chinese-content-adapter

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:52 AM UTC
• Version: 1.0.0

Overview

This is a local Chinese-platform content adapter with no hidden access or persistence; the main caution is unsafe WeChat HTML output for untrusted content.

Use this only for Chinese-platform content workflows. Review generated WeChat HTML before pasting it into a source-mode editor, and do not process untrusted third-party Markdown or HTML unless it is sanitized first. Prefer a pinned installer version when available.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wechat_formatter.py:76
• Finding: Unescaped HTML and Unsafe URL Scheme Injection in WeChat Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/wechat_formatter.py`, lines 76-102 **Vulnerability Type**: HTML injection and unsafe link generation **Risk Level**: Medium ### Vulnerable Code ```python for line in lines: line = line.strip() if not line: continue if line.startswith("# "): html_parts.append(self.HEADER_STYLE.format(text=line[2:])) elif line.startswith("## "): html_parts.append(f'<section style="margin: 24px 0 16px; font-size: 18px; font-weight: bold; color: #333;">{line[3:]}</section>') elif line.startswith("### "): html_parts.append(f'<section style="margin: 20px 0 12px; font-size: 16px; font-weight: bold; color: #555; padding-left: 12px; border-left: 3px solid #667eea;">{line[4:]}</section>') elif line.startswith("> "): html_parts.append(self.QUOTE_STYLE.format(text=line[2:])) elif line.startswith("- ") or line.startswith("* "): html_parts.append(f'<section style="margin: 8px 0 8px 20px;">🔹 {line[2:]}</section>') elif re.match(r"^\d+\.\s", line): html_parts.append(f'<section style="margin: 8px 0 8px 20px;">📌 {re.sub(r"^\d+\.\s", "", line)}</section>') else: text = self._inline_format(line) if text.strip(): html_parts.append(self.PARAGRAPH_STYLE.format(text=text)) html_body = "\n".join(html_parts) return f""" <section style="font-family: -apple-system, BlinkMacSystemFont, 'PingFang SC', 'Microsoft YaHei', sans-serif;"> {html_body} {self.FOOTER} </section> """.strip() ``` The link conversion performed by `_inline_format` also inserts an unvalidated destination into an HTML attribute: ```python text = re.sub(r"\[(.*?)\]\((.*?)\)", r'<a href="\2" style="color: #667eea;">\1</a>', text) return text ``` ### Technical Analysis The formatter directly interpolates user-controlled article content into HTML elements without first applying HTML escaping. This affects headings, quotations, list items ...[truncated 2257 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Escape every user-controlled text fragment with `html.escape(value, quote=True)` before inserting it into HTML. 2. Parse Markdown using a maintained library configured to disable raw HTML rather than implementing Markdown conversion through regular expressions. 3. Validate link destinations with `urllib.parse.urlsplit()` and allow only explicitly approved schemes, such as `https` and optionally `http`. 4. Reject dangerous or ambiguous schemes, including `javascript:`, `data:`, `vbscript:`, and scheme-relative URLs unless specifically required. 5. Construct anchor elements through a safe HTML builder, or escape both link labels and attribute values before interpolation. 6. Sanitize the completed output with a strict allowlist that permits only required elements and attributes. Remove event handlers, scripts, embedded objects, forms, and unsafe CSS or URL values. 7. Add security tests covering raw tags, quoted attribute breakouts, mixed-case and whitespace-obfuscated URL schemes, encoded payloads, malformed Markdown links, and nested formatting. 8. Treat downstream platform sanitization as defense in depth rather than the primary security control. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The title and overview state that the skill is specifically for Chinese creators and Chinese-platform adaptation, but the file does not explicitly present this as an opt-in language/locale choice or justify it as a region-specific tool. Under the stated policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence
• Finding: The install command uses `npx clawhub@latest`, which pulls the most recent package version at execution time rather than a reviewed, fixed version. This creates a supply-chain risk: a compromised or breaking upstream release could be fetched and executed by users without warning.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger examples are broad natural-language requests such as adapting or optimizing an article, without clear invocation boundaries or namespacing. In agent environments, this can cause the skill to activate during ordinary editing tasks unexpectedly, leading to unintended data handling or behavior.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The module docstring describes the skill entirely as a Chinese social-media content adapter for Chinese platforms, which signals a fixed language/locale context. Under the policy, locale constraints should either offer user opt-in or be clearly justified as region-specific; this file does not provide either.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The module title and description are entirely in Chinese and present the skill as serving users in that language without offering any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The Xiaohongshu guidance uses prescriptive language such as '标题必须有 emoji！' and other platform-specific conventions, but the file does not clearly state that the skill is limited to Chinese platforms or users who opted into that locale context. This creates a locale-specific policy issue because the guidance is presented as mandatory behavior without an explicit scope or user choice.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s docstrings and behavior define the skill strictly as a Chinese Xiaohongshu-style converter, and generated strings such as titles, tags, and body text are hardcoded in Chinese. This imposes a specific language/locale on all users without offering a language choice or documenting an opt-in, which matches the language-policy violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This formatter forces the output platform label to Chinese ("知乎") and, elsewhere in the file, rewrites titles and content into Chinese-language Zhihu style. Because the file provides no opt-in or alternative language/locale behavior, it violates the policy against forcing a specific language without user choice.

Intent-Code Divergence

Low

• Confidence: 89% confidence
• Finding: The docstring presents the skill as a narrow formatter for Juejin content. In practice, the code not only formats title/content but also evaluates 'technical depth', detects code presence, extracts tags, and generates traffic/engagement suggestions, which goes beyond pure formatting even though it still avoids API use.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The module docstring and user-facing strings indicate the skill is designed to operate in Chinese only, and there is no visible mechanism for user opt-in or language selection. This can violate a language/locale policy when a skill forces a specific language by default.

Intent-Code Divergence

Low

• Confidence: 76% confidence
• Finding: The top-level docstring says the skill automatically adapts content for multiple Chinese social media platforms, including 公众号, which can imply end-to-end platform adaptation. In code, the skill only performs local formatting/conversion via formatter classes and returns a dictionary of results; it does not actually integrate with or adapt against remote platform interfaces.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The module description explicitly targets '微信公众号' and is written entirely in Chinese, and the returned metadata also fixes the platform to '微信公众号'. Under the policy rule, forcing a specific language/locale without user opt-in can be a natural-language policy concern when no alternative or choice is documented.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The docstring at L046 describes only HTML formatting, which suggests a narrow transformation role. However, the method also calls `extract_summary` and `cover_suggestions` and returns those additional outputs, so the inline documentation understates and conflicts with the method's actual behavior.

Static analysis

No suspicious patterns detected.