Security audit

AI KEY·找对标

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its creator-research purpose, with cautions about API-key handling, saved preferences, and missing support files.

Review the missing fetch script and shared dependencies before enabling automation. Use a dedicated, narrowly permissioned TikHub key and avoid printing it into logs. Approve scraping costs and third-party login access explicitly. Decide whether rejection reasons and preferences should persist, and keep the configured memory folder private.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/抓取手册.md (reported line 35)May include surrounding context.
第 5 步　把 key 存起来。在电脑上打开「终端」，粘这一行（把 你的key 换掉）后回车：

bash
echo 'TIKHUB_API_KEY=你的key' >> ~/.env

脚本会自己去 ~/.env 读，之后不用再管。

The workflow saves user-specific preferences to persistent memory without instructing the agent to notify the user.

Medium

Category: Output Handling
Confidence: 88% confidence
Finding: The workflow directs the agent to persist users’ rejected options, reasons, and preferences without an explicit notification or consent step in the supplied instructions. Although personalization is relevant to this skill, retaining these potentially revealing judgments beyond the conversation creates an undisclosed privacy risk, especially if memory is later reused or shared.
Content: No source excerpt is available for this finding.