Security audit

ym-content-topic-planner

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only content planning skill with no code execution, network access, credential handling, persistence, or hidden behavior.

Installers should expect this skill to respond mainly in Chinese and to activate for some broad content-planning phrases. It does not appear to run code, access private files, use credentials, contact the network, or persist data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The description says the skill should be used when a user says phrases like “下一步发什么” and “发什么内容,” which are broad, conversational requests that could match many unrelated content-help situations. The file does not provide exclusion conditions or negative examples to clarify when these phrases should not invoke this skill.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger list contains broad phrases such as '发什么内容' and 'content calendar' that could overlap with ordinary conversation and cause the wrong skill to activate. In a multi-skill agent, overly generic triggers can lead to prompt-routing confusion, irrelevant outputs, or interception of requests intended for other skills, though the impact here is limited because the skill is low-risk and text-only.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: This markdown file contains skill guidance exclusively in Chinese, and there is no natural-language indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Static analysis

No suspicious patterns detected.