Security audit

AI KEY·开头前五秒

Security checks for vulnerabilities and agentic risk

Overview

This is mainly a short-video opening-hook writing skill, but it automatically stores user feedback and preferences in persistent vault/framework memory without clear user approval.

Install only if you are comfortable with an AI KEY writing workflow that can read local AI KEY reference/vault files and automatically remember your hook preferences or rejected styles across sessions. Review or disable the write-back behavior if you do not want feedback from normal chats to become persistent rules.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The manifest description lists trigger examples such as “开头怎么写”, “这个开头行不行”, “how to write the opening”, and “give me some hooks”. These are generic requests that overlap with ordinary writing help, and the file does not provide exclusion conditions or tighter scope constraints to distinguish when this skill should activate versus other writing-related skills.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill instructs automatic write-back of user feedback and inferred preferences into persistent memory files, including storing what hook forms a user rejects or prefers. That creates unnecessary retention of interaction data beyond what is needed to generate hooks, and can enable profiling or cross-session use without clear consent or minimization.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This file presents all instructions and examples only in Chinese, and there is no indication that the skill is region-specific or that users may choose another language.

Context-Inappropriate Capability

Low

Confidence: 81% confidence
Finding: The manifest presents this skill as an opening-hook specialist, but the file directs the agent to route users to other skills such as `/aikey-mvp`, `/aikey-script`, `/aikey-review`, and `/aikey`. While related, this turns the skill into a coordinator across other tools rather than only diagnosing and generating hooks.

Static analysis

No suspicious patterns detected.