T09 · Insecure Skill Coding Practices
Error
- Location
references/gen-workflow.md:78- Finding
Shell Command Injection Through Untrusted Prompt and Path Interpolation
- Content
View full analysis
- Remediation
View remediation
Security audit
文曲·配图
Security checks for vulnerabilities and agentic risk
Overview
This image-generation skill is mostly purpose-aligned, but it should be reviewed because its documented command workflow can mishandle article-controlled prompt text while using local credentials, uploads, and file edits.
Install only if you trust the publisher and are comfortable with the skill using local image-provider credentials, generating images from article content, uploading images to a configured image host, and editing article files. Prefer running CLI calls with structured arguments or carefully escaped prompt/path values rather than pasting untrusted prompt text into shell commands, and verify the wenqu-cli package source before installation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
references/gen-workflow.md:20- Finding
Dependency Installation Is Not Enforced by Cryptographic Artifact Verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (58)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 写入同编号 `generation`；正文的 `![]()` 只指向当前采用的那一版，其余版本仅留存在 `versions` 里供回看对比，具体写入规则见 `references/gen-workflow.md` 第四步。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 写入同编号 `generation`；正文的 `![]()` 只指向当前采用的那一版，其余版本仅留存在 `versions` 里供回看对比，具体写入规则见 `references/gen-workflow.md` 第四步。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 写入同编号 `generation`；正文的 `![]()` 只指向当前采用的那一版，其余版本仅留存在 `versions` 里供回看对比，具体写入规则见 `references/gen-workflow.md` 第四步。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 写入同编号 `generation`；正文的 `![]()` 只指向当前采用的那一版，其余版本仅留存在 `versions` 里供回看对比，具体写入规则见 `references/gen-workflow.md` 第四步。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 文中 `Skill` 工具是 Claude Code 的跨技能调用机制名。其他 agent 没有对应机制时，调用方直接读取本技能的 `SKILL.md` 和 `references/` 文件就地执行。
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The metadata description includes broad triggers like '生成图片', '渲染一下', and '帮我生图' without strong contextual constraints, which can cause the skill to activate during ordinary discussion rather than only when the user explicitly wants image generation. Because this skill can proceed into generation, upload, and article modification workflows, unintended invocation can lead to unnecessary side effects or user confusion.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger recognition section repeats broad phrases such as '生成图片', '渲染一下', and '把图画出来' as direct entry points, and although there is some discussion-vs-generation guidance, the activation language remains permissive. In an agent environment, this increases the chance of the skill being selected when the user intended only to discuss or review images, leading to unintended tool use or content changes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The default style instruction explicitly says all text annotations must be in Chinese. This is a language policy constraint presented as a default requirement, and the file does not provide user opt-in or a language-selection mechanism for output language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file explicitly instructs that all text in generated diagrams be Chinese, regardless of the user's requested language. This can override user intent and system-level localization expectations, causing unauthorized language coercion and degraded usability in multilingual contexts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The label rules systematically require Chinese replacements for technical terms and abbreviations, enforcing Chinese-only terminology throughout diagrams. In a diagram-generation skill, this creates consistent user-intent override risk and can also reduce precision by translating established technical identifiers that users may need preserved.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The title and core instructions are entirely in Chinese and present the guidance as the default required format for writing AI image prompts. Under the policy criteria, forcing a specific language without opt-in or a documented region-specific justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document is written to operate in Chinese only and repeatedly mandates Chinese-language interaction patterns without offering a language choice or checking user preference. This can create consent and comprehension failures: users may approve installations, uploads, or document edits without fully understanding prompts, especially because the workflow requires explicit confirmations and operational decisions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow defines broad, colloquial trigger phrases such as '渲染一下' and '帮我生图', which can match ordinary conversation and cause the image-generation skill to activate outside the user's intended scope. Over-broad activation is dangerous because this skill can install tools, inspect local environment state, and initiate uploads, so accidental triggering increases the chance of unnecessary side effects and consent confusion.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
wenqu image doctor --json
text 按 `runtime` 与 `providers` 字段判断当前可用路径；Codex 使用当前登录态，OpenAI、OpenRouter、通义和 Seedream 的密钥默认由 `wenqu image` CLI 从本机凭证文件读取（路径见 `wenqu image doctor` 输出的 `paths.credentials`）。临时切换时显式传 `--env-file <你的凭证文件>`；该文件也必须是 owner-only（`chmod 600`）。 若检测到缺失依赖，按下表手动安装或处理：
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The entire document is written in Chinese and provides prescriptive phrasing to use in prompts, but nowhere indicates that Chinese is optional or that the skill is region-specific. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Line L34 explicitly says '所有文字用中文', which forces a specific language for generated output. This is a natural-language policy issue because the file does not present Chinese as optional, user-selected, or region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Line L52 requires '所有文字用中文', imposing a fixed language policy in a reusable prompt template. Because no alternative language path or opt-in is provided, this violates the locale-choice requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Line L57 instructs that all text must be in Chinese, which is a hardcoded locale requirement. The file does not indicate that this limitation is optional or justified by a region-specific use case.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Line L62 includes '所有文字用中文', creating a fixed-language requirement in the prompt template. This is a policy concern because users are not given a language choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Line L67 requires all text to be in Chinese, which enforces a specific language across outputs. The file lacks any opt-in, fallback, or justification for restricting language in this way.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file title and all prompt/template content are written in Chinese, including fixed labels such as 「是/否」 and title/text instructions, which implies a Chinese-language default for generated content. There is no indication that users may choose another language or that this is a region-specific skill with a documented language requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
该 markdown 文件在提示模板中直接规定输出文字必须为中文，属于自然语言层面的语言策略限制。文件中未说明这是仅适用于中文场景的区域性技能，也未提供用户可选择其他语言的机制，因此构成语言/locale policy violation。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
该模板把中文设为固定输出要求，而不是用户可配置项。按照规则，这种未提供 opt-in/choice 的语言限定属于自然语言政策违规。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
这里对输出语言作了硬性限定，但文档没有给出语言选择入口，也没有说明此限制是特定地区/合规要求所致。因而符合语言或 locale policy violation 的判定条件。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
模板将中文作为必选输出语言，而不是默认值或用户可覆盖选项。该做法会在未获用户同意时强制特定语言，属于应报告的自然语言策略问题。
- Content
Static analysis
No suspicious patterns detected.