Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Dianping review-writing and manual packaging helper; it has local file and helper-skill risks, but I found no hidden posting, exfiltration, persistence, or destructive behavior.
Install the companion hekouwang-writer-skill only from a trusted source, avoid pointing HEKOUWANG_WRITER_SKILL_DIR at untrusted folders, and review/delete generated dist packages because they may contain personal photos, faces, receipts, locations, and review text. Treat the advertised Pro automation as a separate higher-risk product because it may interact with a real Dianping account.
A description-behavior mismatch is security-relevant because users and orchestrators may invoke the skill expecting harmless review-writing, while underlying code reportedly performs unrelated OCR-style matching and publisher/receipt-learning behaviors. Hidden or undeclared behavior breaks trust boundaries and can enable collection, processing, or action on data outside the user’s informed intent.
The skill describes shell, environment, file read, and file write driven workflows, but declares no explicit tool scope or permissions boundaries. That creates unnecessary ambiguity about what the agent may access at runtime and increases the chance of over-broad execution, accidental file exposure, or shell misuse if the host platform grants default capabilities.
The trigger phrases are broad enough that the skill could activate in loosely related conversations, causing it to handle photos, text, or posting-related tasks when the user did not explicitly request this specific workflow. Over-broad invocation raises the risk of unintended data processing and of the model following this skill in contexts where a different, safer skill should be used.
The description states that non-Dianping Chinese documents should be handed off elsewhere, and the overall instructions are written as a Chinese-only workflow. This imposes a language constraint without stating user opt-in or a documented policy justification such as region-specific compliance requirements.
Documenting automated posting and later collection of engagement metrics introduces capabilities unrelated to merely helping a user draft reviews. In the context of a review-platform assistant, these features increase the chance of account misuse, platform abuse, and privacy issues because they imply active interaction with a third-party service and continued monitoring after publication.
The page explicitly markets Pro features for automated posting and post-publication metric collection even though the skill is described elsewhere as a consumer-side writing assistant. This broadens the operational scope into account-linked automation and tracking, which can enable platform-policy evasion, unintended data collection, and higher-risk behavior than a simple drafting tool.
The comment text specifies checks against reader-focused information using Chinese-language categories and keywords only, indicating the skill behavior is constrained to Chinese content. There is no indication of user opt-in, alternative language support, or a documented region-specific justification in this file.
The document enforces a single language/locale in its natural-language instructions, and there is no indication that users can opt into another language or that the restriction is justified by a region-specific purpose. This matches the policy-violation category for language or locale constraints without user choice.
This file contains natural-language instructions that are exclusively Chinese-specific, including explicit references to Chinese writing style and a Chinese-only skill (Humanizer-zh). Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation when no alternative or opt-in is provided.
This markdown file is written entirely in Chinese and prescribes concrete output phrasing, labels, and examples in Chinese, such as the title and section templates. There is no indication that the skill is region-specific or that users can opt into another language, which can violate language/locale policy requirements.
This Python file presents its purpose and usage entirely in Chinese, and later user-facing output and argument help are also Chinese-only. That creates a locale policy concern because the skill effectively requires a specific language without offering any language choice or documenting a justified region-specific constraint.
The error messages and validation require a title in the specific Chinese format "地点 · 名称", and the file further assumes Chinese text rendering and Chinese fonts. This is a natural-language locale constraint embedded in the skill behavior, but the file does not offer a language choice or document a justified region-specific limitation.
This Python file contains its primary natural-language instructions, usage text, and operational messages exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
The module description and all user-facing strings are written in Chinese and describe the tool as checking Chinese writing conventions, but there is no indication of user choice or explicit documentation that the skill is intentionally Chinese-only. This can violate language/locale policy when a skill implicitly forces one language without opt-in or justification.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
本 skill 运行时依赖 hekouwang-writer-skill（>= 1.1.0）。查找顺序：
1. 显式传入的目录（content_gate.py --writer-dir）
2. 环境变量 HEKOUWANG_WRITER_SKILL_DIR
3. 与本 skill 同级的 hekouwang-writer-skill/（ClawHub、SkillHub、~/.claude/skills 等安装方式都是同级）
4. ~/.claude/skills、~/.codex/skills、~/.agents/skills、~/.cursor/skills 下的 hekouwang-writer-skill/
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
本 skill 运行时依赖 hekouwang-writer-skill(>= 1.1.0)。查找顺序:
1. 显式传入的目录(content_gate.py --writer-dir)
2. 环境变量 HEKOUWANG_WRITER_SKILL_DIR
3. 与本 skill 同级的 hekouwang-writer-skill/(ClawHub、SkillHub、~/.claude/skills 等安装方式都是同级)
4. ~/.claude/skills、~/.codex/skills、~/.agents/skills、~/.cursor/skills 下的 hekouwang-writer-skill/
The skill discovers an external skill directory from attacker-influenced sources and then executes code from it, which expands the trust boundary beyond the local writing-assistant logic described by the skill. Because the discovered directory can come from --writer-dir, an environment variable, or writable home-directory locations, a malicious local actor or poisoned installation can hijack the dependency and run arbitrary Python.
The code executes Python scripts from a dynamically discovered directory via CLI input, environment variable, sibling path, or user home skill folders, and only validates presence of expected filenames plus a version string from _meta.json. That means an attacker who can place or redirect a fake hekouwang-writer-skill in one of those locations can obtain arbitrary code execution in the context of this skill whenever checks run.
def _run(d: Path, script: str, text: str) -> dict:
proc = subprocess.run([sys.executable, str(d / "scripts" / script), "--json"],
input=text, capture_output=True, text=True, timeout=TIMEOUT)
if not proc.stdout.strip():
raise RuntimeError(f"{script} 无输出：{proc.stderr.strip()[-200:]}")
The code invokes four external Python scripts via subprocess, passing the provided text to them for analysis. While this is part of the bridge's function, the file itself provides no confirmation prompt or user-facing disclosure at the execution point that user content is being sent to another installed skill for processing.
The file's natural-language instructions are entirely in Chinese (e.g. the title and body text) and do not indicate that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
permit persons to whom the Software is furnished to do so.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
permit persons to whom the Software is furnished to do so.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
The README explicitly says the skill saves numbered original photos and generated copy into a local dist/ folder, but it does not prominently warn users about local persistence, retention, or who can access those files on a shared machine. Because the skill handles user photos and review text, this can lead to unintended exposure of personal data or sensitive image content if users assume processing is transient.
Although the README mentions removing phone numbers and QR codes and flagging faces later in the document, the packaging/processing flow does not give a prominent up-front warning that uploaded photos may contain sensitive personal information and should be reviewed before packaging or publication. Users may therefore process and save images containing private data they did not notice, increasing the chance of accidental disclosure.
The HTML declares lang="zh-CN", and the visible content throughout the page is written exclusively in Simplified Chinese. Under the stated policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.