詹明明·口播稿写作

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:23 PM UTC
• Version: 0.2.10

Overview

This is a coherent Chinese script-writing skill, but it gives mutable external vault files and automatic memory writebacks too much durable influence without clear user approval.

Install only if you intentionally use this private Chinese writing vault workflow and are comfortable with it reading configured vault materials and writing drafts, feedback-derived rules, memories, and content units. Review or disable automatic writeback, keep the vault private and trusted, and require explicit confirmation before storing feedback or promoting derived cases into reusable libraries.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:21
• Finding: Mutable External Vault Instructions Can Override Audited Skill Rules## Vulnerability Details **File Location**: `SKILL.md:21-39, 52-58` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Complete Vulnerable Snippet The following is a faithful English rendering of the relevant source instructions: ```markdown First read `zmm/references/Family-Constitution.md`. If it cannot be read, state that the constitution cannot be read and stop. Then read `zmm/references/Interaction-Specification.md`. The built-in criteria are in `references/Rule-Cards.md`. When corresponding rule files exist in `{vault}`, the vault takes precedence and the rule cards are only the baseline. Then read these seven items in order: 1. `config.paths.format` 2. The latest retrospective in `config.paths.retro` and `_draft/*-requirements.md` 3. `{vault}/00-Rules-and-Indexes/Spoken-Script-Generation-Standards.md` 4. `config.paths.voice` 5. `config.paths.feedback_rules` 6. `config.paths.published_index` 7. Selected sections of `{vault}/docs/SOT-Commercialization.md` `{vault}/00-Rules-and-Indexes/Copywriting-Framework-Main-Entry.md` is the sole navigation for how a piece of copy is written. Default to executing it. The user does not need to say which framework to use. Any user feedback is automatically written back according to section 5. ``` ### Technical Analysis The packaged skill delegates authoritative control to numerous mutable files outside the audited project. It explicitly states that rules found in the external vault take precedence over the bundled rule cards and identifies an external document as the sole workflow authority. This creates a trust-boundary violation. The package itself may be benign when reviewed, but its effective instructions can change whenever the vault or configured paths change. Content loaded from those paths is treated as executable agent instruction rather than untrusted reference data. No integrity check, schema validation, signature ...[truncated 2191 chars]
• Remediation: ## Remediation Suggestions 1. Remove the rule that external vault content automatically overrides packaged security-critical instructions. 2. Treat all vault and configuration-derived text as untrusted reference data, not executable agent policy. 3. Package and version all mandatory workflow and safety rules with the skill. 4. Allowlist external paths and resolve canonical paths before access to prevent redirection outside approved directories. 5. Validate loaded files against a strict schema that permits data and writing preferences but rejects tool instructions, permission changes, persistence directives, and safety overrides. 6. Require explicit user confirmation before applying a newly discovered or modified external rule. 7. Display the source path, version, checksum, precedence, and proposed behavioral effect before activation. 8. Use signed manifests or pinned cryptographic hashes for external policy files when external storage is unavoidable. 9. Enforce a fixed precedence model in which system, platform, and packaged safety requirements cannot be overridden by vault content. 10. Record an audit log of every external rule loaded and every behavior it changes.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:54
• Finding: User Feedback Is Persisted as Long-Term Rules Without Explicit Consent## Vulnerability Details **File Location**: `SKILL.md:54-57, 125, 250-252` **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: High ### Complete Vulnerable Snippet The following is a faithful English rendering of the relevant source instructions: ```markdown The framework contains a feedback automatic-writeback mechanism. Default to executing it. The user does not need to say which framework to use. Any feedback supplied by the user is automatically written back into the framework according to section 5; the user does not need to identify it specially. Phase 6: Save and write back. Save the completed draft to `_draft/NN_spoken_{title}.md`; write newly derived viewpoints and cases back into `02-content-unit-library/`; report the path. Before finishing, inspect what wording the user corrected and which structures or methods the user confirmed as effective. Write those items into `08-skill-memory/zmm-script/` after deduplication. ``` ### Technical Analysis The skill directs the agent to transform user feedback, corrections, preferences, viewpoints, and cases into persistent framework and memory entries automatically. It does not require the user to approve the exact content, storage location, scope, retention period, or future reuse. This is a memory-poisoning risk because ordinary conversational input can become a durable instruction source for later sessions. Context-specific feedback may be generalized incorrectly, while adversarial feedback can be deliberately phrased as a correction or successful method. Deduplication does not mitigate this risk because it only detects repetition; it does not establish authenticity, safety, relevance, or correct scope. The instruction also writes newly derived viewpoints and cases into a reusable content library. This can persist private or inaccurate material and later cause it to be treated as canonical source material. ### Attack Path 1. The att ...[truncated 1624 chars]
