Security audit

AI KEY·选题先试水

Security checks for vulnerabilities and agentic risk

Overview

This skill drafts and tracks X test posts using local creator data in a disclosed, bounded way, with no hidden posting, credential use, remote payloads, or destructive behavior found.

Install only if you are comfortable letting the skill read AI KEY reference/memory files and a local CSV of your X posts, write drafts and pipeline records in your vault, and overwrite the clipboard with finalized post text. Review the generated draft before manually posting to X.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description focuses on content generation for cheap topic validation on X, plus test-pipeline registration and downstream decisioning based on real interaction data. The actual code instead performs retrospective analytics on an existing dataset of posts: it discovers a CSV path, reads local files, filters rows, sorts by bookmark rate, and prints top-performing posts. This is a materially different primary purpose—voice calibration / historical post analysis rather than transforming user fragments into a test post. The code also accesses local filesystem/config resources that are not implied by the declared behavior. Therefore this is a clear description-behavior mismatch.

Vague Triggers

High

Confidence: 96% confidence
Finding: The trigger phrases are broad enough to match ordinary conversation, which can cause accidental invocation of the skill in unrelated contexts. In an agentic environment, unintended activation matters because this skill is authorized to read local references and memory paths and may write local files, so a casual phrase could cause unintended data access or state changes.

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The instructions impose a mandatory language policy via “零术语” and direct the skill to avoid certain terminology entirely when speaking to the user. This enforces a specific communication style without offering the user a choice or opt-in, which fits the language-policy violation criterion.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The manifest describes this skill as turning an idea fragment into plain-text X content for cheap validation, while the code/documentation also performs local operational steps: writing draft files, copying content to the clipboard, and registering entries in a testing pipeline. Those file and clipboard side effects go beyond pure text generation, even though they support the broader workflow described later in the longform instructions.

Context-Inappropriate Capability

Low

Confidence: 80% confidence
Finding: A skill presented as generating X post text and registering test results does not obviously need direct clipboard access unless that behavior is explicitly declared. Clipboard writes are an extra local-system capability with side effects outside the core content-generation role.

Natural-Language Policy Violations

Low

Confidence: 89% confidence
Finding: This shell script includes natural-language comments and an error message in Chinese while also using English identifiers and labels. The file does not indicate that the skill is region-specific or give users a language/locale choice, which can violate a language policy requiring opt-in or documented justification.

Static analysis

No suspicious patterns detected.