GEO内容违禁词检测与智能替换

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:04 AM UTC
• Version: 1.1.0

Overview

This skill mostly does what it claims, but it combines automatic content rewriting, an overbroad hidden word policy, and unsafe paid API-key infrastructure that users should review before installing.

Install only if you want an automated Chinese content-compliance filter and are comfortable with it rewriting text based on a broad, uncategorized blacklist. Avoid paid mode unless the API endpoint is trusted and HTTPS-only; do not pass keys or admin tokens in command lines or URL query strings. Treat the bundled billing worker as review-required infrastructure before deployment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:90

Finding

Mandatory Commercial Message Injected into Agent Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 90-92
Vulnerability Type: Output instruction hijacking
Risk Level: Medium

Vulnerable Code

markdown

**免费模式额外提示**：
如果 `billing.truncated` 为 `true`，在输出末尾附加提示：
> 当前为免费模式，仅检测并替换了前3个违禁词。文章中还有 {hidden_count} 个违禁词未检测。配置 API Key 可启用完整检测。API Key 购买方式：[你的购买渠道]

Technical Analysis

The Skill instructs the agent to append a purchase-channel promotion whenever free-tier results are truncated. This instruction modifies the agent's user-facing output for a commercial purpose unrelated to the core technical result.

Although a neutral notice that results were truncated is functionally relevant, forcing the agent to advertise an unspecified purchasing channel exceeds the minimum behavior needed to perform prohibited-word detection. The placeholder could also be replaced with an unreviewed external destination.

Attack Path

1. A user loads the Skill and submits text containing more than three unique prohibited terms.
2. The detector runs in free mode and sets billing.truncated to true.
3. The Skill instructs the agent to append the prescribed commercial message.
4. The resulting answer contains author-controlled promotional content regardless of whether the user requested purchasing information.

Impact Assessment

This affects the integrity of user-facing responses. It does not grant operating-system privileges, execute code, or expose article contents. Its scope is limited to manipulating the current session's output and potentially directing users to an author-selected purchasing channel.

Remediation

View remediation

Remediation Suggestions

• Remove the mandatory purchase-channel promotion from the Skill instructions.
• Return only a neutral notice explaining that free-tier results were truncated.
• Display purchasing information only after an explicit user request.
• Do not permit unrestricted placeholders to introduce unreviewed URLs or contact channels.
• Keep tier metadata machine-readable so the host application, rather than the Skill, controls any commercial interface.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/billing_worker.js:68

Finding

Administrative Authentication Can Fail Open When ADMIN_TOKEN Is Unconfigured

Content

View full analysis

Vulnerability Details

File Location: scripts/billing_worker.js, lines 68-70 and 127-129
Vulnerability Type: Authentication bypass caused by missing-secret handling
Risk Level: Critical

Vulnerable Code

javascript

if (body.admin_token !== env.ADMIN_TOKEN) {
  return jsonResp({ error: '管理令牌无效' }, 403, corsHeaders);
}

The same check is used by the key-revocation endpoint:

javascript

if (body.admin_token !== env.ADMIN_TOKEN) {
  return jsonResp({ error: '管理令牌无效' }, 403, corsHeaders);
}

await env.KEYS.delete(`key:${body.api_key}`);

Technical Analysis

The authorization check assumes that env.ADMIN_TOKEN always exists. If the deployment omits that environment binding and a request also omits admin_token, both expressions evaluate to undefined. The strict inequality is then false, so the request passes authentication.

This fail-open condition affects /admin/add and /admin/revoke. The /admin/add route can create a new key or increase credits on an existing key, while /admin/revoke can delete a key.

Attack Path

1. The Worker is deployed without configuring ADMIN_TOKEN, whether through operator error or an incomplete deployment.
2. An attacker sends a JSON request to /admin/add without an admin_token property.
3. body.admin_token and env.ADMIN_TOKEN are both undefined.
4. The authorization comparison passes.
5. The attacker creates a new API key or adds credits to a chosen key.
6. Alternatively, the attacker invokes /admin/revoke without a token and deletes a victim's key.

