Security audit

AI KEY·哪里会被划走

Security checks for vulnerabilities and agentic risk

Overview

This script-review skill also requires saving feedback, performance figures, and writing-profile samples without a clear permission step.

Review the saving behavior before installing. Require explicit agreement on which feedback, figures, and writing samples may be retained, where they are stored, and how to delete them; otherwise keep the review session-only. Obtain and review the missing family documents before enabling the workflow. The concern is insufficient control over persistent records; the inspected package shows no exfiltration or destructive behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

The skill instructs the agent to persist user feedback and performance metrics without a user-facing disclosure.

Medium

Category: Output Handling
Confidence: 90% confidence
Finding: The skill directs the agent to persist user corrections and numerical performance results without requiring disclosure or authorization for that retention. A script-flow review does not inherently authorize durable storage of user feedback or potentially sensitive account analytics, creating an unexpected-retention risk, although no external transmission is shown.
Content: No source excerpt is available for this finding.

L45–L48 instruct persistent author-profile updates beyond the declared script-flow review and optional rewrite.

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: The rule requires feedback to become persistent author-profile entries, including updated dates and registered samples, without an authorization check. Although stylistic personalization is relevant to rewriting, silently modifying a durable profile exceeds a one-off review and can retain user material or alter future behavior without the user's awareness.
Content: No source excerpt is available for this finding.

The report template requires a publish-readiness verdict despite the manifest explicitly excluding that assessment.

Low

Category: Excessive Agency
Confidence: 98% confidence
Finding: The required summary includes “动完能不能发” (whether the script can be published after changes). The manifest at L004–L006 explicitly assigns publish-readiness judgments to aikey-review, and L129 reiterates that exclusion, so this output requirement exceeds the skill’s declared retention-analysis scope.
Content: No source excerpt is available for this finding.