搜爆款作品助手

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:39 AM UTC
• Version: 1.0.4

Overview

This skill is a disclosed public trend-research workflow with some documentation inconsistencies, but no evidence of hidden code, credential access, persistence, or destructive behavior.

Install only if you want Chinese-platform trend research. Treat results as public-search summaries, verify important links and engagement numbers manually, and be aware that a few auxiliary guides mention platforms outside the advertised WeChat/Douyin/Xiaohongshu scope.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Note

• Location: references/keyword-extraction-guide.md:45
• Finding: Excluded-platform search templates violate the enforced data-source boundary## Vulnerability Details **File Location**: `references/keyword-extraction-guide.md:45-46` **Vulnerability Type**: Conflicting and insecure Skill configuration **Risk Level**: Low ### Vulnerable Code ```text - "快手 + [话题] + 热门" - "B站 + [话题] + 播放量" ``` ### Technical Analysis The keyword extraction guide instructs the Agent to generate search queries for Kuaishou and Bilibili. These instructions conflict with the mandatory platform allowlist in `SKILL.md` and `references/core_workflow.md`, which restrict searches, collection, and analysis to WeChat Official Accounts, Douyin, and Xiaohongshu. Because `SKILL.md` directs the Agent to consult this guide during keyword expansion, the conflicting templates may be treated as operational instructions. This weakens the reliability of the allowlist and can cause the Agent to search or collect information from expressly excluded platforms. No command execution, credential exposure, privilege escalation, or local system access results from this issue. The vulnerability affects the integrity and declared scope of the Skill's data collection. ### Attack Path 1. A user requests keyword expansion or cross-platform analysis for a topic. 2. The Agent loads `references/keyword-extraction-guide.md`. 3. The Agent applies the listed platform query templates. 4. Searches are generated for Kuaishou or Bilibili. 5. Out-of-scope results may be collected, analyzed, or presented despite the three-platform restriction. ### Impact Assessment An affected Agent may disclose or rely on results from platforms outside the advertised allowlist. This can produce misleading reports, violate the Skill's declared collection boundary, and undermine downstream assumptions about provenance and compliance. The issue does not grant an attacker additional operating-system privileges, access to secrets, persistent execution, or control over local tools.
• Remediation: ## Remediation Suggestions 1. Remove the Kuaishou and Bilibili query templates. 2. Replace them with templates exclusively covering WeChat Official Accounts, Douyin, and Xiaohongshu. 3. Add an explicit statement that keyword expansion must never introduce a platform outside the central allowlist. 4. Define the allowlist once in the mandatory workflow and require every optional guide to reference that definition instead of maintaining independent platform lists. 5. Add a final validation step that rejects generated search queries containing excluded platform names or domains. 6. Add consistency tests that compare all platform references in auxiliary guides against the authoritative allowlist.

