Security audit

Sspai Hot Cn

Security checks for vulnerabilities and agentic risk

Overview

The skill appears low-risk for system security, but its main behavior is under-disclosed because it advertises current SSPAI hot-article monitoring while the included script returns fixed mock data.

Install only if you are comfortable treating the output as sample or demo data unless the publisher updates it to fetch live SSPAI content. It does not show signs of stealing data or modifying your system, but users should not rely on it for current article rankings.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list includes broad generic terms such as “数码评测” and “效率工具,” which can appear in ordinary user conversation unrelated to this skill. This can cause unintended invocation or routing conflicts with other skills, reducing user control and making prompt-selection behavior less predictable.

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The skill content is primarily Chinese and does not indicate any language negotiation or fallback despite being usable in a broader environment. If auto-invoked for users not expecting Chinese output, it can create confusion, degrade usability, and lead to misleading interactions where the user cannot easily verify the returned content.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill advertises monitoring SSPAI hot articles, but the implementation only serves hardcoded mock content. This is a genuine integrity issue because downstream users or agents may rely on the output as if it were current external data, leading to misinformation or incorrect automated decisions.

Natural-Language Policy Violations

Low

Confidence: 81% confidence
Finding: The manifest identifies the skill as Chinese-focused through the name suffix "-cn", a Chinese-language description, and the "chinese" tag. Because no user choice or opt-in is described in this file, this appears to hard-code a locale/language preference rather than offering a selectable option.

Intent-Code Divergence

Low

Confidence: 95% confidence
Finding: The docstring states that the function retrieves SSPAI hot articles, but it actually returns static mock data. While not directly enabling code execution or data theft, this mismatch is a security-relevant deception/integrity problem because it can mislead operators, auditors, or dependent automation about the provenance and freshness of the data.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: This code emits a fixed Chinese heading in its default output, and the surrounding docstrings/comments also indicate a Chinese-only presentation. Under the language/locale policy rule, a skill should not force a specific language unless it offers user choice or clearly documents a justified locale constraint.