Security audit

Article Taster

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese article-analysis skill that runs local heuristic scoring; it has some reliability and hardening issues but no hidden privileged, persistent, destructive, or exfiltrating behavior was found.

Install only if you are comfortable with local heuristic analysis of Chinese text. Do not rely on its AI/originality labels as proof, pin or review dependencies before use, limit input size when exposing it to untrusted users, and avoid enabling any future external LLM scoring unless article text transmission is clearly disclosed and explicitly approved.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ai_detector.py:42
Finding: Unbounded Backreference Regular Expressions Permit Denial of Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/report_generator.py:47
Finding: Unescaped Article Titles Allow Markdown Content Injection
Content: View full analysis
str: """Generate a Markdown report.""" verdict = report['reading_advice']['verdict'] grade = report['grade'] score = report['overall_score'] grade_emoji = { "A+": "💎", "A": "⭐", "B+": "👍", "B": "👌", "C": "🤔", "D": "👎" }.get(grade, "📄") md = f"""# Article Tasting Report ## Basic Information - **Title**: {report['title']} ``` ### Technical Analysis The report generator interpolates `report['title']` directly into Markdown without escaping Markdown metacharacters or removing line breaks. The title can originate from an unrestricted explicit title argument or from the first line of attacker-controlled article content. A crafted title can therefore terminate the intended list entry and inject headings, links, images, or other Markdown structures into the generated report. The exact consequences depend on the downstream renderer. At minimum, the attacker can alter the report's presentation and create misleading content. If the renderer automatically fetches remote images, injected image syntax may also cause an outbound request when a victim views the report. ### Attack Path 1. An attacker supplies a crafted explicit title, for example a title containing a line break followed by a forged heading or remote image: ```text Legitimate title ## Forged Security Result ![tracking](https://attacker.example/track) ``` 2. `ArticleTaster.analyze()` passes the title to `ReportGenerator.generate()`. 3. `ReportGenerator.to_markdown()` inserts the title into the Markdown output without encoding. 4. A user or downstream system renders the generated Markdown. 5. The injected structure appears as part of the trusted report. A renderer that permits remote resources may also request the attack ...[truncated 588 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (26)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明的核心能力是内容质量与原创性鉴别，包括多维度评估文章质量、检测AI风格、识别原创内容；而代码只做了简单的文章体裁/类型识别，依据是预设关键词匹配和密度打分。两者主功能明显不同，且声明中的关键能力在代码中完全未体现。代码也没有访问额外资源或权限问题，但其实际用途与描述存在实质性偏差，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: 描述中的核心能力包括：多维度文章质量评估、检测AI味/大便味、识别原创内容。代码确实实现了“多维度评估”的一部分，但范围明显限定在情感散文与创意写作，使用启发式关键词和结构特征来评估情感表达、文笔、结构、创意和共鸣。代码中没有任何针对AI文本特征检测、机器生成判别、‘大便味’风格识别、原创性验证、查重、外部比对或相似度分析的实现。因此，声明覆盖了代码未提供的关键能力，且实际主用途更偏向文学风格分析而不是所宣称的完整文章鉴定功能，属于实质性描述不符。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description says this skill evaluates article quality, detects AI-like text and low-quality style, and identifies original content. The code does not perform those functions. Instead, it analyzes novels specifically, with heuristics for genre, plot structure, character portrayal, narrative technique, style, world-building, and spoiler handling. There is no logic for AI-text detection, plagiarism/originality checking, or broad article assessment. The actual primary purpose is materially different from the declared one, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: 声明中的“多维度评估文章质量”与代码的部分行为相符，因为代码确实会从多个维度评估文章质量。但代码明显聚焦于“技术文章”分析，维度和指标都围绕技术术语、代码块、步骤说明、标题结构等展开，不是通用文章品鉴器。更重要的是，声明提到的“检测AI味/大便味”在代码中完全没有对应实现；没有任何AI生成文本检测、风格异常检测或相关分类逻辑。对于“识别原创内容”，代码只通过原创/转载关键词和字符唯一率做一个粗略原创性分数，属于非常有限的启发式估计，不等同于可靠的原创内容识别。因此，声明与实际行为存在实质性不匹配。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises executable/scripted capabilities and optional external-provider integrations but does not declare any explicit tool scope or permissions boundaries. In an agent environment, this creates ambiguity about whether file reads and network access are intended and authorized, increasing the risk of over-privileged execution or unexpected data access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill metadata and description are entirely Chinese-focused, with languages: 中文 and Chinese-specific processing dependencies, but the document does not clearly present this as an opt-in locale restriction or offer alternatives. Under the policy, forcing a specific language without user choice or explicit justified constraint is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The dependency list states that OpenAI/Anthropic may be used for LLM-assisted scoring, but the skill description does not clearly warn users that submitted article text could be transmitted to third-party providers. This is a privacy and data-governance issue because users may provide unpublished, sensitive, or proprietary content under the assumption that analysis is local.