Security audit

AI KEY·口播稿写作

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Chinese script-writing assistant, but it automatically reads and updates local content and memory stores in ways users should review first.

Install only if you want this skill to use a local AI KEY-style content vault and to keep improving local drafting rules over time. Review or disable the automatic feedback, content-library, and memory writeback behavior if you do not want corrections, preferences, or draft-derived material retained after a session.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger list includes very broad natural-language phrases such as generic requests to 'write a script' or 'help me write this topic out,' which can cause accidental invocation in unrelated conversations. Unintended activation is dangerous because this skill has aggressive workflow, file-reading, and persistence behavior, so a casual phrase may launch actions the user did not intend.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The instruction to automatically write any user feedback back into the framework without the user specifically asking creates silent long-term retention and profile building. Even if intended as convenience, it expands data collection beyond immediate script generation and can store preferences or sensitive information unexpectedly.

Natural-Language Policy Violations

Medium

Confidence: 82% confidence
Finding: The file states a default content form of “知识付费口播” unless the user explicitly asks for something else, which establishes a default linguistic/cultural mode rather than offering an upfront choice. The document is otherwise bilingual but does not clearly offer users a language or locale selection before applying the default mode.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill repeatedly promises section-by-section co-writing and explicit user confirmation, but later requires producing and saving a full finished script with additional deliverables. That mismatch can cause the agent to overrun user intent, generate more content than authorized, and persist outputs before the user has approved them.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill instructs automatic persistence of generated drafts and write-back into content-unit libraries and memory stores, which goes beyond narrow script drafting and introduces unauthorized data modification. This is risky because it can silently create or alter files based on unverified model output and user interaction history.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The instruction says to assume the audience is effectively unfamiliar and specifically requires presenting the author's name in Chinese and explaining it in plain language. This imposes a specific language/locale presentation policy in the skill guidance, but the document does not provide user opt-in or explain that the skill is intentionally limited to a Chinese-language context.

Static analysis

No suspicious patterns detected.