T09 · Insecure Skill Coding Practices

Note

• Location: references/angle-mining-guide.md:119
• Finding: Content-angle guidance recommends platforms outside the declared Skill scope## Vulnerability Details **File Location**: `references/angle-mining-guide.md:119-130` **Vulnerability Type**: Out-of-scope platform recommendation **Risk Level**: Low ### Vulnerable Code ```text ### B站 - **适合角度**：教程型、测评型、故事型 - **标题风格**：专业型、话题型、UP主风格 - **内容特点**：中长视频、弹幕互动、投币收藏 ### 快手 - **适合角度**：真实体验型、接地气型 - **标题风格**：口语化、老铁风 - **内容特点**：真实感、互动性强 ``` ### Technical Analysis The optional angle-mining guide contains platform-specific recommendations for Bilibili and Kuaishou. Both platforms are explicitly excluded by the authoritative workflow, which states that the Skill may search, collect, analyze, and report only data from WeChat Official Accounts, Douyin, and Xiaohongshu. When the guide is loaded for content-angle analysis, these sections can cause the Agent to expand its recommendations beyond the declared functional boundary. The issue is a configuration-integrity flaw rather than malicious code: no executable payload, external dependency, sensitive-data access, or persistence mechanism is present. ### Attack Path 1. A user requests content angles or platform adaptation advice. 2. The Agent loads `references/angle-mining-guide.md` as recommended by `SKILL.md`. 3. The Agent processes the Bilibili and Kuaishou adaptation sections. 4. The Agent includes excluded-platform recommendations or uses them to guide further searches. 5. The resulting deliverable no longer conforms to the Skill's documented three-platform boundary. ### Impact Assessment The affected output may contain unsupported or prohibited platform recommendations, creating provenance, compliance, and accuracy concerns. It may also encourage subsequent out-of-scope searches or analysis. This issue does not provide additional system privileges, access to private data, arbitrary code execution, tool replacement, or cross-session persistence.
• Remediation: ## Remediation Suggestions 1. Remove the Bilibili and Kuaishou platform sections from the guide. 2. If they must remain for documentation purposes, label them unambiguously as excluded and prohibit their use in searches, analysis, recommendations, and final output. 3. Limit the platform-adaptation section to WeChat Official Accounts, Douyin, and Xiaohongshu. 4. Generate auxiliary platform sections from a single authoritative allowlist to prevent configuration drift. 5. Add an output validation rule that rejects platform recommendations outside the allowlist. 6. Review all future reference updates for consistency with the mandatory workflow before release.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger guidance allows very broad natural-language requests such as '查热点' or '最近什么火' to activate the skill without strong scoping or exclusion rules. This can cause the agent to invoke the skill for common conversational requests and push it into workflow-driven search behavior when the user's intent is ambiguous, increasing the chance of irrelevant data gathering, misleading output, or bypass of more appropriate skills.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The command examples use ambiguous phrases like '最近有什么热点 / 热搜' and '分析 XX 话题热度 / 爆款' without clear exclusion conditions, so the skill may over-match many ordinary requests that mention popularity or trending topics. In an agent environment, over-broad triggers can hijack routing decisions, causing the model to apply this skill where it does not fit and potentially generate constrained but misleading analyses under the wrong context.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This markdown file presents all instructions and guidance exclusively in Chinese, and it does not indicate that the skill is region-specific or that users may opt into another language. The policy requires flagging language or locale constraints when a specific language is effectively forced without user choice or clear justification.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest says the skill is limited to 公众号、抖音、小红书三平台, but this guide explicitly includes additional platform adaptation sections for B站 and 快手. That creates a semantic mismatch between the declared platform scope and the documented behavior/content shipped with the skill.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The entire skill specification is written as a mandatory Chinese-language workflow and examples, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

### 网络搜索工具不可用

| 情况             | 处理方式                                                                                            |
| ---------------- | --------------------------------------------------------------------------------------------------- |
| 搜索工具返回错误 | 1. 向用户说明当前无法获取实时数据<br>2. 基于已有知识提供一般性分析<br>3. 建议稍后重试或提供具体话题 |
| 搜索结果为空     | 1. 检查关键词是否过于小众<br>2. 尝试使用更通用的搜索词<br>3. 说明该话题暂无爆款数据                 |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The document is entirely written in Chinese and presents its guidance as the sole mode of use, with no indication that users may choose another language or that the restriction is required for a region-specific purpose. This can violate language/locale policy when a skill effectively forces a specific language without user opt-in.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill metadata explicitly limits operation to 公众号、抖音、小红书, but the reference guide instructs generating search combinations for 快手 and B站 as well. This creates a scope-expansion mismatch that can cause the agent to access or reason over unintended platforms, undermining policy boundaries and increasing the chance of unauthorized collection or execution outside the declared capability.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This markdown file contains user-facing instructional content exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the language/locale policy rule, forcing a specific language without user choice can be a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: This markdown file uses Chinese throughout, beginning with the title at L01, and does not indicate that the skill is region-specific or provide any user language/locale option. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a locale-policy issue.

Description-Behavior Mismatch

Low

• Confidence: 93% confidence
• Finding: The manifest explicitly says the skill is limited to 公众号、抖音、小红书三平台, but this standards document also defines viral-content criteria for 快手 and B站. Even though this file is documentation rather than executable code, it broadens the represented operational scope of the skill beyond what the manifest claims.

Static analysis

No suspicious patterns detected.