Security audit

文曲·写作

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Chinese technical-writing workflow that stores writing context and preferences, but its sensitive behaviors are mostly scoped, explained, and aligned with drafting and reviewing articles.

Install this if you want a stateful Chinese technical-writing assistant. Before use, be comfortable with it reading project source files for evidence, creating `wenqu-skills/` directories in projects, and saving a writing profile under `.gogoingai/wenqu-skills/profile.md` or `$HOME/.gogoingai/wenqu-skills/profile.md`; do not put secrets, cookies, private contact details, or private paths into the profile or article materials.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill instructs collecting and persistently storing reader/author profiles, preferences, and writing context beyond what is strictly necessary for a single writing task. This creates a data minimization and privacy risk because personal behavioral metadata is retained across sessions and projects without clear limits, consent granularity, or deletion rules.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill reads from and writes to a global profile file under $HOME, which expands access beyond the immediate project and can expose or overwrite cross-project personal data. For a writing skill, touching user-global files increases the blast radius of mistakes and creates unnecessary privacy and integrity risk.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrases are broad enough to match many ordinary requests such as '帮我写' or 'analyze source code', which can cause the skill to activate in contexts the user did not intend. Because this skill performs extensive file reads/writes and can invoke other skills, accidental activation can lead to unnecessary workspace modification, unwanted persistence, and overcollection of local context.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The workflow trigger table mixes ambiguous cues like '修改', '检查', and '发布' without strong boundary checks, increasing the chance that a casual user utterance routes into the wrong high-impact workflow. In this skill, misrouting matters because different branches can load persistent state, alter files, or invoke publication/review subskills with side effects.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly says user profile information will be saved for future use, but it does not clearly explain retention scope, sensitivity boundaries, who can access it, or how users can revoke it. This undermines informed consent and may lead users to disclose personal or organizational information that persists longer than expected.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The file is entirely in Chinese and does not offer a language choice or document a justified locale restriction, which can exclude or mislead users who operate in other languages. In a writing workflow skill, this can cause users or downstream agents to misunderstand mandatory process constraints and produce incorrect outputs or skip required checks.

Static analysis

No suspicious patterns detected.