T03 · Remote Payload Retrieval and Execution
Error
- Location
references/updates.md:3- Finding
Unauthenticated Remote Self-Update Chain
- Content
View full analysis
- Remediation
View remediation
Security audit
黑石写作助手·短故事版
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Chinese short-fiction writing skill, but it asks to persistently change the installed skill and MCP tool configuration from server-controlled data.
Review before installing. The local writing guidance is narrowly scoped, but do not approve updates or cloud activation unless you trust blackstone.wansu.tech and are comfortable with it changing this skill or adding MCP tool configuration. Prefer using it offline/local-only if you only need writing help.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T07 · Tool Hijacking and Spoofing
Error
- Location
references/cloud.md:19- Finding
Server-Controlled MCP Configuration Installation
- Content
View full analysis
- Remediation
View remediation
other
Note
- Location
SKILL.md:60- Finding
Automatic External Version Check Discloses Skill Usage Metadata
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The natural-language content is entirely in Chinese and describes the skill/versioning for a writing assistant, which may indicate a language-specific constraint. Because no user choice, opt-in, or justification for the locale is provided in this file, it can be interpreted as forcing a specific language/locale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The display name, short description, and default prompt are all written in Chinese, and the prompt implicitly directs the interaction in that language without offering a language choice. This can violate language/locale policy where skills should not force a specific language unless the constraint is explicit and justified or the user opts in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest's default prompt includes the general phrase '帮我把这个灵感写成一篇完整短故事', which is a common-language request rather than a narrowly scoped invocation pattern. The file does not provide explicit trigger constraints, exclusions, or negative examples to clarify when this skill should activate versus ordinary writing assistance.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains user-facing instructional content entirely in Chinese, and there is no natural-language indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule for language/locale constraints, forcing a specific language without opt-in is a policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file is entirely written as Chinese-only instructional content and provides no opt-in, alternative language option, or statement that the skill is specifically limited to Chinese-language use. Under the policy, forcing a specific language without user choice is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file presents all instructions and examples exclusively in Chinese, which can impose a specific language on users without any stated choice or locale justification. Under the policy, forcing a language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This file’s instructional content is entirely in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill is written as Chinese-only operational guidance and does not indicate that the user may choose another language or locale. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy violation unless the constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown skill file presents all instructions and output requirements exclusively in Chinese, which effectively forces a specific language/locale on users. Under the policy, language constraints should either be user-selectable or clearly justified as region-specific; neither is stated here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file is entirely framed as a Chinese-language instruction set, starting with the title in Chinese, and the prescribed response format throughout assumes Chinese output. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified or optional.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document is wholly written as a Chinese-language interaction guide and repeatedly specifies how the assistant should answer, but it provides no indication that Chinese is optional or limited to a China-specific use case. This can amount to a language/locale policy violation because it implicitly forces one language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file contains user-facing instructional content only in Chinese, and nowhere indicates that the skill is China-specific or that users may choose another language. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructions and content exclusively in Chinese, with no user opt-in, alternative language option, or justification that the skill is region-specific.
- Content