Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 核查原创：`node scripts/check-original.js`
Security audit
视频号自动发布 (channels-video-publish)
Security checks for vulnerabilities and agentic risk
Overview
This skill is purpose-built for Weixin Channels publishing, but it needs review because it can post from a logged-in account through an unsandboxed Chrome debugging session without a mandatory final confirmation gate.
Install only if you intentionally want an agent to control a separate logged-in Chrome profile for Weixin Channels. Keep the automation profile separate from your normal browser, use --dry-run first, require a human confirmation before any run without --dry-run, and close the remote-debugging browser when finished.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 核查原创：`node scripts/check-original.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 核查原创：`node scripts/check-original.js`
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill drives a logged-in Chrome instance via CDP and explicitly depends on networked browser debugging, but it declares no tool scope or permission boundaries. That means an agent could invoke browser/network-capable behavior without an explicit allowlist, increasing the chance of unintended access to authenticated sessions, remote endpoints, or broader automation than the user expects.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrases are broad and action-oriented, covering multiple similar user utterances without strong exclusion conditions or confirmation gates. In this context, the skill can publish or schedule content to a real social-media account, so ambiguous activation raises the risk of accidental invocation and unintended posting from an authenticated session.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Chrome 是按请求的 Host 头生成
webSocketDebuggerUrl的。 发Host: 127.0.0.1会拿到ws://127.0.0.1/devtools/...（没有端口）→ ws 去连 80 →ECONNREFUSED。 curl 能连上是因为它发的是Host: 127.0.0.1:9222。js http.get({ host: '127.0.0.1', port: 9222, path, headers: { Host: '127.0.0.1:9222' } })
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents a workflow where older content may need to be deleted and reposted, and notes that deleting loses existing play/like data irreversibly. Although it says explicit user confirmation is required, the file overall lacks a broader user-facing warning section highlighting that the skill may perform destructive content-management actions affecting published data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file's usage instructions, comments, and runtime messages are written entirely in Chinese, and the automation logic also depends on matching Chinese UI text such as button labels and dialog content. This imposes a specific language/locale requirement without user opt-in or documented justification, which fits the language/locale policy violation category.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This file contains its primary instructions, warnings, and output text in Chinese, including the header comment and console messages. Because the skill does not offer a user language/locale choice or explain that it is intentionally limited to a Chinese-only regional audience, it violates the language/locale policy criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This JSON file contains user-facing title, description, and album fields written in Chinese with no indication that language choice is optional or region-specific. Because SQP-3 applies to all file types, fixed locale content can be a natural-language policy concern when it does not document user opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.