Impact Assessment

An unauthenticated attacker can obtain administrative control over license-key issuance, credit allocation, and key revocation on a misconfigured deployment. This can enable unlimited paid-tier use, billing fraud, denial of service against customers, and corruption of account state. The issue does not directly provide Cloudflare account or operati ...[truncated 17 chars]

Remediation

View remediation

Remediation Suggestions

• Reject every administrative request when env.ADMIN_TOKEN is absent or empty.
• Require a nonempty string credential before performing any comparison.
• Validate required Worker bindings during deployment and fail health checks when they are missing.
• Move authentication to the Authorization: Bearer header.
• Apply constant-time comparison where supported.
• Add rate limiting, audit logging, and alerts for key creation, recharge, and revocation.
• Use separate scoped credentials for read-only and mutating administrative operations.

A fail-closed check should resemble:

javascript

if (
  typeof env.ADMIN_TOKEN !== 'string' ||
  env.ADMIN_TOKEN.length === 0 ||
  typeof body.admin_token !== 'string' ||
  body.admin_token.length === 0 ||
  body.admin_token !== env.ADMIN_TOKEN
) {
  return jsonResp({ error: 'Unauthorized' }, 403, corsHeaders);
}

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/detect_words.py:158

Finding

Paid API Key Can Be Transmitted to an Arbitrary or Plaintext Endpoint

Content

View full analysis

Vulnerability Details

File Location: scripts/detect_words.py, lines 158-173 and 246-254
Vulnerability Type: Unrestricted transmission of a bearer credential
Risk Level: High

Vulnerable Code

python

def verify_api_key(api_key, api_endpoint):
    """Verify API key with the billing service and deduct one credit.

    Returns:
        dict: {"valid": bool, "remaining": int, "message": str}
    """
    try:
        data = json.dumps({"api_key": api_key}).encode('utf-8')
        req = urllib.request.Request(
            f"{api_endpoint.rstrip('/')}/verify",
            data=data,
            headers={'Content-Type': 'application/json'},
            method='POST'
        )

        with urllib.request.urlopen(req, timeout=10) as resp:
            result = json.loads(resp.read().decode('utf-8'))
            return result

The destination is accepted directly from an argument or environment variable:

python

parser.add_argument(
    '--api-key',
    default=os.environ.get('GEO_API_KEY', ''),
    help='API key for paid tier (full detection). env: GEO_API_KEY'
)
parser.add_argument(
    '--api-endpoint',
    default=os.environ.get('GEO_API_ENDPOINT', ''),
    help='Billing API endpoint URL. env: GEO_API_ENDPOINT'
)

Technical Analysis

The script serializes the paid API key into a JSON request and sends it to the configured GEO_API_ENDPOINT. It does not require HTTPS, verify that the hostname belongs to the intended billing service, reject embedded URL credentials, or explicitly prevent redirects to an untrusted destination.

Sending the API key is necessary for the declared paid-tier verification design, but allowing an unrestricted destination exceeds the minimum privilege needed for that functionality. The article text is not included in this network request; the exposed sensitive value is the API key.

Attack Path

1. An attacker controls proces ...[truncated 778 chars]

Remediation

View remediation

Remediation Suggestions

• Require an https URL scheme and reject plaintext HTTP.
• Pin or allowlist the expected billing hostname instead of accepting an arbitrary destination in normal operation.
• Reject URLs containing user-information fields, fragments, or unexpected ports.
• Disable automatic redirects or revalidate the scheme and hostname after every redirect.
• Store the approved endpoint in trusted Skill configuration rather than an untrusted inherited environment variable.
• Use a short-lived challenge token or signed request instead of repeatedly transmitting a reusable bearer credential.
• Clearly disclose that paid-mode verification sends the API key over the network.
• Avoid logging arguments or request bodies containing the API key.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/billing_worker.js:100

Finding

Administrative Token Is Passed in a URL Query Parameter

Content

View full analysis

Vulnerability Details

File Location: scripts/billing_worker.js, lines 100-105
Vulnerability Type: Sensitive credential exposure through URLs
Risk Level: High

Vulnerable Code

javascript

if (path === '/admin/balance' && request.method === 'GET') {
  const adminToken = url.searchParams.get('admin_token');
  const apiKey = url.searchParams.get('api_key');

  if (adminToken !== env.ADMIN_TOKEN) {
    return jsonResp({ error: '管理令牌无效' }, 403, corsHeaders);
  }

The deployment guide explicitly instructs operators to use this pattern:

bash

curl "https://geo-word-checker.<你的子域名>.workers.dev/admin/balance?admin_token=你的ADMIN_TOKEN&api_key=gw-abc123xyz"

Technical Analysis

URL query parameters are commonly recorded by shell history, reverse proxies, CDN request logs, analytics systems, monitoring products, browser history, and copied links. TLS protects the request in transit but does not prevent these endpoint and infrastructure logs from retaining the full URL.

