Security audit

ime_message_skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed text-rewriting helper that sends user-provided message text to a configured model API, with no hidden persistence or destructive behavior found.

Install only if you are comfortable sending the text you rewrite to the configured model service. Avoid using it on highly sensitive chats unless your deployment has appropriate privacy, logging, and retention controls, and pin the OpenAI SDK dependency for managed environments.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

Location: scripts/rewrite_client.py:11
Finding: Unpinned Third-Party Dependency Installation Guidance
Content: View full analysis
Remediation: View remediation
``` 2. Generate and verify cryptographic hashes for production installations, such as by using a hash-locked requirements file with: ```bash pip install --require-hashes -r requirements.txt ``` 3. Commit a lock file generated by the project's selected dependency-management tool and review dependency updates before deployment. 4. Install packages only from an explicitly trusted package index, preferably in an isolated virtual environment. 5. Replace the unconstrained installation message with instructions that reference the project's locked dependency file, for example: ```text Install the reviewed dependencies with: pip install --require-hashes -r requirements.txt ``` 6. Add automated dependency and supply-chain scanning to CI, and verify package provenance where supported. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill references environment-variable-based API token usage and a script that invokes an external model service, but it does not declare any explicit tool scope or permissions. This creates a capability/authorization mismatch: a host may not clearly constrain or review the skill's access to environment data, increasing the risk of unintended secret exposure or over-broad execution privileges.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description and instructions are entirely framed around Chinese input and prescribe Chinese rewriting behavior by default ('将…整理成…自然书面语'), with translation only occurring when the user explicitly specifies a target language. This creates a natural-language locale constraint without an explicit opt-in or documented justification that the skill is intended only for Chinese-language use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest text names the skill in Chinese ("输入法语音消息书面化") with no indication that users can choose another language or locale. The stated policy flags language or locale constraints when they are imposed without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: 该文档明确要求通过远程模型接口发送用户输入文本进行改写，但没有向使用者提示这些文本会离开发送端并传输到第三方服务。对于输入法/语音转写后的消息场景，文本中很可能包含私人聊天、联系人信息、日程或其他敏感内容，缺少透明披露和数据处理提醒会带来隐私与合规风险。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The title explicitly labels the integration guidance as Chinese-only ("中文"), and the document consistently assumes Chinese output such as "整理成书面语" without any indication that users may choose another language or locale. This can violate a language/locale policy when the skill behavior is effectively fixed to a specific language without opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code sends user-provided text to a remote model API and can optionally emit the full raw model response as JSON, but it provides no explicit warning, consent step, or privacy notice at the point of use. In this skill’s context, the input is likely to be IME or voice-transcribed message content, which often contains sensitive personal or business communications, so silent transmission to a third-party endpoint creates a real data exposure risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: 标题明确标注“模型接口说明（中文）”，且示例 system/user 内容均固定为中文表述，整体文档没有说明这只是示例语言，或用户是否可选择其他语言/locale。根据 SQP-3，若技能在自然语言层面强制特定语言而无用户选择或明确合理性，可能构成语言/locale 策略问题。
Content: No source excerpt is available for this finding.