Security audit

詹明明·公众号短文

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent WeChat short-post drafting skill with expected local side effects such as saving drafts, storing limited memory, and copying text to the clipboard.

Install only if you are comfortable with the skill reading zmm reference and memory files, saving drafts and generated banners under your vault, updating the related topic pipeline, remembering style feedback, and copying the final text to your clipboard. Review generated content before publishing; the skill says it will not publish for you.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to run `pbcopy` to place generated text into the host clipboard, which is a host-side side effect outside the minimum needed to draft content. Clipboard writes can overwrite a user's existing clipboard contents without clear consent and create a surprising boundary crossing from content generation into workstation manipulation.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger list includes broad natural-language activations such as requests equivalent to 'make a WeChat short post,' which can match ordinary conversation and invoke the skill unexpectedly. Over-broad triggering increases the chance that file access, memory access, and side-effecting workflow steps are activated without the user intentionally selecting this specific skill.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill performs file writes, image generation/storage, and clipboard manipulation, but those side effects are not prominently disclosed in the user-facing skill description. When a skill can persist data or alter the host environment without upfront notice, users cannot provide informed consent and may trigger actions they did not expect.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The skill directs the agent to read from and write to persistent memory paths under `{vault}` and `08-技能记忆/...` without an explicit privacy notice or data-minimization limits. While memory use can be legitimate for personalization, undisclosed persistence risks storing sensitive user preferences or content history longer than expected.

Static analysis

No suspicious patterns detected.