T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:732- Finding
Unverified Remote Script Downloaded and Executed Through a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Wuhao Writer - Popular Science
Security checks for vulnerabilities and agentic risk
Overview
This is mainly a Chinese article-writing style skill, but it adds unnecessary external-skill installation and a remote curl-to-bash installer that users should review carefully.
Install only if you are comfortable manually reviewing any external skills first. Do not run the curl-to-bash installer as written; prefer reviewed registry installs, pinned versions, and explicit approval before using aihot, hv-analysis, the neat-freak maintenance skill, or any knowledge-base archiving.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:431- Finding
Mandatory Promotional Footer Overrides User-Controlled Article Output
- Content
View full analysis
/ Author: [author attribution] > / For submissions or tips, contact: [email] ``` The accompanying rule states that this format must be used at the end of every article, and explains that it directs readers to like, mark, share, and subscribe. ### Technical Analysis The Skill applies an unconditional output rule that inserts engagement requests, subscription promotion, attribution, and contact solicitation into every generated article. This changes the user’s requested output even when the user only asks for rewriting, review, structural planning, or an article that does not require promotional material. A style template may legitimately offer an optional publication footer, but making it mandatory is not necessary for the declared popular-science writing function. The instruction also risks presenting unresolved placeholders such as author attribution or email address as if they were valid publication data. This issue affects generated content rather than obtaining operating-system privileges. It is classified as instruction hijacking because loading the Skill introduces a persistent output objective that can supersede the immediate user request. ### Attack Path 1. A user loads the Skill for an ordinary writing or editing task. 2. The Skill’s mandatory footer rule applies to every article. 3. The Agent appends engagement, subscription, attribution, and contact language regardless of whether the u ...[truncated 774 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
SKILL.md:623- Finding
Unpinned External Skills Are Installed or Automatically Invoked Outside the Audit Boundary
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
curl ... | bashfetches code from a remote server and immediately executes it, giving the remote endpoint full control over the resulting shell session. In a writing skill, this is especially inappropriate because the command is unrelated to the minimum function of drafting articles, so it materially increases risk through unnecessary remote code execution exposure.- Content
text 或手动： ```bash curl -fsSL https://aihot.virxact.com/aihot-skill/install.sh | bash核心能力：
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The chaining pattern
| bashturns downloaded content directly into executable shell input, eliminating the user's opportunity to inspect what will run. This creates a straightforward path for supply-chain compromise, malicious script substitution, or server-side takeover to become arbitrary command execution on the target machine.- Content
text 或手动： ```bash curl -fsSL https://aihot.virxact.com/aihot-skill/install.sh | bash核心能力：
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This README presents the skill and all usage guidance exclusively in Chinese, which can amount to a language/locale policy constraint if users are not given an explicit choice or opt-in. The file does not state that the skill is intended only for Chinese-language users or content, nor does it offer alternatives for other locales.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
该 manifest/markdown 头部的 triggers 包含“公众号”“AI写作”“文章创作”“内容创作”等高频、泛化词汇，这些词在大量日常写作或内容讨论场景中都会出现，缺少足够的领域约束。文档也未给出明确的触发边界、排除条件或负例，因此容易与普通对话重叠并引发非预期调用。
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill's stated purpose is article writing guidance, but it also introduces external tool installation, data gathering, report generation, and post-publication archival workflows. This scope expansion increases the attack surface by encouraging the agent or user to interact with outside services and tools not essential to the core writing function, which can lead to unreviewed code execution, data exfiltration, or unintended tool chaining.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document instructs installation of external tooling via shell commands even though that behavior is not central to a writing-style skill. Embedding operational installation steps in a non-admin skill can socially engineer users or agents into executing code they would not otherwise run, especially when presented as a normal prerequisite.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document includes a pipe-to-shell installation command without surrounding safety guidance, provenance verification, checksum validation, or least-privilege instructions. In skill content, this is dangerous because users may treat the command as trusted operational advice and execute unreviewed remote code directly on their systems.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
L97-L98 将“说白了”列为绝对不用的 AI 标志性句式，但 L159-L160 的“语气词和过渡词”又把“说白了”列为常用口语连接词。文档前后对同一表达给出了相反指令，属于意图层面的直接矛盾。
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
L117-L123 声称冒号属于绝对不用的标点，但文档自身在多个位置持续使用冒号，例如固定尾部格式中的“作者：[作者署名]”“投稿或爆料，请联系邮箱：[邮箱]”以及大量章节标题。作为技能规范文档，其声明的硬性禁令与实际示范内容不一致。
- Content