Back to skill

Security audit

guofeng-lyric-writer

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only writing aid for Chinese Guofeng lyrics and does not request system access, credentials, persistence, or external execution.

Install this if you want help writing Guofeng or classical Chinese-style lyrics. If you need commentary or final output in another language, state that preference when using it; no sensitive system access or persistence is indicated by the artifacts.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The workflow is written to produce Guofeng lyrics using Chinese themes, vocabulary, rhyme categories, and example output throughout, but it does not state that the user must opt into Chinese-language composition or that the skill is region/language-specific. This can violate a language/locale policy when a skill implicitly forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The description says to use the skill for creating Guofeng lyrics, writing Chinese-style songs, adapting classical poetry into lyrics, or composing classical-style verses, with trigger examples that are illustrative rather than bounded. Because it does not provide exclusion conditions or a precise trigger scope, the activation criteria may be interpreted too broadly for many ordinary poetry or songwriting requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The output format is entirely specified in Chinese and presents a fixed response structure, which can imply that responses must be in Chinese regardless of user preference. Under the language/locale policy, a mandated language should be optional unless clearly documented as a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file is entirely written as English instructional content around Chinese songs, which can constitute a language-policy issue if users are not given an option for preferred language. The file does not indicate that English is optional or justified by a documented region- or audience-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file presents all substantive content in Chinese terms and headings, with only limited English glosses, which can amount to an implicit language constraint for users who do not read Chinese. Under the language/locale policy rule, forcing a specific language without opt-in or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file presents almost all substantive vocabulary content and examples exclusively in Chinese, with no indication that users can opt into another language or locale. Under the policy, forcing a specific language without user choice can be a natural-language policy issue unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.