The same administrative token protects privileged mutation endpoints, so disclosure through the balance endpoint can compromise more than read-only balance access.

Attack Path

1. An administrator follows the deployment guide and invokes the balance endpoint with admin_token in the URL.
2. The complete URL is retained in shell history or infrastructure logs.
3. An attacker with access to one of those records extracts the token.
4. The attacker submits authenticated requests to /admin/add or /admin/revoke.
5. The attacker creates, recharges, or revokes license keys.

Impact Assessment

Exposure of the shared administrative token grants control over all operations protected by that token, including key issuance, credit modification, balance access, and revocation. The scope is the entire deployed billing service rather than a single customer key.

Remediation

View remediation

Remediation Suggestions

• Replace the query parameter with an Authorization: Bearer header.
• Change the balance endpoint to reject credentials supplied in URLs.
• Update every example in references/deploy_guide.md.
• Redact authorization headers and API keys from application and infrastructure logs.
• Rotate any administrative token previously used in a query string.
• Use separate, scoped credentials for read-only balance queries and key-management operations.
• Prefer short-lived administrative credentials and enforce rate limiting.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/billing_worker.js:165

Finding

License Keys Are Generated with a Non-Cryptographic Random Number Generator

Content

View full analysis

Vulnerability Details

File Location: scripts/billing_worker.js, lines 165-173
Vulnerability Type: Weak bearer-token generation
Risk Level: Medium

Vulnerable Code

javascript

function generateKey() {
  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
  let key = 'gw-';
  for (let i = 0; i < 24; i++) {
    key += chars[Math.floor(Math.random() * chars.length)];
  }
  return key;
}

Technical Analysis

Math.random() is not specified as a cryptographically secure pseudorandom-number generator and must not be used to create authentication credentials or bearer tokens. The visible key length does not compensate for weaknesses or predictability in the underlying generator.

Exploitability depends on the runtime's generator implementation and the attacker's ability to collect outputs or infer generator state. Nevertheless, security credentials must be generated from a cryptographically secure source.

Attack Path

1. The service generates license keys using Math.random().
2. An attacker obtains one or more generated keys or sufficient information about the runtime's pseudorandom state.
3. Where the runtime implementation permits state inference or practical prediction, the attacker derives candidate future keys.
4. The attacker tests candidate keys against /verify.
5. A correct prediction permits use of another customer's credits.

Impact Assessment

Successful prediction grants access only to the paid-tier privileges and credits associated with the predicted key. It does not grant administrative access or local code execution. Practical risk varies by runtime implementation, but the primitive is unsuitable for credential generation.

Remediation

View remediation

Remediation Suggestions

• Use crypto.getRandomValues() to generate at least 128 bits of entropy.
• Encode random bytes using hexadecimal or base64url without reducing entropy through biased conversion.
• Enforce uniqueness before storing a generated key.
• Store a cryptographic hash of each API key where the application design permits it.
• Support key expiration, rotation, revocation, and per-key rate limiting.
• Avoid exposing complete keys through administrative logs after initial issuance.

Example:

javascript

function generateKey() {
  const bytes = new Uint8Array(24);
  crypto.getRandomValues(bytes);
  const token = Array.from(bytes, b =>
    b.toString(16).padStart(2, '0')
  ).join('');
  return `gw-${token}`;
}

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/billing_worker.js:41

Finding

Non-Atomic Credit Deduction Allows Concurrent Billing Bypass

Content

View full analysis

Vulnerability Details

File Location: scripts/billing_worker.js, lines 41-56
Vulnerability Type: Race condition in credit accounting
Risk Level: High

Vulnerable Code

javascript

const keyData = await env.KEYS.get(`key:${apiKey}`, 'json');

if (!keyData) {
  return jsonResp({ valid: false, message: 'API Key 无效，请检查或购买' }, 403, corsHeaders);
}

if (keyData.credits <= 0) {
  return jsonResp({ valid: false, remaining: 0, message: '额度已用完，请充值' }, 403, corsHeaders);
}

// 扣减 1 次
keyData.credits -= 1;
keyData.total_used = (keyData.total_used || 0) + 1;
keyData.last_used = new Date().toISOString();

await env.KEYS.put(`key:${apiKey}`, JSON.stringify(keyData));

Technical Analysis

Verification and deduction use a read-modify-write sequence over Cloudflare KV without transactional isolation. Multiple concurrent requests can read the same positive balance before any request writes the updated value.

