KD（快导）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:26 AM UTC
• Version: 1.0.4

Overview

The skill mostly matches a short-video script workflow, but its optional Feishu setup asks for broad workspace permissions and some file-changing steps lack strong user-control boundaries.

Review this skill before installing. Use local-only reports unless you create a tightly scoped Feishu app; do not bulk-import the bundled Feishu permissions as-is. Keep Excel paths pointed at files you control, confirm any rollback/delete action before running it, and treat generated spreadsheets as untrusted until formula-like cell values are sanitized.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: config/feishu_permissions.json:3

Finding

Excessive Feishu Permissions Violate Least-Privilege Boundaries

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/excel_manager.py:169

Finding

Untrusted Script Content Can Be Written as Executable Spreadsheet Formulas

Content

View full analysis

1: self.ws.merge_cells(start_row=start_row, start_column=1, end_row=end_row, end_column=1) # Write columns B-H. for i, segment in enumerate(segments): row = start_row + i self.ws.cell(row, 2).value = segment.get("time", "") self.ws.cell(row, 3).value = segment.get("shot_desc", "") self.ws.cell(row, 4).value = segment.get("movement_desc", "") self.ws.cell(row, 5).value = segment.get("tech_desc", "") self.ws.cell(row, 6).value = segment.get("scene_desc", "") self.ws.cell(row, 7).value = segment.get("line", "") self.ws.cell(row, 8).value = segment.get("sound_desc", "") # Write columns I-N. i_cell = self.ws.cell(start_row, 9) i_cell.value = script_data.get("bgm", "") self.ws.cell(start_row, 10).value = script_data.get("tags", "") self.ws.cell(start_row, 11).value = "待使用" self.ws.cell(start_row, 12).value = script_data.get("activity", "") self.ws.cell(start_row, 13).value = script_data.get("date", "") self.ws.cell(start_row, 14).value = script_data.get("notes", "") ``` ### Technical Analysis `append_script()` writes script fields directly into XLSX cells without validating or neutralizing formula-prefixed values. In particular, a Python string beginning with `=` can be stored by `openpyxl` as a spreadsheet formula rather than inert text. Potentially affected fields include the title, story, timing, shot description, movement description, technical description, scene description, dialogue, sound description, BGM, tags, activity, date, and notes. These fields can originate from generated content or callers of the publi ...[truncated 1979 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (81)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

声明描述的是一个面向用户的完整技能：批量生成多平台短视频脚本、管理文案库。但提供的代码片段并没有实现这些核心能力。它更像是一个安装后手动运行的示例/模板入口脚本，要求用户确认本地路径，随后导入模块、读取单个平台（xiaohongshu）配置、创建生成器对象，并把信息写到本地文本文件。虽然导入了 ScriptGenerator、ExcelManager、WorkflowManager、FormatChecker 等模块，且名称暗示可能支持所声明的功能，但在该代码片段中这些能力并未实际执行；尤其没有批量处理、多平台遍历、脚本生成输出流程，也没有任何文案库管理逻辑。因此，代码实际行为与声明用途存在明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述聚焦于短视频脚本批量生成和文案库管理，但代码并未生成任何脚本，也没有管理文案库内容。相反，它主要处理“活动/推广/促销”配置的自然语言解析、查询和持久化保存。这属于 materially different primary purpose：从脚本生成/文案管理变成了活动配置管理。虽然活动匹配可能可作为上层脚本生成的辅助能力，但该代码块本身的核心行为与声明用途明显不一致，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明的核心用途是“短视频脚本批量生成与管理”，但提供的代码并不生成脚本文本，也不管理文案库数据。其功能集中在对已有分镜/脚本进行时长计算、匹配检查、自动调整时间段以及输出报告。这更像是脚本后处理/时长优化组件，而不是批量生成与管理系统的实现。虽然它可能服务于短视频脚本工作流，但与声明的主要能力存在明显偏差，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的核心功能是短视频脚本批量生成和文案库管理，但代码并未实现任何脚本生成、内容管理、多平台适配或文案库操作。相反，代码专注于飞书机器人/应用权限的读取、格式化、批量导入 JSON 生成，以及权限开通流程说明。这属于 materially different primary purpose，且能力范围与声明明显不符。虽然代码未表现出敏感越权行为，但其实际功能与技能描述基本无关，应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 81% confidence

