Security audit

Article Tuwen

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but its optional Feishu upload and slug-based command/path instructions are not scoped tightly enough for a cloud-sync workflow.

Review this before installing if you may process sensitive material. Use it only if you are comfortable with automatic web searches, Desktop output creation, and sub-skill execution. Before approving Feishu sync, verify the exact filenames to be uploaded and use a safe simple slug; avoid syncing confidential source-derived content unless the upload manifest is explicit.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: references/pipeline.md:101
Finding: Unsanitized Slug Interpolation in Shell Command and Filesystem Paths
Content: View full analysis
公众号配图" ``` Related output-path construction: ```text \公众号配图\ ├── p1.png ~ pN.png ├── -article.md ├── -text-summary.txt └── used-images.json ``` ### Technical Analysis The pipeline interpolates the `` value directly into a documented shell command and multiple filesystem paths. The specification does not require an allowlist, shell escaping, argument-array execution, path canonicalization, or verification that the resulting path remains beneath the intended Desktop output directory. Double quotes do not make arbitrary input safe for shell execution. If the generated slug contains a quotation mark followed by shell metacharacters, it can terminate the quoted argument and introduce additional shell syntax. Separately, path separators or traversal components such as `..` could redirect generated files outside the intended output directory. The project does not define exactly how the slug is generated or prove that it is attacker-controlled. Nevertheless, because the slug is associated with user-provided content and no validation boundary is specified, implementations following this orchestration document may pass unsafe content into the command. ### Attack Path 1. An attacker supplies source material, a title, or metadata that influences the output slug. 2. The resulting slug contains shell metacharacters, quotation marks, path separators, or traversal components. 3. The agent substitutes the slug into the `lark-cli` shell command or Desktop output path. 4. During optional Feishu synchronization, the shell interprets injected syntax rather than treating the entire slug as data. 5. Alternatively, local output operations r ...[truncated 732 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/pipeline.md:99
Finding: Cloud Upload Procedure Does Not Enforce the Declared File Scope
Content: View full analysis
公众号配图\ ├── p1.png ~ pN.png ├── -article.md ├── -文字稿.txt └── used-images.json ``` The upload procedure then instructs the implementation to: ```sh lark-cli drive +create-folder --name "公众号配图" ``` It subsequently says to change into the output directory and upload files one by one because `lark-cli` requires relative paths. No explicit filename allowlist or upload manifest is defined. ### Technical Analysis The declared consent scope is limited to generated PNG files and the text summary. However, the output directory also contains the full article and image-source metadata, while the upload procedure generically instructs the implementation to upload files from that directory one by one. Because no explicit selection rule excludes the article, JSON metadata, temporary files, symlinks, or accidentally co-located source files, an implementation may upload the entire directory contents. This creates a mismatch between the data transfer described to the user and the operation performed after consent. Consent does not adequately mitigate the issue when the user is told that only PNG and summary files will be uploaded but the implementation may transmit a broader set of files. ### Attack Path 1. The pipeline writes PNG cards, a text summary, the full Markdown article, and `used-images.json` into the output directory. 2. Additiona ...[truncated 1113 chars]
Remediation: View remediation
-text-summary.txt ``` 2. Never enumerate and upload every entry in the output directory. 3. Display the exact manifest, file count, filenames, sizes, and destination before requesting consent. 4. Require new consent if the manifest changes after approval. 5. Reject symlinks, directories, unexpected extensions, and files whose canonical paths fall outside the expected output directory. 6. Keep raw materials, temporary files, the full article, and provenance metadata in a separate directory that is never used as an upload source. 7. Verify immediately before each upload that the file matches the approved manifest. 8. Update the pipeline specification so the executable upload procedure exactly matches the privacy declaration. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This file specifies all operational instructions, prompts, and user-facing confirmations in Chinese only, such as the trigger phrases and confirmation text. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file contains substantial user-facing natural language in Chinese, while other entries are partially in English, but it does not state that the changelog is intentionally bilingual or offer a language choice. Under the language/locale policy, forcing one language for some readers without opt-in can be a policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.