Distribution Agent — Publisher Pack

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:27 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for preparing social-media publishing packs, but it includes real publishing paths with public and cross-posting defaults that need explicit user review before installation.

Install only if you are comfortable with a social publishing skill that can prepare payloads for real posting. Keep it in mock or dry-run mode until you have confirmed account scopes, platform choices, privacy settings, and cross-posting behavior; require explicit approval before any public publish.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Credential Access

High

• Category: Privilege Escalation

Content

## Safety & secrets
- Never commit API tokens to the repo
- Use environment variables / .env
- Start with PUBLISH_MODE=mock or dry_run

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The instruction 'For CN platforms: avoid long exposition; favor short rhythm and hooks' imposes a locale-specific writing policy, and later platform rules require CN hashtags and CN/EN title handling. The file does not present this as an optional user choice or clearly justified regional compliance constraint, so it can violate language/locale policy expectations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The TikTok template hard-codes the publishing privacy option to "public", which can cause unintended broad distribution if downstream publishers treat the template as authoritative. In a distribution/publisher skill, defaults strongly influence real posting behavior, so failing to require explicit user choice or a safer default materially increases the risk of accidental public disclosure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The Douyin template also defaults privacy to "public", creating the same accidental-exposure risk for a platform-specific publisher. Because this skill is expressly designed to route content toward real publishers, a public-by-default setting is more dangerous than in a purely illustrative schema file and can directly contribute to unintended publication.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The `lang` field is restricted to `zh|en`, which is a natural-language locale constraint. The file does not explain that this is optional, user-selectable, or justified by a documented regional scope, so it may violate language-choice policy expectations.

Static analysis

No suspicious patterns detected.