoke the website Key. Provider-side retention was not established by the bundled artifacts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (22)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The code explicitly exposes six executable feature categories through FEATURES and the prepare/execute commands, rather than restricting operation to rewriting and associated detection. Generation, standalone formatting, and publishing are substantive capabilities absent from the declared purpose. Publishing and draft delivery have approval checks, but authorization safeguards do not make those capabilities declared. Connection management, task recovery, cost previews, and local exports are supporting implementation details and are not independently treated as mismatches. The rewriting itself is delegated to an external service, so this chunk does not establish whether factual preservation is achieved.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

代码明确调用 formatting 服务的 preview 操作，参数指定排版主题 warm；这属于版式处理，与声明的自然化改写、降低 AI 特征在主要用途上不同。所提供代码未执行改写或检测，也没有证据表明该排版调用是声明功能的必要辅助步骤。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Rewriting and detection support align with the description, and credential storage, input-file reading, networking, and result downloads are ordinary supporting details. However, the code explicitly exposes generation, formatting, and a substantial publishing interface through both client methods and CLI commands. Its generic feature/action interface also permits workflows outside the declared rewriting scope. These are substantive additional capabilities, not merely implementation details. The code delegates text processing to the remote API, so preservation of facts and reduction of AI-like characteristics cannot be verified from this chunk. No automatic publishing or malicious exfiltration is demonstrated; the mismatch concerns the broader exposed functionality.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied code contains no rewriting-service invocation, AI-characteristic reduction, or detection integration. Its observable behavior is a Markdown conversion CLI. File and standard-stream operations are ordinary supporting details, not independently suspicious capabilities. Although the vendored module could support a larger rewriting workflow, this chunk alone implements a materially different function and does not substantiate the declared purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied chunk exclusively implements Markdown task-list handling. It contains no rewriting-service integration, article naturalization, fact-preservation logic, or detection integration. Although this vendored plugin could support a larger application's formatting, no connection to the declared workflow is established in the supplied code. The mismatch concerns this chunk's materially different purpose, not suspicious resource access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied chunk's primary function is table-of-contents generation, not the declared rewriting workflow. It contains no rewriting-service integration, naturalization logic, or detection calls. Although its vendor path suggests it could support a larger application, the supplied code does not establish that connection. No network access, file access, or other suspicious side effects are evident.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied code performs document-format conversion, not stylistic rewriting or AI-feature reduction. It contains no calls to a rewriting or detection service. Although its vendor location suggests it may be a supporting dependency, the supplied chunk establishes no connection to the declared workflow. This assessment is limited to the shown code; it does not establish malicious behavior or what the rest of the skill implements.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The supplied code provides local-file inclusion rather than article rewriting or authorized AI-text detection. Although Markdown rendering could support a writing workflow, this directive additionally allows document-controlled reads of files within the source directory, which is not disclosed by the description. Its path and cycle protections limit that capability but do not eliminate it. No rewriting-service calls, detection calls, or network activity appear in this chunk; this assessment is limited to the supplied code.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/vendor/mistune/list_parser.py (reported line 258)May include surrounding context.

python

]
    if "fenced_directive" in block.specification:
        rules.insert(1, "fenced_directive")
    return rules


def _match_list_item_break(

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The mandatory rewriting workflow lacks an explicit warning that the user's article is uploaded to an external service.

Medium

• Category: Output Handling
• Confidence: 87% confidence

Finding

The workflow sends the full article to the provider during preparation, before the documented fee-approval step, without explicitly disclosing that timing. Naming an external rewriting service makes eventual transmission foreseeable, but users requesting only a quote may still disclose confidential text unintentionally.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/api.md (reported line 95)May include surrounding context.

md

## 各功能参数

| 功能      | input                                                                       | params                                                                                                                 |
| --------- | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| 文章生成  | brief 主题；可选 title、referenceText 参考正文、sourceImportId 已有导入记录 | style（最多200字）、prompt（6000字）、audience（200字）、length（100字）、titleRule（300字）                           |
| 文章改写  | text 原稿，可选 title；已有稿件用 manuscriptId 与 revision                  | 默认自然降 AI；style 可选深度降 AI、保留文风，prompt 补充要求                                                          |

The preview instructions do not disclose that preparing a quote transmits the supplied article content.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The guide emphasizes that prepare only validates and quotes, but does not disclose that it submits the supplied article to the provider. Because the client makes that request before execution approval, sensitive text can leave the local environment even when the user never approves the paid task.

Content

No source excerpt is available for this finding.

The rewrite skill exposes executable generation, formatting, workflow, and publishing capabilities beyond rewriting and optional detection.

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

In scripts/skill_client.py, L021 includes generation, formatting, workflow, and publishing, and L318 exposes all of them through the prepare command. These are operational capabilities: L108 previews the selected feature and L153 starts it, allowing this rewrite skill to create unrelated content or initiate platform delivery when the credential permits it. Although the shared-client documentation acknowledges these functions and execution has an approval gate, the skill manifest only declares rewriting and authorized detection.

Content

No source excerpt is available for this finding.

The include directive can incorporate additional local files, beyond the article-rewriting purpose.

Medium

• Category: Excessive Agency
• Confidence: 87% confidence

Finding

In scripts/vendor/mistune/directives/include.py, L030–L033 derive a filesystem path from a document directive, and L070–L095 read that file and incorporate its contents into parsed output. Although L035–L039 restrict inclusion to the source directory, document-driven inclusion of additional files is not justified by the manifest's rewriting and authorized detection scope; this capability applies when the plugin is registered and a source file is supplied.

Content

No source excerpt is available for this finding.

The rewrite skill exposes publishing and publishing-account operations outside its stated purpose.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The manifest describes article rewriting and optionally authorized detection, but L300–L314 expose commands to enumerate publishing accounts and manuscripts, start publishing runs, and submit delivery decisions. These are reachable remote operations, not implementation details required to rewrite text or check detection results.

Content

No source excerpt is available for this finding.

The delivery instructions prescribe a Chinese summary without offering a language choice.

Low

• Category: Output Handling
• Confidence: 95% confidence

Finding

L46 specifies that report.txt is a Chinese summary, imposing a particular natural language on a user-facing deliverable. The guide provides neither user opt-in nor a documented functional reason for that language restriction.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/vendor/mistune/LICENSE (reported line 14)May include surrounding context.

text

* Neither the name of the creator nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.


THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/vendor/mistune/LICENSE (reported line 14)May include surrounding context.

text

* Neither the name of the creator nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.


THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/vendor/mistune/block_parser.py (reported line 108)May include surrounding context.

python

self.list_rules = list_rules
        self.max_nested_level = max_nested_level
        # register default parse methods
        self._methods = {name: getattr(self, "parse_" + name) for name in self.SPECIFICATION}

    def parse_blank_line(self, m: Match[str], state: BlockState) -> int:
        """Parse token for blank lines."""

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/vendor/mistune/inline_parser.py (reported line 118)May include surrounding context.

python

else:
            self.rules.append("softbreak")

        self._methods = {name: getattr(self, "parse_" + name) for name in self.rules}

    @property
    def max_nested_level(self) -> int:

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/vendor/mistune/plugins/__init__.py (reported line 48)May include surrounding context.

python

module_path, func_name = name.rsplit(".", 1)

    module = import_module(module_path)
    plugin = cast(Plugin, getattr(module, func_name))
    _cached_modules[name] = plugin
    return plugin