Security audit

AI KEY·公众号短文

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent WeChat short-post drafting helper, with disclosed local draft, clipboard, image-generation, and tracking side effects that users should be aware of.

Install this if you want an AI KEY workflow that creates WeChat short-post drafts and banner assets in your vault. Expect it to read local AI KEY references and memory, use configured image-generation credentials if available, save draft files, update a topic-tracking note when applicable, and copy the finished body to your clipboard. Review generated content before publishing; the skill explicitly says it should not publish for you.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill declares broad natural-language triggers such as '做个公众号短文' and '公众号贴图', which can overlap with normal user conversation rather than an intentional skill invocation. In systems with automatic routing, ambiguous triggers can cause the skill to activate unexpectedly, leading to file writes, memory updates, and clipboard manipulation the user did not clearly request.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill performs host-side actions including writing draft files, updating tracking records, and copying content to the clipboard, but the description and trigger surface do not clearly warn the user about these side effects. Lack of transparent disclosure undermines informed consent and increases the risk of users unintentionally permitting persistent changes to local storage or workflow records.

Context-Inappropriate Capability

Low

Confidence: 86% confidence
Finding: The skill instructs the agent to copy the generated post body into the system clipboard via `pbcopy`. Clipboard access is a side effect outside the core need of drafting content, and can overwrite a user's existing clipboard contents without explicit consent. In an agent environment, this creates an avoidable channel for unintended data handling and surprising host interaction.

Static analysis

No suspicious patterns detected.