Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 1. **手写手账** - examples/1-handwritten-journal.jpg
Security audit
Content Writer
Security checks for vulnerabilities and agentic risk
Overview
This writing skill is mostly coherent, but it includes unsafe instructions for watermark removal and credential handling that users should review before installing.
Install only if you are comfortable with a writing assistant that can search the web, call image-generation providers, save drafts locally or to third-party services, and prepare publishing output. Do not paste API keys into chat or store app secrets in TOOLS.md; use a secret manager or protected environment variables. Do not use the watermark-removal instructions, and require explicit confirmation before any external API call, file save, Feishu/Obsidian sync, or publication step.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 2. **板报风格** - examples/2-blackboard-style.jpg
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. **科技版式** - examples/3-tech-style.jpg
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 4. **日常科普** - examples/4-flat-edu-style.jpg
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 5. **扁平简约** - examples/5-minimalist-style.jpg
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 6. **孟菲斯** - examples/6-memphis-style.jpg
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 7. **蒸汽波** - examples/7-vaporwave-style.jpg
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly instructs automatic watermark removal from generated images and provides implementation details to crop them away. That is a direct policy-violating capability because it facilitates removal of attribution or provider markings from media.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly instructs the assistant to ask users for API keys in chat, receive them directly, and use them for configuration and testing. That is unnecessary and unsafe for a writing assistant because it creates a natural-language path for collecting, handling, and potentially exposing secrets outside a dedicated secret-management flow.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The assistant is told to ask users for API keys, accept them in conversation, and then configure/test the service. This creates a direct credential-harvesting path and increases the chance that secrets are retained in chat history, logs, transcripts, or passed into tools unsafely.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill recommends placing公众号 appid/secret values in TOOLS.md, which is likely a plaintext file and not an appropriate secret store. This encourages insecure credential storage and broadens the chance of accidental disclosure through version control, logs, backups, or other tooling.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Suggesting that公众号 appid/secret be added to TOOLS.md encourages plaintext credential storage in a file likely to be readable, copied, synced, or committed. This materially increases the attack surface for secret disclosure and unauthorized account use.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases are broad enough to activate on common terms like '创作' or '写文章', which increases the chance the skill runs in unintended contexts. Because the skill can perform web access, local file operations, and external publishing-related actions, accidental activation meaningfully increases exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill describes web searching, web fetching, local saves, and third-party destinations like 飞书 and Obsidian without providing any user-facing notice about what data may leave the system or be written locally. In a workflow that may process user-provided drafts, topics, or unpublished content, that omission creates privacy and data-handling risk.
- Content
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 78% confidence
- Finding
The Obsidian path detection command enumerates user filesystem locations to discover installed applications and storage paths. This is not inherently malicious, but it is broader than necessary for a writing workflow and can reveal local environment details without an explicit permission step.
- Content
Obsidian 路径检测：
bash ls -la ~/Library/Application\ Support/obsidian/ 2>/dev/null || ls -la ~/Obsidian/ 2>/dev/null第5步：文章调整
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
The skill sends prompts and possibly user-derived content to an external image-generation API. External transmission is expected for this feature, but it still introduces data exposure risk because the workflow lacks clear consent, minimization guidance, or boundaries on what content may be sent off-platform.
- Content
为每个章节生成一张配图，使用火山引擎 API：
bash curl -X POST "https://ark.cn-beijing.volces.com/api/v3/images/generations" \ -H "Authorization: Bearer $VOLCENGINE_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code and surrounding instructions claim to remove watermarks by cropping the bottom 20% of every image, regardless of whether a watermark exists. This is dangerous because it operationalizes watermark removal and encourages copyright/policy evasion under misleading justification.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
The inclusion of third-party image API endpoints expands the set of external services to which user-derived data may be transmitted. While this supports the feature set, it becomes risky in context because the skill also encourages ad hoc credential setup and lacks strong privacy/safety guardrails around outbound content.
- Content
md |--------|-----| | 环境变量 | `NANO_BANANA_API_KEY` | | 模型 | `banana-v2` | | 端点 | `https://api.banana.sh/v1/image/generate` | #### 方案6：Replicate (支持多种模型)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill requests API keys and gives storage guidance without any secure-handling warning, despite involving highly sensitive secrets. Combined with the direct-in-chat collection flow and plaintext storage suggestion, this materially raises the risk of credential leakage and misuse.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger is centered on generic article-writing language and workflow entry points, which can overlap with ordinary user requests. That increases the chance the skill activates in contexts where the user did not intend to invoke it, potentially steering content generation, save, or publish flows unexpectedly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The SOP instructs the assistant to save locally, to Feishu, or to Obsidian and later offers publishing actions, but it provides no warning, consent checkpoint, or explanation of where data will go. In a content-writing skill, this can cause unintended disclosure of user-provided drafts or sensitive business information to external systems or publication targets.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
SQP-3 covers natural-language policy violations such as forcing a specific language without user opt-in. The usage flow and primary skill framing are presented as Chinese-first content, and the file does not state that users may choose their preferred language or locale.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This is a markdown file, so SQP-2 applies to omissions in the skill description about behaviors that affect user data or system integrity. The example dialogue shows the skill saving output locally to the Downloads folder, but there is no explicit warning or disclosure that the skill writes files to the user's filesystem.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown instruction explicitly requires '英文提示词' for AI image tools, imposing a language choice in the skill behavior. Under the policy, language constraints should either be optional for the user or clearly justified as region/tool-specific; that justification is not provided here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file contains user-facing guidance exclusively in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.