Security audit

Editorial Review

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese editorial review skill, with the main caveat that it applies mainland China publication and compliance norms by default.

Install this if you want Chinese editorial review, especially for mainland-China or zh-CN publication workflows. Before using it on Taiwan, Hong Kong, Macau, or non-PRC audiences, state the target region and review political or legal suggestions yourself. Treat fact-checking and compliance output as advisory, and only allow file writes or web checks for documents and claims you are comfortable sharing with the agent environment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The activation description is extremely broad and includes vague cues like 'look this over' or any Chinese text needing review, which can cause the skill to trigger on ordinary writing requests that were not asking for compliance or political screening. In context, that is more dangerous because this skill performs normative filtering for political sensitivity and advertising-law compliance, so accidental invocation can steer benign user tasks into censorship-oriented or region-specific review flows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file mandates a single state-aligned political framing for disputed territorial, historical, and governance topics without any user-choice, locale gating, or neutrality safeguards. In an editorial-review skill, this can cause the agent to systematically rewrite or suppress lawful user content according to a specific political ideology, creating censorship, misrepresentation, and compliance risk across jurisdictions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The changelog describes the skill as enforcing Chinese typography, grammar, political/territorial compliance, and Chinese advertising-law checks. In this file, those locale-specific constraints are presented as built-in behavior without any indication that users can opt into Chinese-only review or that the skill is explicitly limited to a Chinese-language/regional use case.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The 'When to Activate' section repeats ambiguous triggers such as 'check this', 'review', and 'look it over' without requiring publication, editorial, or compliance context. That broad matching increases the chance of unintentional skill takeover, causing the model to apply heavyweight review rules and restrictive policy assumptions where the user may have wanted a simple answer or light feedback.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This section operationalizes political and territorial compliance rules in a mandatory review pipeline, including directives to rewrite Taiwan/Hong Kong/Tibet/Xinjiang references into state-approved framing. Because the skill is for broad editorial use and can be triggered too easily, these instructions can systematically coerce outputs toward censorship or compelled political normalization even when the user only asked for ordinary proofreading.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: L278 states 'This skill does NOT rewrite content,' which sets a clear intent boundary. But L227-L228 and L248 explicitly direct the skill to provide a 'Clean Version' or 'corrected version' when requested, which is a substantive rewrite of the user's text and contradicts that caveat.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill defaults to mainland simplified Chinese and notes that Taiwan/Hong Kong contexts may need adjustment, but it does not require the user's locale or consent before applying that standard. In this skill's context, that is risky because regional language and political norms are especially sensitive; applying the wrong default can distort user intent, introduce unwanted political framing, or produce inappropriate edits.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The table of contents and later sections frame the methodology around Chinese-specific verification sources and Chinese-language examples, which can amount to a locale-specific constraint in natural-language guidance. Because the document does not explicitly state that this reference is only for Chinese-content workflows or offer an alternative locale choice, it may violate the policy against forcing a specific language/locale without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest declares a fixed language setting of "zh-CN", which can be interpreted as requiring a specific language/locale for the skill. Under the policy, locale constraints should either offer user choice or be clearly documented and justified as region-specific; this manifest does not provide that context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This file anchors itself to PRC law and presents its operative examples and prohibited terms solely in Chinese, with no opt-in or indication that the skill is intentionally region-specific for a user-selected locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The text frames the guidance as detailed rules for Chinese character accuracy and punctuation, and later anchors it to GB/T standards without indicating that this applies only when writing in Chinese or when the user wants Chinese-localized output. Because the file is markdown, natural-language policy issues apply, and this wording can be read as forcing a locale-specific convention without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.