Security audit

aigc-web-push

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its publishing purpose, but it needs review because it can push content through a remote API and includes weakly guarded draft deletion and in-place file rewriting behavior.

Install only if you are comfortable giving this skill authority to send unpublished content and account identifiers to the configured remote API. Keep config.json out of version control, verify apiBase and target account before pushing, review output before publication, and do not use cleanupDrafts unless you intentionally want to clear drafts.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill’s documented purpose is content generation and publishing, but it additionally exposes a destructive draft-cleanup capability. Hidden or weakly-scoped deletion features increase the chance an agent or user invokes data-destroying actions without clear consent, especially because the same configuration and API endpoint are reused for push operations.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Providing a bulk draft-deletion function is not proportionate to a skill marketed for content creation and push delivery. This capability can be abused to remove unpublished content from a connected WeChat account, causing integrity and availability loss for the user’s editorial workflow.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The script treats HTTP 408/504 or any response body containing timeout-like text as a successful push, even though it does not verify whether the remote service actually completed the task. This can mislead operators and automation into assuming delivery succeeded, causing silent message loss, duplicate retries later, or inconsistent publication state.

Vague Triggers

High

Confidence: 97% confidence
Finding: The frontmatter sets `alwaysApply: true`, which causes the skill to activate on essentially all matching interactions instead of only when the user explicitly requests humanization. That broad scope can make the agent silently rewrite content, override user intent, or interfere with other tasks, increasing the chance of unsafe or unauthorized transformations.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The file mode explicitly instructs the agent to rewrite the target file in place and leave only the final rewritten text, without any requirement for confirmation, preview, backup, or change summary in the file itself. In an agent environment with file access, this can destroy user-authored content, remove non-prose material if the boundaries are misapplied, and cause irreversible or hard-to-audit modifications.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill instructs the agent/user to store sensitive configuration material, including a skillKey and account selection data, into a local config.json without any explicit warning about secrecy, access control, or safe handling. This increases the risk of credential leakage through workspace exposure, version control commits, or other skills/tools reading the file.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The script sends article content, openId, skillKey, and optionally appId and image URLs to a remote API, but it provides no explicit runtime warning or confirmation that this content is being disclosed to an external service. In this skill context, remote transmission is expected, but the lack of clear disclosure can still lead to accidental leakage of unpublished or sensitive content by users who assume processing is local.

Ssd 2

Medium

Confidence: 97% confidence
Finding: This skill is explicitly designed to 'remove AI-generated traces' and make text sound more human, which can be used to conceal AI authorship and evade downstream AI-origin or policy screening based on linguistic cues. The extensive instructions for disguising common AI markers increase misuse potential because the skill operationalizes concealment rather than ordinary editing, even though it does not directly enable system compromise or code execution.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: push.js:34