Security audit

文曲·发布

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a coherent publishing helper, but it should be reviewed because it can execute an unpinned external skill inline and may overwrite prior release artifacts despite saying it will not.

Install only if you trust the local wenqu-image skill that may be invoked for cover generation, and treat repeated publication of the same draft version carefully because earlier publish/vN artifacts can be replaced. Prefer reviewing paths before write, keeping backups, or modifying the workflow to write immutable pubM-specific directories.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:33
Finding: Unpinned External Skill Instructions Are Loaded and Executed
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/workflow.md:80
Finding: Repeated Publication Can Overwrite Existing Release Artifacts
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
- `Skill` 工具（调用 wenqu-image 生成封面）→ 没有跨技能调用机制就直接 Read `wenqu-image` 的 `SKILL.md` 和 `references/` 文件，照其内联执行

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The description says to use this skill when the user says phrases like “准备发布” and “生成发布版,” which are relatively broad and may appear in ordinary editing or planning contexts without clearly meaning this specific publication workflow. The file does not provide exclusion conditions or negative examples to clarify when these phrases should not activate the skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The title and the entire instruction set are written as a normative specification in Chinese, and there is no indication that users may choose another language or that the skill is limited to a Chinese-only context. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The entire skill guidance is written as a prescriptive Chinese-only writing standard, with no indication that users may choose another language or that the skill is limited to a Chinese-language workflow. The policy explicitly calls for flagging language or locale constraints when they are imposed without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow directs the agent to create publication output files and append to a changelog automatically, but it does not require an explicit user confirmation immediately before those filesystem modifications occur. In an agent setting, this can cause unintended repository changes, especially when a user only asks to prepare or preview a publication-ready version and does not realize the skill will persist files and mutate project history.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.