Security audit

养生公众号日更

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated article-production purpose, but it asks the agent to remember a local folder, automatically updates local HTML files, and includes direct off-platform WeChat payment instructions.

Review this before installing if you do not want an agent to remember local writing folders or update a persistent article library. Confirm exact write paths before running the library script, and treat the WeChat payment/contact instructions as an external transaction outside platform safeguards.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The description explicitly says the skill should activate for generic phrases like '写今天的公众号' or '来一篇养生文', which are broad enough to match ordinary writing requests that may not imply consent to this full pipeline. Because the skill also includes file-handling and publishing workflow steps, accidental invocation could cause the agent to apply hidden behaviors or ask for/retain local path information unexpectedly.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill asks the user to provide an article storage directory and says the AI should remember it for future use, but it does not warn that this creates persistent knowledge of a local path or may enable later file operations in that location. This weakens informed consent around local filesystem context and increases the chance of unintended reuse or modification of user files.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: These instructions direct the agent to generate same-directory HTML files and run a script to insert content into a library, but they do not require explicit user confirmation before creating or modifying files. In a skill context, silent file creation and automated library updates can alter user data, overwrite adjacent content, or make persistent changes the user did not expect.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The upgrade section solicits off-platform contact via a personal WeChat ID and requests direct payment, without any trust, privacy, or fraud warning. This creates social-engineering and privacy risk because users may be induced to disclose identity, payment, and contact information outside platform safeguards.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This code performs a file write to the target library path, potentially modifying an existing HTML library or creating a new one, but there is no confirmation prompt before the write. Although the script prints a completion message afterward, the safety-relevant disclosure comes only after the operation has already occurred.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: The rule requires a fixed tone "温暖、像姐姐聊天" and the overall skill content strongly assumes Chinese-language output, but does not offer users a language or locale choice. Because the file includes English metadata and an English payment note, the lack of explicit opt-in or language selection is a natural-language policy concern rather than a clearly justified region-only restriction.

Natural-Language Policy Violations

Low

Confidence: 89% confidence
Finding: The script creates HTML with `lang="zh"`, which enforces a specific locale in generated output. The file does not indicate that this is optional, user-configurable, or required by a region-specific use case, so it appears to violate the language/locale choice policy.

Static analysis

No suspicious patterns detected.