chinese-ad-copywriter

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:51 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Chinese ad-copy and compliance-checking helper, but users should understand that its scripts contact a hardcoded external API with ad text.

Install only if you are comfortable sending ad text, titles, keywords, and platform choices to the listed external Tencent Cloud API. Do not use it with confidential client material unless you have reviewed the endpoint and data-handling expectations; the scripts would also benefit from proper JSON/URL encoding before production use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check.sh:12
• Finding: Unescaped User Input in Manually Constructed JSON Payload<![CDATA[ ## Vulnerability Details **File Location**: `scripts/check.sh`, lines 12-13 **Vulnerability Type**: JSON injection and malformed request construction **Risk Level**: Medium ### Vulnerable Code ```bash PAYLOAD=$(printf '{"text":"%s","platform":"%s","keywords":"%s","title":"%s"}' "$TEXT" "$PLATFORM" "$KEYWORDS" "$TITLE") RESPONSE=$(curl -s -X POST "${API_BASE}/check" -H "Content-Type: application/json" -d "$PAYLOAD" --connect-timeout 10 --max-time 15) ``` ### Technical Analysis The script manually interpolates the user-controlled `TEXT`, `PLATFORM`, `KEYWORDS`, and `TITLE` values into a JSON string. It does not apply JSON escaping to quotation marks, backslashes, control characters, or line breaks. Shell quoting prevents these values from being evaluated directly as shell commands, so this issue does not establish local command execution. However, shell quoting does not make the values safe for use inside JSON. A crafted value can terminate its intended JSON string and introduce additional properties or otherwise produce malformed JSON. The resulting payload is transmitted to the documented third-party compliance service at: ```text https://1341839497-2yuxt6z58d.ap-guangzhou.tencentscf.com/check ``` ### Attack Path 1. An attacker supplies ad copy or an option value containing JSON syntax, such as quotation marks and additional property delimiters. 2. The argument parser stores the crafted input in `TEXT`, `PLATFORM`, `KEYWORDS`, or `TITLE`. 3. `printf` embeds the input verbatim into `PAYLOAD`, without JSON encoding. 4. The resulting request body contains malformed JSON or attacker-injected properties. 5. The remote service may reject the request, interpret altered fields, or process data differently from what the local caller intended. 6. The script then consumes the resulting response with `jq`, potentially producing misleading compliance results or terminating because `set -e` is enabled. ### Impact Assessment The confirmed impact is limit ...[truncated 502 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Construct the request body with a JSON-aware encoder instead of string interpolation: ```bash PAYLOAD=$(jq -n \ --arg text "$TEXT" \ --arg platform "$PLATFORM" \ --arg keywords "$KEYWORDS" \ --arg title "$TITLE" \ '{text: $text, platform: $platform, keywords: $keywords, title: $title}') ``` Then submit the encoded payload using explicit failure handling: ```bash RESPONSE=$(curl --fail-with-body --silent --show-error \ -X POST "${API_BASE}/check" \ -H "Content-Type: application/json" \ --data-binary "$PAYLOAD" \ --connect-timeout 10 \ --max-time 15) ``` Additional hardening should include: - Validate `PLATFORM` against a fixed allowlist. - Apply reasonable length limits to all user-controlled fields. - Verify that the response is valid JSON and contains the expected schema before processing it. - Display an explicit error if the remote API returns an unsuccessful status. - Warn users that ad text, titles, and keywords are sent to an external Tencent Cloud endpoint and should not contain confidential campaign information. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/generate.sh:7
• Finding: Unencoded User Input in API Query Parameter<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate.sh`, line 7 **Vulnerability Type**: URL query-parameter injection **Risk Level**: Low ### Vulnerable Code ```bash RESPONSE=$(curl -s "${API_BASE}/generate?platform=${PLATFORM}" --connect-timeout 10 --max-time 15) ``` ### Technical Analysis The user-controlled `PLATFORM` value is concatenated directly into the request URL without percent-encoding or allowlist validation. URL metacharacters such as `&`, `=`, and `#` can alter the structure or interpretation of the query string. Because the complete URL is enclosed in shell quotes, this does not provide local shell-command injection. The security boundary affected is the outbound HTTP request: crafted input can introduce additional query parameters, truncate part of the URL at a fragment delimiter, or otherwise cause the remote endpoint to receive a request different from the one intended by the script. ### Attack Path 1. An attacker invokes the script with a platform argument containing URL delimiters. 2. The script assigns that value directly to `PLATFORM`. 3. The value is concatenated into the URL after `?platform=`. 4. The remote endpoint receives altered query parameters or a modified platform value. 5. The script parses and displays the returned content as though it corresponded to the requested platform. ### Impact Assessment The issue can affect the integrity and reliability of template requests and may expose undocumented remote API behavior if the service supports additional query parameters. It can also cause request failures or misleading template output. No local command execution, privilege escalation, filesystem access, persistence, or credential compromise is established by this issue. The impact is confined to the outbound request and the content returned by the remote template service. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Use curl's query-parameter encoding instead of direct URL concatenation: ```bash RESPONSE=$(curl --fail-with-body --silent --show-error --get \ "${API_BASE}/generate" \ --data-urlencode "platform=${PLATFORM}" \ --connect-timeout 10 \ --max-time 15) ``` Because the supported platforms are known in advance, also enforce an allowlist before making the request: ```bash case "$PLATFORM" in baidu|xiaohongshu|douyin|taobao|jd) ;; *) echo "Unsupported platform" >&2 exit 1 ;; esac ``` The script should additionally validate the response schema before displaying template data and report non-successful HTTP responses explicitly. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises executable shell scripts (`check.sh`, `generate.sh`) and an API backend, but it does not declare any tool scope or permissions boundaries. This can cause an agent or user to invoke shell-capable behavior without an explicit trust and consent model, increasing the risk of unintended command execution or hidden external interactions.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list contains broad phrases such as general ad-copy and compliance terms that may cause the skill to activate in contexts beyond the user's intent. Overbroad activation is dangerous here because the skill can lead to external API use and shell-script suggestions, causing unintended data exposure or workflow changes.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill states that it performs real API-backed compliance checks and includes executable scripts, but it does not clearly disclose that user-provided copy may be transmitted to a third-party service or that local shell commands may be run. This creates a meaningful privacy and safety risk because sensitive draft content, campaign data, or client materials could be sent off-platform or processed through command execution without informed consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

