Security audit

zeelin-writing

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real Chinese self-media writing workflow, but it over-automates local reading and publishing steps and stores API keys persistently in ways users should review.

Review this skill before installing if you only want general writing help. Use it only for the intended Chinese self-media workflow, avoid the bundled brand persona unless you want that voice and call to action, and do not let it publish or use platform credentials without a separate confirmation. If you run setup, prefer manually managed restricted API keys and avoid storing secrets in shell startup files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: references/用户人设.md:1
Finding: Bundled brand directives can introduce undisclosed promotional content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/初始化.sh:94
Finding: API keys are collected visibly and persisted in plaintext
Content: View full analysis
> "$HOME/.zshrc" echo -e "${GREEN}✅ 已添加到 ~/.zshrc${NC}" echo " 请运行: source ~/.zshrc" elif [ -f "$HOME/.bashrc" ]; then echo "export GOOGLE_API_KEY=\"$API_KEY\"" >> "$HOME/.bashrc" echo -e "${GREEN}✅ 已添加到 ~/.bashrc${NC}" echo " 请运行: source ~/.bashrc" fi export GOOGLE_API_KEY="$API_KEY" fi fi fi ``` The Skill also directs the agent to create a plaintext credential file: ```env GOOGLE_API_KEY=用户提供的key WECHAT_APP_ID=用户提供的appid WECHAT_APP_SECRET=用户提供的secret ``` ### Technical Analysis The initialization script uses ordinary `read` rather than silent input, so the API key is displayed while the user types it. It then appends the secret directly to either `.zshrc` or `.bashrc`, creating long-lived plaintext credential persistence in a widely sourced shell configuration file. The documented alternative stores Google and WeChat credentials in `.wechat/.env`, but neither the instructions nor the script enforce restrictive permissions such as mode `0600`. Shell profiles and environment files may be included in backups, copied during troubleshooting, read by other same-user processes, or acci ...[truncated 1530 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/markdown-to-html.ts:132
Finding: Markdown conversion automatically installs mutable npm dependencies
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/markdown-to-html.ts:143
Finding: Untrusted Markdown is converted to HTML without sanitization
Content: View full analysis
tags, all CSS must be in style="") const inlinedHtml = juice(fullHtml); ``` The resulting document is subsequently written without a sanitization step: ```ts await writeFile(outputPath, inlinedHtml, 'utf-8'); ``` ### Technical Analysis The converter passes Markdown content through `marked`, wraps the resulting HTML, processes it with `juice`, and writes it to a local HTML file. There is no HTML sanitizer or strict element-and-attribute allowlist between parsing and output. If input Markdown is supplied by an untrusted source, raw HTML or dangerous attributes may survive conversion. Examples include event-handler attributes, active embedded elements, and dangerous URL schemes. When a user opens the generated file in a browser or another permissive HTML previewer, active content can execute in that viewing context. The exact behavior depends on the versions and configuration of `marked`, `juice`, and the viewer. The audit confirms the absence of an explicit sanitization boundary; it does not establish that every possible payload is preserved by every dependency version or target platform. ### Attack Path 1. An attacker supplies or influences a Markdown article. 2. The article contains active HTML, an event handler, an embedded remote resource, ...[truncated 933 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (32)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a broad end-to-end writing and publishing assistant, but this code chunk only handles one narrow formatting step: converting markdown into WeChat-compatible HTML and producing a manifest of local images. That is at best a small subcomponent of the declared workflow ('HTML排版'), not the overall behavior described. Additionally, the code includes an undeclared operational capability by invoking npm install automatically through execSync, which is not mentioned in the description. Therefore, the description does not accurately represent what this supplied code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 该代码块的行为非常单一：根据用户提供的标题创建一个本地 Markdown 文件，并把标准输入内容写入文件。它不生成文章、不修改文章、不审校、不降重、不搜索知识、不讨论选题，也不与微信公众号、小红书或任何外部平台交互。虽然“归档”在描述中被提到，脚本也仅在输出提示中建议用户未来手动移动文件，但并未真正执行归档。整体上，声明描述的是完整创作与发布工作流，而实际代码只是一个本地保存文章的辅助脚本，属于主要功能和能力范围的明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 代码的实际功能仅是本地文件系统上的项目结构初始化：校验项目名称、创建目录、复制或生成 brief 模板、生成项目说明文件，并提示下一步操作。虽然生成的模板和说明文件中提到了写作流程节点（如选题讨论、审校、配图、发布），但这些只是静态文本/目录结构，并不执行对应能力。与声明中强调的“完整10步创作流程”“自动生成封面图”“发布到公众号草稿箱”“小红书一键自动发布”等核心能力相比，代码的主目的明显不同且能力严重不足，因此属于显著描述与行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 代码片段并未实现或直接执行声明中的核心写作能力，如需求分析、知识搜索、选题讨论、文章创作、三遍审校、降AI味、HTML排版、公众号/小红书发布等。其实际主要用途是安装/初始化辅助：检查依赖、建目录、配置环境变量、测试脚本可运行性，并展示使用说明。虽然这些行为可能是该写作系统的配套支持脚本，但就该代码片段本身而言，主功能与声明的“写作助手”明显不一致。此外，代码包含对用户 shell 配置文件的写入这一敏感环境配置行为，声明中也未体现。因此应判定为描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises very broad trigger phrases such as generic writing and editing requests, making accidental activation likely. In skill-based agents, overbroad activation can cause unintended file operations, data access, web fetches, or publishing workflows to run in contexts where the user did not intend to invoke this skill.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The skill instructs the agent to collect and write API credentials into a local .env under the skill directory, creating a credential-handling pathway inside routine workflow automation. In an agent context, embedding secret collection and storage into the skill increases the chance of accidental exposure, insecure file permissions, reuse by unrelated tasks, or leakage through later tool access.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

