Security audit

内容审核与原创改造

Security checks for vulnerabilities and agentic risk

Overview

The skill mainly provides Chinese content review and rewriting, but it also adds a separate registration flow that creates a persistent install ID and asks the user to send it to the author.

Install only if you are comfortable with a manual author-registration process and a persistent local install ID. Avoid putting sensitive client text, private drafts, personal data, or confidential moderation notes into the learning log or custom lexicon unless you intend that information to be retained locally and reused later.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is content review and rewriting, but the skill also introduces an activation and licensing workflow that generates a unique installation identifier, persists it locally, and instructs the user to contact the author for registration. This mismatch is dangerous because users and platforms may grant trust or permissions appropriate for writing assistance while the skill performs tracking, persistence, and off-platform contact behaviors that were not disclosed in the primary purpose.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes local scripts, reads reference files, and writes activation or learning data, but it does not declare any explicit tool or permission scope. That makes the file and script capabilities non-transparent to the host and user, increasing the chance of unintended local file access or persistence beyond what a content-auditing skill appears to need.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The activation guidance says to use the skill when users ask to '按我的风格写' or '多平台改写', which are broad phrases that can overlap with many ordinary writing or editing requests. The file does not provide narrower trigger constraints or negative examples to distinguish when this skill should activate versus other general writing skills.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation flow requires users to generate an installation code and send it to the author before receiving full functionality, which is unrelated to the stated content-auditing mission. This creates unnecessary data handling and a social-engineering channel, encouraging off-platform contact and establishing an avoidable trust dependency on the author.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill tells users to send a generated installation identifier to the author without a clear privacy notice, retention policy, or explanation of how the identifier may be linked to usage. Even if the identifier is generated locally, the instruction creates unnecessary external disclosure and can normalize sharing installation metadata with a third party.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file explicitly instructs the agent to append 'new experience' after each use and to conduct weekly review, which creates an ongoing retention mechanism for user-session-derived data without any limits, minimization rules, or privacy notice. In the context of a content-review skill, those 'experiences' can easily include user prompts, sensitive text, moderation outcomes, or proprietary writing samples, making silent persistence and reuse a real privacy and data-governance risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file content is entirely in Chinese and provides no indication that language choice is configurable or based on user preference. Under the policy, hard-coding a specific language without opt-in can be a locale/language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The title and instructions are entirely in Chinese, and L03 states that any rewrite must be checked against this table, implying a mandatory language/style regime. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file contains prescriptive natural-language guidance exclusively in Chinese, which can amount to a forced language constraint if used as a skill reference without offering alternatives. The policy allows language constraints only when the skill offers user choice or clearly documents a justified locale limitation, neither of which appears here.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script implements a licensing/registration gate that is unrelated to the declared skill purpose of content auditing and rewriting. While not overtly malicious, this adds unnecessary control-flow and user obligations outside the advertised functionality, creating supply-chain trust and privacy concerns because users must contact the author to unlock full use.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The code creates a persistent per-installation identifier under the user's home directory even though device-specific tracking is not necessary for the skill's stated content-processing purpose. Persistent identifiers can enable user tracking, correlation across interactions, and coercive licensing workflows, especially when combined with instructions to share the identifier with the author.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script description, CLI messages, and generated report text are all fixed in Chinese, which imposes a specific language/locale on users. There is no opt-in, language selection mechanism, or documented justification that this is a region-specific tool.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script implements persistent 'learning' by appending user-supplied notes to a local log, which exceeds a one-shot auditing tool and creates undeclared state across runs. This is dangerous because user content may be retained without clear consent and can accumulate sensitive material unrelated to the skill’s core scanning function.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: User-provided notes are written to a persistent local file without meaningful disclosure in normal execution flow, creating an undeclared data retention channel. In a content-audit context, notes may contain article text, client information, or moderation rationale, so silent storage increases privacy and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script appends user-provided notes to a learning log without an upfront warning about local retention, which is a privacy and transparency failure. Users may reasonably expect transient processing for an audit tool, not durable storage of freeform text that could contain sensitive business or personal information.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script loads and mutates a persistent personal risk lexicon, allowing behavior to drift over time beyond the manifest’s stated auditing and rewriting scope. This is risky because user-provided entries can silently influence future analyses, reducing predictability and potentially causing overblocking, biased output, or abuse of future scans.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script can persistently alter future audit behavior by saving user-supplied risk words into local memory, creating hidden state that survives across sessions. This is dangerous because a malformed or abusive entry can poison subsequent audits and there is no integrity control, review step, or consent workflow around that persistence.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script stores user-supplied risk entries in a persistent personal lexicon without clearly warning users that their input will be retained and reused in future runs. This creates a transparency issue and can surprise users with stateful behavior in what appears to be a simple local analysis script.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The entire skill specification is written as a Chinese-only workflow and trigger model, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest positions this skill as a specialist for content review and rewriting tasks. The instruction to invoke python pi-jev/scripts/pi_jev.py "任务" adds a separate decision-layer/router capability that is not necessary to perform the described auditing and rewriting functions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 73% confidence
Finding: The natural-language instructions and headings are presented only in Chinese, which can impose a language constraint on users or operators without documenting a choice or opt-in. The file does not state that the skill is intentionally Chinese-only or region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file presents all instructions in Chinese and does not indicate that the skill is intended only for Chinese-speaking users or provide any language/locale opt-in. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The docstring says the identifier is 'not uploaded, not sent out', but the runtime instructions tell the user to send the number to the author for registration. This contradiction undermines informed consent and may mislead users about data handling, which is especially risky in a third-party skill where trust boundaries are already weak.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.