Security audit

Transcript Crafter

Security checks across malware telemetry and agentic risk

Overview

The skill’s main writing workflow is coherent, but it also defaults to saving and uploading transcript-derived articles to Feishu and invoking local helper commands, which needs user review before installation.

Install only if you are comfortable with a transcript-writing skill that can use external search services, local helper commands, Feishu credentials, Desktop writes, and Feishu cloud upload. Avoid all-auto mode for confidential material, explicitly say not to upload to Feishu when needed, and review any configured helper scripts or lark-cli credentials before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The documented workflow extends beyond transcript processing and article generation into persistence on the local desktop and upload to Feishu cloud storage. Those actions change the data-handling scope from content transformation to filesystem writes and third-party exfiltration, which is risky because interview transcripts and derived articles may contain sensitive or unpublished information.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The pipeline includes shell/CLI file-copy and upload commands that perform privileged side effects unrelated to the stated writing/transcription function. Embedding operational commands in a content skill increases the chance an agent will copy sensitive files, stage them in working directories, or transmit them externally without sufficient review or sandboxing.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill embeds subprocess-style Python command execution routes (`python ./mx_data.py`, `mx_search.py`, `mx_xuangu.py`) inside a content-transformation workflow. Even if intended for search augmentation, this expands the skill from passive text processing into active code/tool invocation without clear sandboxing, parameter validation, or user consent, increasing risk of command misuse and unintended local execution.

Context-Inappropriate Capability

Medium

Confidence: 79% confidence
Finding: The routing matrix explicitly prioritizes recent-trend and public-opinion channels such as last30days-cn for '近期舆论/热点', despite the skill metadata stating it should not be used for hot-topic articles. This broadens operational scope beyond the declared purpose and can cause the agent to collect volatile, lower-quality, or privacy-sensitive content from social platforms unexpectedly.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The fallback policy mandates filling missing facts with 'Agent 已知信息' and marking them as '[AI推断]' while also stating '绝不留空'. In a transcript-to-longform workflow, this creates pressure to fabricate unsupported details rather than preserve evidentiary gaps, which can inject false claims into published content and mislead readers with invented authority.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The manifest description includes broad invocation phrases such as '提取并转写、转写公众号长文、提取干货', which can match many ordinary summarization, transcription, and writing-assistance requests outside the narrow intended scope. This over-broad routing can cause the agent to activate a high-permission skill unnecessarily, exposing user files, network access, and subprocess-capable behavior in situations where a simpler skill would suffice.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The skill description and task instructions are written to force Chinese-language output and a specific WeChat-publication format without any opt-in or fallback to the user's language preference. This can override user intent, reduce usability, and cause incorrect or non-consensual transformations when the user requests another language or a neutral output format.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document describes local file writes and external uploads without a clear user-facing warning or affirmative consent step in the same workflow. Even if intended as convenience features, silent persistence and transmission can expose confidential transcripts, personal data, or proprietary drafts in ways the user may not expect.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill instructs direct shell/Python execution for external scripts without any user-facing warning, approval step, or safety boundary. In an agent environment, this can lead to silent local process execution and broaden the attack surface beyond the expected document-processing behavior.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill specifies direct HTTP/API requests to external services as part of normal operation but provides no warning that user content or derived queries may be transmitted off-platform. This creates privacy and compliance risk, especially if transcripts contain confidential interview material or personal data.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill directs requests to an external API and requires a browser-like User-Agent to avoid 403 responses, but omits any user disclosure or governance control. This can mask automation behavior, bypass normal transparency expectations, and send potentially sensitive search terms to third parties without informed consent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.