Finding

The declared description presents the skill as a production feature for batch generating and managing short-video scripts. However, the supplied code chunk is specifically a test script (test_workflow.py) for validating WorkflowManager behavior. Its primary purpose is QA/testing: initializing the workflow, calling internal step methods, printing pass/fail diagnostics, and returning an exit code. While the tested workflow appears related to short-video content ideation, the code shown does not itself implement batch script generation or document-library management. Instead, it exercises lower-level workflow steps like trending-topic search, rules loading, external search, similarity checks, and format checks. That makes the actual behavior materially different from the declared end-user purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明的用途聚焦于“短视频脚本批量生成与管理、文案库管理”，但实际代码并未实现或展示脚本生成、批量处理、文案库管理等核心能力。相反，这段代码是针对 config_manager 的测试文件，主要围绕配置加载、平台配置读取、配置校验和路径配置异常处理。虽然平台参数配置可能是该技能的支撑部分，但这段代码本身的直接行为与声明的主要功能存在明显偏离，因此应判定为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明强调的核心能力是“短视频脚本批量生成与管理”。但当前代码块并没有实现任何脚本生成逻辑、平台适配逻辑或批量生成流程；它只是一个测试脚本，用于验证 ExcelManager 对文案库 Excel 文件的加载、格式扫描、已有脚本读取、追加写入和写入校验等功能。虽然“管理文案库”与Excel读写有一定相关性，但该代码的直接目的明显是测试Excel管理组件，而不是实现所声明的主要用户功能。因此描述与实际代码行为存在实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

声明的核心用途是“短视频脚本批量生成与管理”，而实际代码是一个测试文件，主要验证 FormatChecker 的格式检查、批量验证、自动修复和平台限制规则。它处理的是脚本结构与合规性测试，不体现批量生成脚本或管理文案库的主要功能。虽然同属短视频脚本相关领域，但主功能明显不同，因此构成描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

代码片段的实际功能并不是批量生成短视频脚本或管理文案库，而是对配置管理器进行测试，重点在于加载 skill 配置、获取平台配置、验证配置项以及检查 Excel 路径是否已设置。虽然这些能力可能作为短视频脚本生成系统的底层支持组件，但该代码片段本身的主要目的与声明的用户可见用途不一致。因此应判定为描述与实际行为存在明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

声明的核心用途包含两部分：批量生成短视频脚本，以及管理文案库。实际代码并不是脚本生成器，而是一个针对 ExcelManager 的测试脚本，主要验证 Excel 文案库文件的创建、加载、格式扫描、已有脚本读取、脚本追加和写入校验。虽然“管理文案库”与 Excel 读写存在一定相关性，但这里的实际行为更具体地是本地 Excel 文件测试与管理组件验证，且完全没有体现“批量生成多平台短视频脚本”的生成能力。因此代码行为与声明用途存在实质性偏差，应判定为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明的核心用途是“批量生成与管理短视频脚本/文案库”，但代码片段实际是测试 FormatChecker 的格式检查功能：构造合法/非法脚本样例，调用 validate_script、validate_batch、auto_fix 和 get_fix_report，并验证不同平台的格式限制。这说明其主要行为是脚本格式校验与修复测试，而不是脚本生成或文案库管理。虽然都处于短视频脚本相关领域，但主功能存在明显偏差，因此应判定为描述与代码行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

