Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Chinese content-orchestration tool, but it asks for broad command execution permissions and includes WeChat publishing flows without enough scoping or user-facing warnings.
Review this before installing. It appears to be documentation-only and purpose-aligned for Chinese content production, but install it only if you are comfortable with a routing skill that can invoke publishing workflows and is declared with broad command execution tools. For safer use, require explicit confirmation before any WeChat action, treat links and drafts as sensitive, and remove Bash/Exec unless a concrete workflow needs them.
The Skill declares unrestricted Bash and Exec capabilities even though its documented purpose is intent classification and delegation to content-generation, visualization, and publishing Skills. No shell command, executable component, or documented workflow in the reviewed package demonstrates a legitimate need for general command execution.
This violates the principle of least privilege. If malicious user-controlled content, remotely retrieved material, or a compromised delegated Skill can influence tool selection, the unnecessary execution permissions increase the consequences from incorrect content generation to local command execution.
The package does not contain a command-injection payload or instructions that directly abuse these tools. Therefore, this finding concerns unnecessarily exposed privilege rather than confirmed malicious command execution.
Attack Path
A user supplies adversarial content, a URL, or material intended for processing by the orchestration Skill.
The content is forwarded to one or more delegated Skills, such as a paper processor, card generator, or publisher.
An untrusted instruction or compromised dependency attempts to induce a shell or execution tool call.
Because Bash and Exec are already permitted, the Agent may have a command-execution channel that is not required
...[truncated 792 chars]
Remediation
View remediation
Remediation Suggestions
Remove Bash and Exec from allowed-tools unless a specific, documented workflow requires them.
Retain only the minimum tools needed for orchestration. For example:
yaml
allowed-tools: [Read, Write, WebSearch]
Remove Write or WebSearch as well if delegated Skills perform those operations and the orchestration layer does not need direct access.
If command execution later becomes necessary, replace general shell access with narrowly scoped operations that:
Allow only predefined executables.
Reject shell metacharacters and unvalidated arguments.
Avoid command strings interpreted by a shell.
Restrict filesystem and network access through sandboxing.
Require explicit user confirmation for consequential operations.
Treat content obtained from user-provided URLs and delegated Skills as untrusted data, not executable instructions.
Pin and independently audit delegated Skills before granting them access to publishing, filesystem, network, or execution capabilities.
The README explicitly routes content to a WeChat publishing tool and even gives an example of '发出去' without warning that content may be transmitted to an external platform or publicly published. In an orchestration skill, this is risky because a user may interpret the action as a formatting step rather than a live publication step, increasing the chance of unintended disclosure or accidental posting.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The skill description is framed as a broad default entry point for content generation, format conversion, and routing from direct questions, materials, or links, which can match a very wide range of ordinary user requests. In an agent environment, this increases the chance of unintended invocation and accidental use of powerful downstream tools or workflows without sufficient narrowing, confirmation, or task-specific safeguards.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The skill explicitly supports routing complete articles to a WeChat publishing workflow, but the documentation does not prominently warn that content may be transmitted to an external platform. This can cause users or upstream agents to exfiltrate sensitive, proprietary, or draft material outside the local environment without informed consent.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding
The documented workflow routes writes output through humanizer-zh, indicating Chinese-language humanization as a default transformation without explicit user opt-in. This can override user language preferences, alter meaning or tone, and create unauthorized content transformation in multilingual or compliance-sensitive contexts.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The routing matrix and examples document a publish path to wechat-publisher as a normal workflow outcome, but they omit a strong safety notice that external posting may be irreversible or publicly visible. In practice, an agent could auto-route content into publication without the user appreciating the finality and exposure of that action.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding
The manifest description is entirely in Chinese and presents the skill as a general-purpose content generation and output orchestrator, but it does not state that the skill is China-specific or that Chinese is optional. For a broadly scoped skill, this implies a locale/language constraint without documented user choice or justification, which fits the natural-language policy violation criteria.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The entire skill documentation is written in Chinese and presents the workflow, examples, and conclusions only in that language, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking/regulatory context. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
This markdown file uses only Chinese for headings, routing tables, and integration instructions, which can effectively force a specific language on users or maintainers. The file does not provide an opt-in, alternative language, or any justification that the skill is intended only for a Chinese-language or region-specific context.
