cn-ad-copywriter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 2.0.0

Overview

This skill does what it claims, but it can automatically send advertising drafts and metadata to a fixed external API without a clear consent step or privacy details.

Install only if you are comfortable sending ad drafts, titles, keywords, and platform information to the documented Tencent Cloud Function endpoint. Avoid using it with confidential launches, client material, regulated data, or customer information unless the publisher documents data handling and provides consent or local-only controls.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

other

Warning

• Location: scripts/check.sh:5

Finding

Undisclosed Transmission of User-Provided Advertising Content to an External Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check.sh:12

Finding

Unsafe JSON Construction Allows Request Corruption and Property Injection

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/generate.sh:5

Finding

Unvalidated Platform Value Allows HTTP Query-Parameter Injection

Content

View full analysis

Remediation

View remediation

&2 exit 1 ;; esac ``` 2. Use cURL's URL-encoding support instead of manual concatenation: ```bash RESPONSE=$(curl -sS --fail-with-body \ --get "${API_BASE}/generate" \ --data-urlencode "platform=${PLATFORM}" \ --connect-timeout 10 \ --max-time 15) ``` 3. Validate the response schema before rendering it. 4. Return an explicit failure when the endpoint responds with a non-successful HTTP status or malformed JSON. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises executable shell scripts and API-backed command-line usage but declares no explicit tool scope or permission boundaries. In an agent environment, this can cause the model to assume shell execution is acceptable and invoke local commands or networked scripts without clear authorization, increasing the risk of unintended command execution or data exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger list contains broad terms such as general ad-copy/compliance phrases that may cause the skill to activate for ordinary writing or marketing requests outside its intended niche. Over-broad activation can route unrelated user input into a skill that promotes external API usage and shell-script workflows, creating unnecessary exposure to external services and unintended behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill states that it is a professional Chinese advertising copywriter and is framed to generate copy for Chinese platforms, but it does not indicate that users may choose another language for interaction or output. This can constitute a locale/language policy issue because it implicitly enforces a specific language without explicit opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This line performs the actual outbound transmission of user-supplied content to an external service, which is a genuine security-relevant behavior in this skill context. The risk is heightened because the skill is marketed for real ad-copy generation/compliance checking, so users are likely to submit proprietary marketing drafts or regulated content without realizing it leaves the local environment.

Content

Scanner excerpt · scripts/check.sh (reported line 12)May include surrounding context.

sh

done
[[ -z "$TEXT" ]] && echo "❌ 请提供文案内容" && exit 1
PAYLOAD=$(printf '{"text":"%s","platform":"%s","keywords":"%s","title":"%s"}' "$TEXT" "$PLATFORM" "$KEYWORDS" "$TITLE")
RESPONSE=$(curl -s -X POST "${API_BASE}/check" -H "Content-Type: application/json" -d "$PAYLOAD" --connect-timeout 10 --max-time 15)
TOTAL=$(echo "$RESPONSE" | jq -r '.data.totalIssues // 0')
HIGH=$(echo "$RESPONSE" | jq -r '.data.stats["高"] // 0')
MID=$(echo "$RESPONSE" | jq -r '.data.stats["中"] // 0')

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends the full ad copy text plus metadata (platform, keywords, title) to a third-party remote API endpoint, but gives the user no explicit notice at runtime and no consent prompt. Because ad copy may include unpublished campaign material, customer data, or sensitive business information, this creates a real confidentiality and privacy risk rather than a purely informational issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's user-facing messages and formatted output are hardcoded in Chinese (for example, '用法', '模板', '技巧', and '获取模板失败'). This imposes a specific language/locale on all users without opt-in or justification, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Natural-language strings in the usage/help and error output are fixed to Chinese, which can impose a language choice on users without opt-in. The file does not indicate that the skill is intentionally region- or locale-specific, nor does it offer an alternative language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.