AI KEY·今天拍什么

• Outcome: Review
• Latest audit: Sep 23, 2026 · 4:17 AM UTC
• Version: 0.5.3

Overview

The skill is mostly a coherent short-video topic workflow, but it gives itself automatic authority to persist user feedback into shared framework and memory files without explicit user approval.

Install only if you are comfortable letting this skill read your content vault, run the named local project scripts, and update topic pipeline or memory files. Before using it, consider changing the automatic feedback writeback behavior to require explicit confirmation and keeping saved feedback in a skill-owned file rather than a shared framework that affects other workflows.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases include broad everyday requests like '帮我出选题' and '这个题能不能做', which can cause accidental activation outside a narrowly intended workflow. Over-broad activation matters more here because the skill can read memory, run scripts, and write files, so mistaken invocation can lead to unintended access or persistence.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The instruction to '默认按它执行' and to automatically write any user feedback back into a broader framework creates hidden cross-context state mutation unrelated to the narrow advertised purpose of topic selection. Automatic write-back into shared framework files can poison future runs, persist prompt injection from users, or alter behavior of other skills without explicit approval.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Automatic write-back of user feedback into a shared framework is unjustified for a topic-selection skill and creates a persistence channel from untrusted conversation content into system behavior. Because all skill content must be treated as adversarial, this is especially dangerous: a malicious user could seed future prompt state or modify downstream decision rules indirectly.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The default-execution language says to follow an external '唯一导航' by default without the user needing to specify it, which makes activation scope ambiguous and expansive. This increases risk because ordinary feedback can implicitly trigger hidden file reads/writes and broader framework logic the user did not request.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The skill invokes local Python scripts and stored datasets to mine candidates and rebuild indexes, which materially broadens capability beyond the manifest's simple advisory framing. Script execution against local paths increases the attack surface for unintended code execution, sensitive data exposure, and side effects if the environment or referenced files are compromised.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill goes beyond conversational topic advice by instructing persistent filesystem mutation ('写进 06-选题装配/选题管道.md'). That expands its operational scope into stateful side effects, which can surprise users, create unauthorized data changes, and make the skill capable of modifying shared project artifacts rather than only analyzing topics.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill directs persistent storage of user-specific preferences and 'validated methods' into memory files, which exceeds the manifest's clearly disclosed scope. Persisting individualized behavioral data can create privacy risks, unintended profiling, and long-lived prompt-state contamination if users did not knowingly opt in.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill content is entirely in Chinese and presents interaction flow, instructions, and outputs without offering a language choice or fallback. This can exclude users who do not read Chinese, cause misunderstandings about constraints or advice, and create an avoidable accessibility and consent issue, though it is not a classic security exploit.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The entire skill file is written as prescriptive guidance in Chinese and presents the method as the shared basis for multiple skills, but it does not indicate that language choice is optional or user-configurable. Under the policy for natural-language violations, a skill that effectively constrains language/locale without opt-in should be flagged unless the constraint is explicitly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The entire skill file is written exclusively in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file’s instructional content is entirely in Chinese and does not indicate that users may choose another language or that the skill is explicitly limited to Chinese-language use. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The file mandates “零术语” and instructs the skill to avoid theoretical terms in user-facing responses. This imposes a fixed language/style policy without offering the user a choice, which can conflict with language or locale preference requirements.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The file’s natural-language instructions and required output phrasing are entirely in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-only context. Under the stated policy, forcing a specific language without opt-in can constitute a locale/language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The text says '留给 澳洲AI教父 判' and later '在 澳洲AI教父 拍板前' as the authority for resolving the issue. This introduces a locale/persona-specific decision framing without offering user choice or documenting why an Australia-specific authority is required.

Static analysis

No suspicious patterns detected.