Writing Expert Team

• Outcome: Pass
• Latest audit: Jul 21, 2026 · 2:38 AM UTC
• Version: 1.0.0

Overview

This is a disclosed writing workflow skill with optional local file outputs and WeChat draft publishing, with no evidence of hidden or destructive behavior.

Install only if you want an end-to-end writing pipeline that may create local draft/state files and, when explicitly configured, interact with WeChat publishing tools. Keep API credentials in the publishing tool's config, review generated content before preview or draft push, and run the redline checker with --fix only on files you intend to modify.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill advertises file-reading and file-writing behavior through the referenced redline checker, but no explicit permissions are declared. That creates a transparency and authorization gap: a caller may invoke a writing workflow without realizing the skill can scan local .md/.txt files and potentially modify them in place. In a content-production context this is not inherently malicious, but undeclared write capability can still lead to unintended data modification or over-broad file access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The declared purpose frames the skill as a writing pipeline, but the resource list reveals a command-line tool that scans local files and can automatically rewrite them. This mismatch is dangerous because users and orchestration systems may grant trust based on a benign writing description while the skill performs broader filesystem actions, increasing the chance of silent content alteration or misuse on unintended directories.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The workflow explicitly includes a downstream capability to invoke local WeChat formatting/publishing tools and push drafts via a configured API. That crosses from content generation into external side-effecting actions, which is materially riskier because a writing skill could cause unintended publication, data leakage into third-party systems, or misuse of local tooling if activation/consent boundaries are weak.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill extends from drafting into publication preparation, preview-link generation, artifact creation, and persistent state/file writes. That broadens its authority from content generation to external side effects, increasing the chance of unintended data disclosure, unauthorized publication actions, or persistence of sensitive drafts and metadata beyond what a writing skill minimally needs.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documented draft-box publishing flow introduces credentialed integration with a third-party platform using AppID/AppSecret and token-based API calls. Even though marked optional, embedding this capability in the skill increases the risk of secret misuse, accidental publication, and expansion from advisory behavior into authenticated external actions that are not strictly necessary for writing assistance.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The document specifies persisting pipeline state, including session IDs, timestamps, step history, and document identifiers, to pipeline-state.yaml without any user disclosure, retention policy, or minimization guidance. Even if the data seems operational, silent persistence can expose activity metadata, create privacy surprises, and leave sensitive writing context on disk longer than users expect.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill describes using local tools and a configured API to generate previews and push drafts to a public WeChat account, but it does not clearly warn about privacy, account-scope, or system-impact consequences. Users may not realize that drafts or article content could leave the local environment, be stored by external services, or appear in an account workspace, making accidental disclosure or unintended publication more likely.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.