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The configured ai_patterns are exclusively Chinese-language phrases such as 作为一个AI and AI语言模型, which indicates a language-specific policy baked into the skill behavior. There is no accompanying indication that users can opt into this locale or that the restriction is justified as region-specific, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module docstring and all user-facing labels are written only in Chinese, and the runtime output in the main block also presents results exclusively in Chinese. This creates a language policy issue because the skill effectively forces a specific language/locale without offering the user any choice or documenting a justified regional constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The confidence labels and analysis messages returned by the detector are hard-coded Chinese strings, which means consumers of the skill receive a fixed locale response. Because there is no opt-in, fallback, or configuration for language choice, this is a natural-language policy violation under the language/locale rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The returned AI flavor level strings and warning messages are fixed Chinese-language outputs, including evaluative labels shown to end users. Without a documented locale restriction or user language choice, this forces a specific language and violates the language/locale policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The module name, classifier description, supported categories, and all user-facing docstrings are written only in Chinese, which effectively imposes a specific language/locale on users. The file does not offer any language choice or explain that it is intentionally limited to a Chinese-only regional context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code file contains user-facing module and class descriptions exclusively in Chinese, and the resulting analysis strings and improvement messages are also hard-coded in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring presents the skill description entirely in Chinese, and the CLI help/output strings throughout the file are also Chinese-only. This creates a language/locale restriction without any opt-in or documented justification, which matches the natural-language policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This Python skill is a code file, so SQP-3 applies. The module description and later user-facing output strings are entirely specified in Chinese, and the skill behavior appears designed around Chinese-language analysis without any opt-in, fallback, or documented region-specific requirement, which is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This Python file hard-codes Chinese-language report text, labels, comments, and example outputs throughout the report generator, meaning generated user-facing content is always in Chinese. The file does not offer any language selection mechanism or document that the skill is intentionally limited to Chinese for a justified regional use case.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This codebase hard-codes user-facing text such as verdicts, audiences, time ranges, and reading advice entirely in Chinese, and the comments/docstrings also indicate a Chinese-only interaction model. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code embeds user-facing descriptions, issue messages, and strengths in Chinese, indicating the skill is designed to operate in a single language. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens reproducibility and can unintentionally introduce vulnerable or incompatible releases into the environment.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
jieba>=0.42.1 scikit-learn>=1.0.0 numpy>=1.21.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: scikit-learn is unpinned, so deployments may install different versions depending on timing and resolver behavior. Because the package has known advisories in some versions, the lack of pinning makes it impossible to verify whether the resolved version is safe and increases supply-chain risk.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
jieba>=0.42.1 scikit-learn>=1.0.0 numpy>=1.21.0

Unverifiable Dependency: scikit-learn has 6 known advisory(ies) (CVE-2020-13092 (scikit-learn Deserialization of Untrusted Data); CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2020-28975 (scikit-learn Denial of Service) +3 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The manifest does not pin scikit-learn, and the package has multiple known advisories affecting some versions. Without an exact version, you cannot determine whether installations are exposed to issues such as unsafe deserialization, denial of service, or data leakage in affected releases.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: numpy is declared with only a minimum version, so the actual installed version may vary across environments and over time. Since some numpy releases have published security issues, this creates uncertainty and avoidable supply-chain exposure.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
jieba>=0.42.1 scikit-learn>=1.0.0 numpy>=1.21.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: numpy has known advisories in certain versions, but this requirements file does not specify an exact version. That makes the dependency state unverifiable and can allow affected versions to be installed, especially in fresh or rebuilt environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The natural-language description in the module docstring is entirely Chinese, which can impose a language constraint on users without any visible opt-in or justification. Under the policy rules, forcing a specific language or locale without user choice is a reportable natural-language policy issue.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The help epilog advertises a usable batch command example, implying batch article processing is supported. However, the actual batch branch only prints that the feature is under development, so the documentation actively overstates what the code does.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.