声明描述强调的是面向用户的短视频脚本批量生成和文案库管理能力；但实际代码并未生成任何短视频脚本，也未实现文案库管理。相反，代码是一个针对 ConfigManager 的测试文件，主要围绕配置加载、平台配置读取、时长分镜计算、配置校验以及 Excel 路径配置异常处理。这些能力更像底层配置/测试支持逻辑，而不是声明中的主要功能。虽然配置管理可能是该技能的支撑实现细节，但该代码片段本身的直接行为与声明用途存在明显偏离，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明描述的核心能力是“批量生成短视频脚本、管理文案库”，但提供的代码块并没有生成脚本或管理文案库的逻辑。相反，它构造测试数据并调用 FormatChecker 执行 validate_script、validate_batch、auto_fix 等操作，主要用途是验证脚本格式是否合规及自动修复部分问题，还包含针对不同平台规则的检查。因此其实际行为更接近“脚本格式检查/测试工具”，与声明的主要用途存在明显偏差。未见敏感权限或资源访问问题，但主功能不一致，应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The error-handling logic authorizes autonomous deletion of all content written in Step 8 after a second validation failure, but it provides no clear user warning or approval requirement for rollback. Automated deletion logic is higher risk than append-only behavior because it can remove data unexpectedly, especially if row tracking is wrong, validation misfires, or concurrent edits occur in the same Excel file.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The delete_rows method irreversibly removes rows from the workbook data structure, yet there is no confirmation prompt, logging, or explicit user disclosure associated with this destructive action. Comments indicating rollback intent are not user-facing and do not satisfy the warning requirement for safety-critical operations in code files.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/script_generator.py (reported line 235)May include surrounding context.

python

prompt = prompt.replace("[MIN_CHARS_LINE]", str(content_req.get("G", {}).get("min_chars", 30)))
        prompt = prompt.replace("[MIN_CHARS_SOUND]", str(content_req.get("H", {}).get("min_chars", 15)))
        
        return prompt
    
    def get_prompt_for_script(self, script_num: int) -> str:
        """获取指定脚本的生成提示词（供外部调用）"""

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/workflow_manager.py (reported line 366)May include surrounding context.

python

elif in_table and not line.strip().startswith('|'):
                in_table = False
        
        return rules if rules else self._get_default_rules()
    
    def _get_platform_library_path(self) -> str:
        """获取当前平台的文案库路径

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The trigger phrase and onboarding flow are broad enough that an agent could enter configuration-changing behavior from ordinary conversational requests without a strong confirmation boundary. In this skill, activation can lead to file path configuration, external search, report generation, and optional integration setup, so ambiguous invocation increases the chance of unintended side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The shortcut examples use natural-language commands like configuration and execution requests without explicit scope limits, which can make it unclear whether the agent should explain, preview, or actually perform actions. Because this skill manages local files and can drive network-assisted workflow steps, overly permissive triggers raise the risk of accidental execution or modification from casual phrasing.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill declares capabilities to invoke Python, read configuration files, and write local files, but it does not declare any explicit tool scope such as allowed-tools or permissions. That weakens sandboxing and user transparency, because an agent may execute shell and filesystem operations that are not clearly bounded by the manifest.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Broad shortcut phrases like '配置关键词' or similar configuration-style triggers can activate the skill during ordinary conversation, causing unintended file edits or workflow execution. Because this skill can write configuration and potentially launch shell-driven flows, accidental invocation raises the risk of unauthorized local changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The shortcut and setup text references configuring Feishu upload/report destinations, but it does not clearly warn that generated reports may be uploaded to an external workspace. This can lead to unintended disclosure of generated content, metadata, or possibly sensitive business materials to a third-party platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation says the skill may automatically call web_search to collect current hot topics when keywords are empty, but it does not provide a clear user warning or opt-in at the point of use. Automatic outbound queries can expose user intent, topics, or workflow context to external services without informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The description string is written only in Chinese and the rest of the configuration likewise assumes Chinese-language use, without any indication that users can choose another language or locale. This is a natural-language policy concern because the file embeds a single-language constraint rather than documenting it as optional or region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The prompt template is written entirely in Chinese and specifies the full output structure, which strongly implies the generated script and validation workflow are expected to be in Chinese. In this config file there is no visible option for user language choice or a documented justification that this skill is intentionally limited to a Chinese-only locale.

Content

No source excerpt is available for this finding.