Security audit

AI内容生成器(付费版)

Security checks for vulnerabilities and agentic risk

Overview

This paid content skill is mostly coherent, but it embeds a billing API key and auto-charges through an external service while overstating its AI capabilities.

Review this carefully before installing. It can contact SkillPay, send the supplied user ID, and attempt to deduct 0.001 USDT per generation. The embedded API key should be removed and rotated, billing should require explicit consent, and the description should clarify that the current generator is template-based rather than real AI generation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/skillpay.js:6
Finding: Hardcoded Billing API Credential Used as an Authentication Fallback
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

Location: templates/xiaohongshu.js:6
Finding: Unnecessary Filesystem Probe Outside the Skill Directory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the skill advertises paid AI generation, video scripts, and multi-platform support but only implements a narrower static template generator or omits billing integration, users may be induced to provide payment credentials or make purchasing decisions based on false functionality claims. Misrepresentation around paid features is especially risky because it can create financial harm and erode trust.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: If the skill advertises paid AI generation, video scripts, and multi-platform support but only implements a narrower static template generator or omits billing integration, users may be induced to provide payment credentials or make purchasing decisions based on false functionality claims. Misrepresentation around paid features is especially risky because it can create financial harm and erode trust.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the skill advertises paid AI generation, video scripts, and multi-platform support but only implements a narrower static template generator or omits billing integration, users may be induced to provide payment credentials or make purchasing decisions based on false functionality claims. Misrepresentation around paid features is especially risky because it can create financial harm and erode trust.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: If the skill advertises paid AI generation, video scripts, and multi-platform support but only implements a narrower static template generator or omits billing integration, users may be induced to provide payment credentials or make purchasing decisions based on false functionality claims. Misrepresentation around paid features is especially risky because it can create financial harm and erode trust.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A live SkillPay API key is hardcoded directly in the source as a fallback value, which means anyone with repository, package, build artifact, or log access can extract it and invoke billing APIs. In a billing integration, this can enable unauthorized balance checks, charges, or payment-link generation under the skill owner's account, making the impact materially higher than a generic secret exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The chargeUser function performs a real monetary deduction via a POST request, but there is no confirmation prompt, logging, or other visible user disclosure at the point of charge. Although comments describe the fee in code, those comments are developer-facing only and do not warn the end user before a charge is attempted.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill declares access to an environment secret (SKILLPAY_API_KEY) and appears to require networked billing behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege guarantees and makes it harder for users or the platform to understand and constrain what the skill can access externally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description is written entirely in Chinese and presents the skill as a Chinese-content generator, but it does not state that the language restriction is optional or region-specific. This can violate language/locale policy because the skill appears to impose a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script's usage, content type names, and payment/help text are presented only in Chinese, which imposes a specific language on users. There is no indication that users can opt into another language or that the locale restriction is required for a region-specific purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: checkBalance sends userId to an external API endpoint, which is a network transmission of user-related data. The code contains no user-facing notice, prompt, or logging indicating that balance lookups share identifiers with a third-party billing service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: getPaymentLink posts user_id and amount to a remote billing endpoint, but the code provides no user-facing disclosure that this data is being transmitted externally. This is relevant to privacy and financial workflow safety because it initiates interaction with a payment provider.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This JavaScript template hard-codes all generated article text in Chinese, including the title framing, section headings, and call-to-action strings. That imposes a specific language on all outputs without any user opt-in or documented justification, which matches the locale-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This JavaScript skill generates Chinese-language output and comments throughout the file, including the produced template text and hashtags, with no indication that the user can opt into another language. That creates a natural-language policy concern because the skill effectively forces a specific language rather than offering user choice or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The package description is written as a Chinese-only label ("AI内容生成器 - 收费版"), which indicates a language-specific skill presentation without any visible user choice or justification in this file. Under the policy rule, locale or language constraints should be optional or clearly documented as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The file's natural-language description mixes English with Chinese billing text and presents key cost information in Chinese only. This can violate language/locale policy when users are not given an explicit language choice or opt-in for Chinese messaging.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.