确定 SKILL_DIR：

bash
SKILL_DIR=$([ -f "$HOME/.agents/skills/zeelin-writing/.wechat/.env" ] && echo "$HOME/.agents/skills/zeelin-writing" || echo "$HOME/.claude/skills/zeelin-writing")

创建目录（如不存在）：

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger table includes ambiguous conditions that overlap with common everyday requests, so the skill may activate in unrelated conversations. Because this skill also instructs reading local files and carrying out multi-step automation, unintended invocation increases the chance of unnecessary data access or external actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The workflow explicitly mandates automatic execution from Step 2 through Step 10 without pauses or confirmation, even though later steps include file saving, external searches, and publishing-related actions. Removing confirmation checkpoints for side-effecting operations materially increases the risk of unintended disclosure, destructive edits, or unauthorized external posting.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · scripts/初始化.sh (reported line 111)May include surrounding context.
sh
API_KEY: " API_KEY if [ -n "$API_KEY" ]; then # 添加到 ~/.zshrc 或 ~/.bashrc if [ -f "$HOME/.zshrc" ]; then echo "export GOOGLE_API_KEY=\"$API_KEY\"" >> "$HOME/.zshrc" echo -e "${GREEN}✅ 已添加到 ~/.zshrc${NC}" echo " 请运行: source ~/.zshrc" elif [ -f "$HOME/.bashrc" ]; then echo "export GOOGLE_API_KEY=\"$API_KEY\"" >> "$HOME/.bashrc" echo -e "${GREEN}✅ 已添加到 ~/.bashrc${NC}" echo " 请运行: source ~/.bashrc" fi export GOOGLE_API_KEY="$API_KEY" fi fi fi echo "" # 步骤 4：运行测试 echo "🧪 步骤 4/5: 运行测试" echo "--------------------------------------" # 测试脚本语法 echo "检查脚本语法..." if bash -n scripts/保存文章.sh && bash -n scripts/创建项目结构.sh && bash -n scripts/生成封面图-批量.sh; then echo -e "${GREEN}✅ Shell 脚本语�

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description promises automatic publication to the WeChat draft box, which is an external side effect, but it does not foreground a clear confirmation or warning boundary. Users may believe they are only requesting writing help while the skill's documented behavior extends to pushing content outward.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill is described as a self-media writing assistant, but SKILL.md explicitly tells the agent to prefer running a local shell script (scripts/创建项目结构.sh) to initialize project structure. Spawning shell commands is not an obvious requirement of writing/editing assistance and introduces a broader execution capability than the writing-focused purpose suggests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire template is written only in Chinese and provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file is entirely written in Chinese and includes prescriptive writing guidance such as using specific phrasing conventions (for example, using “我们” instead of “我”). Under the stated policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation, and this file does not offer any language choice or justification for restricting output to Chinese.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generated HTML always sets <html lang="zh-CN">, which imposes a specific language/locale regardless of the input document or user preference. This is a natural-language locale policy issue because the file does not offer opt-in, configuration, or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: If imports fail, the script automatically runs npm install via execSync, causing network-based dependency resolution and execution of package installation lifecycle scripts. In a content-processing skill that may run in automation, this creates a meaningful supply-chain and arbitrary code execution risk if the registry, dependency tree, or local project state is compromised.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script is presented as routine initialization, but part of that setup includes persisting a user-supplied API credential into the user's shell profile. That behavior is security-sensitive and easy for users to overlook during setup, making the script more dangerous than a normal dependency/bootstrap helper.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script's comments, prompts, status messages, and quick-start guidance are entirely in Chinese, which imposes a specific language on users. There is no opt-in, alternative locale, or documented reason that this script must be Chinese-only, so it may violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/初始化.sh (reported line 83)May include surrounding context.
sh
if [ -d "$dir" ]; then echo -e "${YELLOW}⚠️ $dir 已存在${NC}" else mkdir -p "$dir" echo -e "${GREEN}✅ 创建 $dir${NC}" fi done

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/初始化.sh (reported line 83)May include surrounding context.
sh
if [ -d "$dir" ]; then echo -e "${YELLOW}⚠️ $dir 已存在${NC}" else mkdir -p "$dir" echo -e "${GREEN}✅ 创建 $dir${NC}" fi done

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script prompts for a user API key and then appends it in plaintext to ~/.zshrc or ~/.bashrc, creating persistent storage of a secret in a broadly reused shell profile. This increases exposure risk through accidental disclosure, shell-history/profile syncing, over-broad inheritance by future shells, and leakage to unrelated tooling that reads environment variables.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 64% confidence
Finding: While web search is declared as part of the workflow, the document specifically instructs the agent to invoke curl https://r.jina.ai/{URL} to fetch arbitrary webpages through a third-party relay. This is a more powerful command-line/network capability than a typical writing helper needs to expose in its instructions, especially when framed as direct shell usage rather than a bounded search tool.
Content: No source excerpt is available for this finding.