Security audit
Security checks for vulnerabilities and agentic risk
The skill’s paid writing services, local credential storage, and optional publishing are disclosed and governed by explicit user instructions.
Use a key limited to the features you need, set a spending limit, and authorize publishing destinations explicitly. Content goes to Yougao, and the shared key remains locally until disconnected; disconnecting does not revoke it. Prefer the prepare/execute workflow and do not rely on --approved as a security boundary. Remote service and PC-client behavior were outside this artifact review.
scripts/yougao.pyLow-level publishing entry point bypasses the enforced approval gate
A plan prepared for review can be started without a locally enforced approval indication. For publish-mode plans, this can initiate external publication before the required approval has been recorded.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
]
if "fenced_directive" in block.specification:
rules.insert(1, "fenced_directive")
return rules
def _match_list_item_break(
Without declared permissions the skill's intent is opaque and cannot be validated.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 各功能参数
| 功能 | input | params |
| --------- | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| 文章生成 | brief 主题；可选 title、referenceText 参考正文、sourceImportId 已有导入记录 | style（最多200字）、prompt（6000字）、audience（200字）、length（100字）、titleRule（300字） |
| 文章改写 | text 原稿，可选 title；已有稿件用 manuscriptId 与 revision | 默认自然降 AI；style 可选深度降 AI、保留文风，prompt 补充要求 |
L46 specifies that report.txt is a Chinese summary, imposing a particular output language regardless of the user's preference. The source provides neither language opt-in nor a documented regional justification for this requirement.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
* Neither the name of the creator nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
* Neither the name of the creator nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
self.list_rules = list_rules
self.max_nested_level = max_nested_level
# register default parse methods
self._methods = {name: getattr(self, "parse_" + name) for name in self.SPECIFICATION}
def parse_blank_line(self, m: Match[str], state: BlockState) -> int:
"""Parse token for blank lines."""
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
else:
self.rules.append("softbreak")
self._methods = {name: getattr(self, "parse_" + name) for name in self.rules}
@property
def max_nested_level(self) -> int:
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
module_path, func_name = name.rsplit(".", 1)
module = import_module(module_path)
plugin = cast(Plugin, getattr(module, func_name))
_cached_modules[name] = plugin
return plugin