Security audit

cn-content-remix

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese social-content rewriting helper with a small script that fetches platform rules from a named remote API, with no evidence of hidden persistence, credential access, or destructive behavior.

Install only if you want Chinese-platform content adaptation and are comfortable with a Tencent SCF endpoint being used for platform-rule lookups, and possibly content checks if your agent chooses to call the documented API. Review generated advertising-law checks manually before publishing.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill description claims substantive content rewriting, compliance screening, and multi-platform generation, but the described executable capability appears limited to fetching platform rules. This mismatch is dangerous because users or downstream agents may trust the skill to perform compliance or transformation tasks that it does not actually do, creating a false sense of safety and potentially leading to publication of non-compliant or unreviewed content.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill advertises an executable shell script and API-backed behavior but does not declare any explicit tool scope or permissions boundaries. In agent environments, undeclared shell capability increases the risk of unintended command execution or tool invocation without clear operator review, especially when the skill content encourages use of scripts/remix.sh and remote API access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes broad phrases like content remix, platform adaptation, and content marketing, which can cause the skill to activate for ordinary user requests beyond its intended scope. Over-broad activation expands the attack surface by increasing the chances that untrusted content is routed into a skill that promotes shell/API usage and may influence agent behavior unexpectedly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file states "You are a Chinese content remix specialist" and defines the skill exclusively around Chinese-platform output, but it does not explicitly tell users that interaction/output is limited to Chinese or offer opt-in language selection. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The output strings are hard-coded in Chinese, including labels such as 标题, 正文, 标签, and 语气, with no option for users to select another language or locale. This is a natural-language policy concern because the skill appears to impose a specific language without opt-in or stated regional justification in the file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script makes outbound HTTP requests via curl to a remote API, but there is no confirmation prompt, visible user-facing notice, or inline comment/docstring explaining that data will be sent to an external service. Because the platform argument may be transmitted off-host, this is a safety-relevant network operation lacking disclosure within the code file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.