T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:33- Finding
Platform-adapted content is published without explicit final approval
- Content
View full analysis
- Remediation
View remediation
Security audit
Multi-Post
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real multi-platform posting helper, but it needs Review because it can publish modified content and upload media through your logged-in accounts without a clear final approval step.
Review this skill carefully before installing. It should be treated as able to post publicly from any supported account already logged in to the user's browser. A safer version would require a dry run by default, show exact drafts and media for each platform, name the active account and destination, require explicit confirmation before every publish or clearly scoped batch publish, and ask separately before using any external image host.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Warning
- Location
references/platform-rules.md:45- Finding
User-provided images may be uploaded to an unspecified third-party hosting service
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill performs live posting through logged-in browser sessions but does not prominently warn the user that it will take external actions on their behalf. This creates a high risk of unintended account activity, reputational harm, and irreversible publication, especially because the workflow supports sequential posting to many platforms in one command.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest uses very broad trigger phrases such as '发帖', 'publish everywhere', and 'post to all platforms', which can match ordinary conversation and invoke a skill that performs real external actions. In this skill's context, accidental activation is especially dangerous because it can drive a logged-in browser session to publish content across multiple platforms without a sufficiently narrow confirmation boundary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This workflow automates publishing through browser sessions tied to the user's logged-in accounts, but it does not require an explicit warning or confirmation that content will be posted publicly on real third-party platforms. In this skill context, that omission is meaningfully dangerous because the entire purpose is cross-platform broadcasting, so accidental or misunderstood execution can cause immediate reputational, privacy, or compliance harm at scale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The adaptation guidance for Twitter/X explicitly says 'English version,' which forces a language choice in natural-language instructions. This is a locale/language policy issue because the file does not present English as optional or user-selected, nor does it justify the restriction as platform-required.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The LinkedIn adaptation rule states 'English,' which imposes a specific language in the skill's natural-language instructions. Because the file does not offer a language choice or explain why English is necessary, this conflicts with the language/locale policy criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
The skill prominently specifies Chinese trigger phrases and presents the title in Chinese, but does not state whether users may interact in other languages or choose a locale. This can be read as a language preference baked into the skill without explicit user opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The checklist instructs the agent to capture screenshots, extract post URLs, and log status metadata after publication, but it does not tell users that these artifacts may retain sensitive publication details and account-linked activity records. In a multi-platform posting skill, retaining this metadata increases privacy exposure and can create an unnecessary audit trail of the user's social activity.
- Content
Static analysis
No suspicious patterns detected.