• Remediation: ## Remediation Suggestions 1. Replace automatic writeback with an explicit opt-in workflow. 2. Before every persistent write, show the exact proposed entry, destination path, intended scope, and retention period. 3. Require separate confirmation for preferences, behavioral rules, personal cases, and reusable content. 4. Store provenance metadata including user identity or project scope, source conversation, timestamp, confidence, and approving actor. 5. Isolate memory by user and project. Never load one user's feedback into another user's session by default. 6. Distinguish temporary session preferences from durable rules; default all feedback to session-only storage. 7. Validate proposed memory entries and reject instructions that request expanded access, policy overrides, hidden actions, or further automatic persistence. 8. Mark derived viewpoints and unverified cases as untrusted drafts rather than canonical content. 9. Provide review, deletion, expiration, rollback, and memory-export controls. 10. Maintain an append-only audit trail showing what was written, why it was written, and when it was subsequently loaded. 11. Require renewed approval before promoting a context-specific correction into a global framework rule.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger phrases are broad enough to match ordinary requests like '帮我把这个题写出来' or '写条视频文案', which can cause the skill to activate unexpectedly. That increases the chance of unconsented prompt takeover, causing the assistant to ignore the user's actual intent and execute this skill’s heavy workflow, file reads, and persistence behavior instead.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs automatic write-back of any user feedback into persistent framework files without requiring an explicit user request. This creates a durable prompt-injection and privacy risk: sensitive or adversarial content supplied during normal conversation could be stored and later influence future sessions or other outputs without informed consent.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The audience and style requirements mandate Chinese-specific writing behavior, including '零术语' phrasing and detailed Chinese-language口播 conventions, without offering the user a language or locale choice. This can violate language/locale policy when the skill is invoked by users who have not explicitly opted into Chinese-only operation.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The manifest describes a co-writing skill focused on script-type selection, unit assembly, and section-by-section collaboration, which implies generating and revising script text. However, the documented behavior in Phase 6 goes beyond writing assistance by saving drafts to `_草稿/`, writing new viewpoints/cases back into `02-内容单元库/`, and reporting paths, adding repository-maintenance side effects not disclosed in the manifest.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The manifest explicitly frames the skill as '逐段共创，不一键成稿' and the workflow earlier says to write one section at a time with confirmation between sections. But the later output contract mandates '产出格式 = 整篇口播稿' and specifies a full end-to-end script body plus addenda, which conflicts with the claimed collaborative, non-one-shot mode.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The instruction to record user corrections, preferences, and effective methods into skill memory files creates persistent storage of behavioral data without a clear consent boundary. In a prompt-driven system, this can preserve personal preferences, sensitive phrasing, or malicious instructions that later bias outputs across sessions.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This markdown file contains explicit natural-language instructions that require Chinese-language naming and citation formatting, such as using Chinese names and a simplified audience assumption, without indicating that the user may choose another language or locale. Because SQP-3 applies to all file types and covers language/locale policy violations, this is a policy concern.

Intent-Code Divergence

Low

• Confidence: 78% confidence
• Finding: Phase 5 states '不写任何行动指令' and gives examples like not telling the user to follow, DM, or comment. Later, the required output includes a '素材采集清单' explicitly described as '交给用户的行动清单', which is still a form of instruction to perform follow-up actions.

Static analysis

No suspicious patterns detected.