公众号写手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 2.2.0

Overview

The skill is mostly a writing assistant, but it tells the agent to keep usage logs and automatically rewrite its own instructions over time without an approval gate.

Review this skill before installing if you do not want a writing assistant to retain usage feedback or change its own SKILL.md. It should require explicit approval and a visible diff before modifying skill instructions, and experience logs should avoid raw private comments or sensitive metrics.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:545

Finding

Persistent Memory Poisoning Through Autonomous Skill Updates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:545-553; supporting directive in EXPERIENCE_LOG.md:1-3
Vulnerability Type: Persistent state poisoning and autonomous instruction modification
Risk Level: Medium

Vulnerable Code Snippet

English translation of SKILL.md:545-553:

markdown

## Iteration Mechanism

After each use, record the following items in `EXPERIENCE_LOG.md`:

- Topic and data feedback
- Validated titles and formulas
- Read count, share rate, and open rate
- High-frequency words and emotions from user comments
- Misjudgments that need correction

After every ten experience records, proactively update `SKILL.md` once.

English translation of the supporting instruction in EXPERIENCE_LOG.md:1-3:

markdown

# Official Account Writer — Experience Log

Record an entry after every use. Proactively update `SKILL.md` after every ten entries.

Technical Analysis

The Skill instructs the agent to persist usage-derived information in EXPERIENCE_LOG.md after every invocation. The stored information includes feedback, user-comment characteristics, performance data, and perceived errors. These values can originate from untrusted user input and are not subject to validation, provenance tracking, sanitization, or approval.

More critically, the Skill directs the agent to modify SKILL.md after every ten records. Because SKILL.md contains the instructions loaded during future invocations, modifying it creates a path from untrusted session content to persistent agent behavior. This is a long-term memory poisoning condition: manipulated feedback can be accumulated and later transformed into governing instructions that affect subsequent sessions.

The project declares Write and Edit capabilities, so the requested persistence and self-modification are compatible with the Skill's available privileges. No review gate, immutable policy boundary, trusted-data requirement, or ...[truncated 1638 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction that autonomously updates SKILL.md. Treat Skill instructions as reviewed, immutable configuration during normal execution.
2. Require explicit user or maintainer approval before changing SKILL.md, including presentation of an exact diff and a clear explanation of each proposed change.
3. Store operational observations separately from executable or governing instructions. Never load experience-log entries as trusted directives.
4. Validate the provenance and structure of metrics before persistence. Mark user-supplied values as untrusted and prevent them from becoming instructions.
5. Avoid storing raw comments or personally identifying content. Retain only aggregated, minimized statistics with an explicit consent and retention policy.
6. Restrict normal Skill invocations to append-only access to the experience log and deny write access to SKILL.md.
7. Add integrity controls, such as version control review, checksums, protected branches, and rollback procedures, for all Skill instruction changes.
8. If automated recommendations are desired, write them to a separate proposal file for human review rather than applying them directly.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrase covers a wide range of loosely related tasks, including general article creation, optimization, and 'AI痕迹去除', without clear boundaries on when the skill should or should not activate. Overbroad activation increases the chance the skill is invoked in unintended contexts, causing unauthorized file writes or content-generation behaviors outside user intent, especially because the skill is allowed to write and edit files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to record usage data into EXPERIENCE_LOG.md and proactively update SKILL.md, but this persistent self-modification behavior is not disclosed in the main skill description or constrained by explicit user approval. Hidden or under-disclosed write behavior is dangerous because it can lead to silent prompt mutation, accumulation of untrusted data in long-lived files, and drift in future agent behavior beyond the user's immediate request.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.