For example, if the balance is one, several requests can all read one, pass the balance check, decrement their local copy to zero, and return successful verification. Their writes can overwrite one another, resulting in several paid operations for a single effective credit deduction.

Cloudflare KV is designed for distributed key-value access rather than strongly consistent transactional counters, so application-level serialization is required.

Attack Path

1. An attacker obtains a valid key with at least one remaining credit.
2. The attacker sends many concurrent POST requests to /verify.
3. Several Worker invocations read the same pre-decrement balance.
4. Each invocation independently passes the positive-balance check.
5. Each request returns valid: true, enabling a paid scan.
6. Concurrent writes overwrite one another, and fewer credits are deducted than successful authorizations issued.

Impact Assessment

A customer or key holder can consume more paid operations t ...[truncated 230 chars]

Remediation

View remediation

Remediation Suggestions

• Move per-key credit state into a Cloudflare Durable Object so requests for the same key are serialized.
• Alternatively, use a datastore that supports atomic conditional updates or transactions.
• Perform the positive-balance check and decrement in one atomic operation.
• Add idempotency keys so retries do not cause ambiguous charging.
• Record immutable transaction entries for reconciliation rather than relying only on a mutable counter.
• Apply per-key and per-client rate limits to reduce race-condition abuse.
• Add concurrency tests that issue parallel verification requests at balances of one and zero.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Harmful Content Injection

Critical

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · assets/prohibited_words.txt (reported line 23)May include surrounding context.

text

ketamine
k粉
mdma
morphine
narcotic
strychnine
tamoxifen
testosterone
阿芙蓉
爱他死
安非他命

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to perform intelligent replacement, but the visible documentation mainly specifies detection plus API-key-based remote validation, with no trustworthy implementation details for the replacement behavior. Undeclared transmission of API keys to a remote endpoint increases the risk of credential exposure and violates the user's expectation of a simple content-analysis skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill claims to perform intelligent replacement, but the visible documentation mainly specifies detection plus API-key-based remote validation, with no trustworthy implementation details for the replacement behavior. Undeclared transmission of API keys to a remote endpoint increases the risk of credential exposure and violates the user's expectation of a simple content-analysis skill.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

| `scripts/billing_worker.js` | Cloudflare Worker 验证服务代码（技能作者部署，用户无需关心） |

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file contains extensive political and ideological filtering unrelated to prohibited advertising language or SEO compliance. Embedding such terms inside a compliance skill enables covert viewpoint censorship and content suppression under the guise of safety tooling, which is especially dangerous because users will trust the skill's stated purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The blacklist includes surveillance, privacy-intrusion, illicit-data-trade, and related terms far outside GEO/SEO compliance. This can cause the skill to flag or rewrite legitimate discussion of privacy abuse, fraud prevention, journalism, or security topics, while masking the true purpose of the filter and undermining user trust.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file implements a standalone license-key billing and credit-debit service, which is materially unrelated to the declared GEO/SEO prohibited-word checking functionality. In a skill package, capability mismatch is dangerous because it introduces hidden operational behavior, expands attack surface, and may enable monetization or access-control logic that users and reviewers did not consent to.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to use environment variables, read and write files, and contact an external endpoint, but it does not declare any explicit tool scope or permissions. This creates a transparency and containment problem: the agent may access sensitive local content or secrets and perform network actions without the user being clearly warned through the manifest.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases and usage scenarios are broad enough to overlap with ordinary writing or editing requests, which increases the chance that the skill activates unexpectedly. In this skill's context, accidental activation is more dangerous because it can lead to automatic file access, file writes, and optional remote API-key validation without a deliberate user request for those actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Adding paid-tier gating and API-key validation through an external HTTP service is not necessary for the core safety function of scanning text for prohibited words. This expands the trust boundary and can expose user credentials or usage metadata to a third-party service unrelated to local text analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill indicates that configured API keys will be validated through an online service, but it does not provide adequate warning about network transmission, privacy implications, or what data may be sent. In a content-checking skill, this hidden network dependency makes the behavior materially more dangerous because users may expect a local-only workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation directs the agent to automatically read user-provided files and later save modified copies, while explicitly saying not to ask the user. Removing confirmation around local file access and writes is risky because it can expose sensitive content and create unintended file-system side effects from an ambiguously phrased request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This plain-text prohibited-words list overwhelmingly hard-codes Chinese-language terms and China-specific lexical variants alongside a smaller set of English terms, indicating a fixed locale-specific moderation policy embedded directly in the skill data. Because the file provides no natural-language indication of user opt-in, locale selection, or documented regional scope, it appears to impose a specific language/locale policy globally rather than conditionally.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The list is not limited to GEO/SEO or ad-law compliance terms; it also blocks political speech, religion, medicine, gambling, weapons, privacy, and many ordinary web/content terms. In a content-checking skill, such an overbroad blacklist can silently censor unrelated user content, cause policy abuse, and create severe false positives that materially alter user output beyond the stated function.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/deploy_guide.md (reported line 75)May include surrounding context.

