Security audit

AI KEY·口播稿写作

Security checks for vulnerabilities and agentic risk

Overview

This writing skill needs review because it automatically saves all feedback into shared writing rules without clear limits.

Before use, inspect the missing companion framework and Python helpers, restrict access to your chosen writing vault, and require review before feedback changes lasting shared rules. Keep backups of those rules. Obtain participants' consent before recording conversations and remove sensitive details before sharing stories with AI. The supplied files show no malicious payload, but the missing dependencies remain unverified.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Automatic feedback persistence lacks a user-facing notice that shared framework files will be modified.

Medium

Category: Output Handling
Confidence: 88% confidence
Finding: The skill directs automatic persistence of any user feedback into shared framework files without requiring notice or distinguishing temporary draft corrections from durable rules. This can unexpectedly alter future sessions and related workflows, allowing context-specific or adversarial feedback to contaminate persistent guidance.
Content: No source excerpt is available for this finding.

The story-gathering workflow recommends recording personal conversations or sharing life stories with AI without privacy or consent warnings.

Medium

Category: Output Handling
Confidence: 91% confidence
Finding: The workflow recommends recording informal conversations or sharing life stories with AI while soliciting detailed work, relationship, and family experiences, without addressing consent or data handling. In this personal-story context, following that advice could expose sensitive information about the user or third parties, although the source does not itself perform recording or transmission.
Content: No source excerpt is available for this finding.

Requires Chinese translations in finished drafts without offering a language choice.

Medium

Category: Output Handling
Confidence: 97% confidence
Finding: The rule states that foreign-language originals must not appear in finished drafts and that Chinese translations must be used instead. This explicitly mandates an output language without user opt-in or a documented justification for a Chinese-only constraint.
Content: No source excerpt is available for this finding.

The skill requires Chinese translations in finished scripts and prohibits original foreign-language quotations without user opt-in.

Medium

Category: Output Handling
Confidence: 98% confidence
Finding: L402 explicitly requires quotations in finished scripts to be Chinese translations and excludes foreign-language originals; L404 enforces this during review. This imposes a specific output language without offering a user choice or documenting a locale-specific justification.
Content: No source excerpt is available for this finding.

The mandatory citation template requires authors’ names in Chinese without a language choice.

Low

Category: Output Handling
Confidence: 88% confidence
Finding: The fixed citation format explicitly requires a “[中文名]” (Chinese name), imposing a specific language on part of the generated output. The file provides no user opt-in or explicit justification for making this localization mandatory.
Content: No source excerpt is available for this finding.