Security audit

AI KEY·哪里会被划走

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed script-review skill with scoped behavior; its main caveat is that it stores limited user feedback and validation notes for future use.

Before installing, know that this skill is designed mainly for Chinese short-video script review and may save your corrections or retention-performance lessons into its scoped memory folder for future sessions. If you do not want that history retained, disable or remove the memory-write behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill lists trigger phrases such as “这稿子顺不顺”, “逻辑有没有断”, “读起来卡不卡”, and “does this script flow”, which are common conversational requests a user might say in many general writing contexts. The description does not provide exclusion conditions or contextual limits, so the activation scope is ambiguous and could cause unintended invocation.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a script-flow diagnostic tool, but it also instructs the agent to persist user-specific preferences, corrections, and outcome data into long-term memory. That expands data collection beyond what is necessary for the immediate task and creates privacy and data-minimization risk, especially if users are not explicitly informed and given a choice.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Persistently collecting user corrections and retention-related validation data is not clearly required to perform a one-off script-flow diagnosis. Without strong justification, this creates unnecessary accumulation of user interaction history and behavioral data that could later be misused, leaked, or repurposed beyond the user’s expectations.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to write user-specific interaction history and validated performance data into persistent memory files. Persistent storage of this kind can reveal preferences, behavioral feedback, and potentially sensitive business performance context over time, especially if memory isolation, retention, and consent are weak.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: This markdown file uses Chinese throughout, which can impose a specific language on users or maintainers without opt-in. Under the policy rule for natural-language violations, a forced language choice is reportable unless the locale restriction is explicitly justified or optional.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The document is written entirely in Chinese and includes direct interaction instructions such as '回数字就行' and '不知道下一步 → 回 `/aikey`' without indicating that another language is available. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The title and operating-status text are entirely in Chinese and indicate preloaded style/interaction constraints, but the file does not provide any opt-in, alternative language, or justification that this skill is region-specific. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The user-facing next-step instructions are written as fixed Chinese interaction options, including slash-command guidance like “回 `/aikey`”, with no indication that another language can be used. This is a natural-language locale policy concern because the skill appears to require a specific language without documenting user choice or a justified region-specific constraint.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: The file content is entirely written as Chinese-only evaluator instructions, including the title and scoring guidance, with no indication that language selection is optional or limited to a documented region-specific use case. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.