发放 API Key（用户购买后）

bash

curl -X POST https://geo-word-checker.<你的子域名>.workers.dev/admin/add \
  -H "Content-Type: application/json" \
  -d '{"admin_token":"你的ADMIN_TOKEN","api_key":"gw-abc123xyz","credits":100,"note":"客户A"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guide tells operators to place the ADMIN_TOKEN in a URL query string when querying balance. Secrets in query strings are commonly exposed through shell history, browser/history tooling, reverse proxies, server logs, analytics, and referrer-like handling. Because this token appears to authorize administrative actions for key management, disclosure could let an attacker inspect or potentially manage customer API keys depending on server-side controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs users to supply the API key as a command-line argument. Command-line arguments are often visible via shell history, process listings, job-control tools, CI logs, and support screenshots, which can leak a live paid credential. In this skill's context, leaked keys can be abused to consume credits or impersonate a customer’s usage.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code exposes administrative key-management endpoints for adding, revoking, and inspecting API keys even though the skill is described as a content-compliance checker. Hidden or unjustified admin capabilities are risky because they create privileged control surfaces that can be abused if leaked, misconfigured, or later extended, and they violate least privilege for the advertised skill context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The /admin/balance endpoint accepts the admin token in the URL query string, which can leak through browser history, intermediary logs, analytics systems, reverse proxies, and referrer propagation. Exposing an administrative secret this way can enable unauthorized access to key-management functions if the token is captured.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest states the skill supports '智能替换' and can generate context-preserving replacement suggestions, but this script only loads a word list, finds matches, optionally classifies them, and outputs JSON. There is no replacement logic, suggestion generation, or text modification path anywhere in the implementation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script adds paid-tier billing verification and network behavior that is not disclosed in the skill description for a local prohibited-word checker. Undisclosed outbound connections and credential handling expand the trust boundary and can surprise users who expect fully local processing, increasing privacy and supply-chain risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill reads API credentials from CLI/environment and sends them to an external endpoint unrelated to the core text-scanning purpose. Even though only the API key is transmitted here, this introduces unnecessary secret exposure and dependency on an arbitrary remote service, which is risky in a content-analysis tool expected to run locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

When both --api-key and --api-endpoint are provided, the script sends data to an external service via verify_api_key, which is a network operation tied to user input processing. Although the module docstring mentions the paid tier and API configuration, there is no runtime disclosure, prompt, or explicit warning near execution that a remote service will be contacted as part of processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

L003 的描述和触发方式完全以中文定义，且围绕中文 GEO/SEO 内容合规展开，但没有说明这是仅面向中文内容的地域化技能，也没有提供语言选择或用户 opt-in。按照语言/区域政策，这种默认强制单一语言而无选择可能构成自然语言策略问题。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Line L052 states that pasted text is first written to a temporary file to avoid shell escaping issues. However, the command shown immediately after uses --text "<文章文本>", which contradicts that documented behavior rather than implementing the described temp-file approach.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.