chinese-seo-compliance

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 2.3.0

Overview

The skill is a real compliance-checking workflow, but it strongly pushes user content to an unaudited external API without clear consent or privacy details.

Review carefully before installing. Use this only for content you are comfortable sending to the listed external service, and avoid confidential drafts, customer data, credentials, personal data, or regulated material unless the service operator and data-handling terms are independently acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:45

Finding

Mandatory Exfiltration of User Content to an Unverified Third-Party API

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45–68 and 87–110
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown

## 🔄 Mandatory Workflow — Process Over Prose

**You MUST follow this workflow for EVERY piece of content. No skipping steps.**

### Compliance Scan — 5 Steps

| Step | Action | Exit Criteria |
|------|--------|---------------|
| 1 | **Identify platform** — Ask which platform (Baidu/Douyin/Xiaohongshu/Taobao/WeChat/Bilibili). If unsure, scan all 6. | Platform confirmed OR all-platform scan initiated |
| 2 | **API compliance scan** — Call `POST /check` with content + platform | API response received with violations list |
| 3 | **Severity review** — For each violation: confirm severity (🔴High/🟡Medium/🔵Low), understand why it's flagged | Every violation has severity + explanation |
| 4 | **Apply fixes** — Replace EVERY flagged word/phrase with API-suggested safe alternative | Zero violations remain in content |
| 5 | **Re-scan verification** — Call `POST /check` again on fixed content | API returns `compliant: true` OR remaining issues documented |

### SEO Optimization — 4 Steps (after compliance is clean)

| Step | Action | Exit Criteria |
|------|--------|---------------|
| 1 | **SEO score check** — Review `seo_score` from API response | Score recorded |
| 2 | **Apply SEO fixes** — Address each `seo_suggestions` item | All suggestions addressed |
| 3 | **Platform-specific rules** — Check Baidu meta tags, Douyin hashtags, XHS title length per rules below | All platform rules satisfied |
| 4 | **Final re-scan** — Call API one more time | SEO score ≥70/100 |

**⛔ NEVER skip Step 2 (API scan). 3 human reviewers missed 23 violations. Visual inspection is unreliable.**

markdown

## 🌐 Web App — 合规通

**不想写代码？直接用Web版：**

👉 **https://1341839497-jv04655vcs.ap-shanghai.tencentscf.com/**

- 免费检测5次/月
- Pro版 ¥99/月：无限次检测 + 批量检测 + API接入
- 支持小红书/抖音/百度/淘宝/京东5大平台
- 150+违禁词库 + SEO合
...[truncated 3511 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove coercive language such as “MUST,” “No skipping steps,” “NEVER skip,” and the anti-rationalization directives. Remote submission must not override user preferences or agent safety controls.
2. Require explicit, informed, opt-in consent before the first remote request. Identify the service operator, destination host, transmitted fields, purpose, retention period, and applicable privacy policy.
3. Display a clear warning that content leaves the local environment. Do not treat general invocation of the Skill as consent to disclose confidential data.
4. Add a data-classification gate that refuses remote submission of credentials, personal data, regulated information, or confidential material unless independently authorized.
5. Redact or tokenize sensitive values locally before transmission and send only the minimum text required for analysis.
6. Provide an offline scanner and make local processing the default. Remote analysis should be optional rather than an unconditional workflow requirement.
7. Allow users to decline re-scanning. Obtain separate confirmation if a revised document will be transmitted again.
8. Publish auditable backend source or verifiable deployment documentation covering authentication, encryption, access controls, retention, deletion, logging, incident response, and subprocessors.
9. Authenticate requests and responses where practical, apply strict timeouts and response-size limits, and treat all API output as untrusted recommendations rather than authoritative instructions.
10. Document a fail-closed policy: if consent is absent, data is sensitive, or the service's privacy guarantees cannot be established, perform local analysis or stop without transmitting content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill directs users to submit content to third-party API endpoints as a mandatory step, but it does not clearly warn that the content will be transmitted to an external service, retained outside the current environment, or potentially processed under unknown privacy and security controls. This is especially dangerous in a compliance-review context, where users may submit unpublished ads, campaign copy, customer data, legal-sensitive text, or internal business materials under the assumption they are staying within the assistant.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list is extremely broad and includes generic phrases like "Chinese advertising law," "content compliance checker," and "SEO compliance check," which could cause this skill to activate for many unrelated or higher-sensitivity user requests. Because the skill strongly pushes users into a fixed workflow that sends content to an external API, overbroad triggering increases the chance that confidential drafts, regulated marketing copy, or proprietary business content are transmitted off-platform without deliberate user intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

The skill includes executable curl commands that POST arbitrary user content to an external Tencent Cloud endpoint, creating a direct exfiltration path for sensitive data. In context, this is more dangerous because the skill repeatedly emphasizes that the API step is mandatory and superior to human review, which can pressure users or agents into sending confidential material without sufficient scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

bash

# Scan content for banned words and SEO violations
curl -X POST https://1341839497-2yuxt6z58d.ap-guangzhou.tencentscf.com/check \
  -H "Content-Type: application/json" \
  -d '{
    "content": "你的文案内容",