Security audit

Auto Content Ops

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese content-operations drafting skill that uses web searches for trends and does not install code, persist data, or actually publish content.

Install this if you want a Chinese-language content strategy and short-video copy workflow. Expect it to use web search for trends and competitor research; review sources and final copy yourself before posting, and avoid entering confidential campaign, product, or account details if they should not be used in searches.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger conditions are extremely broad and instruct the system to activate this skill for many ordinary content-related requests, including generic asks like writing copy or asking about trends. This can cause unintended routing, override more appropriate skills, and silently expand the skill’s influence over user interactions beyond what users likely expect.

Vague Triggers

High

Confidence: 96% confidence
Finding: The skill declares that it should activate for a very wide range of common content-creation requests, including generic asks like writing copy, planning short videos, or tracking trends. This can cause frequent unintended invocation, override more appropriate skills, and route normal user requests into an external-search-driven workflow that changes system behavior without clear user consent.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The manifest description and invocation instructions are written to operate in Chinese and target Chinese-language content workflows, but they do not state that this is optional or ask the user for a language preference. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill explicitly directs use of web_search to gather external information and later describes 'automatic publishing,' but it does not require user consent, source verification, or a release confirmation step. This creates risk of privacy leakage, misinformation propagation, or accidental publication of low-quality or non-compliant content based on unverified external data.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The skill metadata and instructions are written to operate in Chinese by default for all matching requests, without checking the user's language preference. This can degrade user control, create misleading or unusable outputs for non-Chinese speakers, and make the skill behave contrary to the surrounding system or user expectations.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: This markdown file contains natural-language instructional content exclusively in Chinese, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without user choice is a locale-policy concern.

Static analysis

No suspicious patterns detected.