公众号文章创作

• Analyzed: May 11, 2026, 5:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: 93e8f8fb5d00563f1a5b3764727eb17bc3b2c3684df5773ca6ad524dfd2126cd
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to several significant security vulnerabilities. Most critically, the `stages/04-writing.md` file explicitly instructs the AI agent to execute a shell command (`python scripts/generate_images.py --input prompts.jsonl`). This presents a high risk of prompt injection leading to arbitrary code execution (RCE) if the `--input` file or the command line arguments can be manipulated by a malicious user prompt. Additionally, a sensitive API key is hardcoded in `scripts/image.env` and exposed in `SKILL.md`, which is a severe credential management flaw. Hardcoded Windows-style file paths for saving content (`E:\Claude Code\claude\articles\青少年学习教练公众号\`) are also present in `SKILL.md` and `stages/04-writing.md`, posing compatibility and potential file system interaction issues.