done
[[ -z "$TEXT" ]] && echo "❌ 请提供文案内容" && exit 1
PAYLOAD=$(printf '{"text":"%s","platform":"%s","keywords":"%s","title":"%s"}' "$TEXT" "$PLATFORM" "$KEYWORDS" "$TITLE")
RESPONSE=$(curl -s -X POST "${API_BASE}/check" -H "Content-Type: application/json" -d "$PAYLOAD" --connect-timeout 10 --max-time 15)
TOTAL=$(echo "$RESPONSE" | jq -r '.data.totalIssues // 0')
HIGH=$(echo "$RESPONSE" | jq -r '.data.stats["高"] // 0')
MID=$(echo "$RESPONSE" | jq -r '.data.stats["中"] // 0')

• Confidence: 91% confidence
• Finding: This line performs the actual external transmission of user-supplied content to a hardcoded remote service. In this skill's context, the transmission is core functionality, but it is still security-relevant because the endpoint is external, hardcoded, and receives potentially sensitive business text without trust controls, transparency, or endpoint configurability.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script sends user-provided ad copy, title, platform, and keywords to a third-party remote API endpoint, but it gives no explicit notice, consent prompt, or documentation at runtime that the content will leave the local environment. Because marketing copy may contain unpublished campaign content, customer data, or sensitive business information, this creates a real confidentiality and compliance risk rather than a purely informational issue.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The usage and result strings are presented only in Chinese, which imposes a specific language on all users with no opt-in or alternative. Under the stated policy, forcing a language or locale without user choice is a natural-language policy violation unless clearly justified as region-specific.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: Usage and status messages are presented in Chinese, and the example input also assumes Chinese content, but the script does not indicate that it is intentionally limited to a Chinese-speaking or China-specific workflow. This can violate language/locale policy where user-facing tools should not force a language without opt-in or justification.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The script performs an HTTP request to a remote API endpoint to fetch platform templates, but there is no explicit warning or disclosure at the point of execution that user input will be sent to an external service. Although the script prints usage text when no argument is provided, it does not clearly inform users that running it with a platform value triggers network access.

Static analysis

No suspicious patterns detected.