Security audit

Content Writer

Security checks across malware telemetry and agentic risk

Overview

This content-writing skill is mostly coherent, but it gives unsafe credential-handling guidance and instructs agents to remove image watermarks.

Review this skill before installing. Use it only with non-sensitive drafts, do not paste API keys or publisher secrets into chat, do not store secrets in Markdown files, and do not use the watermark-removal instructions. Prefer configuring provider credentials through environment variables or a platform secret store and confirm any external upload, save, or publish destination before proceeding.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to crop generated images to remove a watermark, framing provenance-removal as a normal post-processing step. Removing or obscuring watermarks/content provenance can violate provider terms, defeat attribution/safety signals, and normalize evasion behavior in an automated workflow.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: Labeling a generic crop routine as '去水印' makes the intended use explicit: conceal or remove a watermark rather than perform ordinary composition edits. That wording increases the risk that users and downstream agents treat provenance-removal as an endorsed feature.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README states that generated files are saved to the Downloads folder without clearly warning the user about local file writes or requiring explicit confirmation. This can lead to unexpected data being written to disk, privacy issues, or abuse if generated content is saved automatically in a predictable location.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill advertises integration with multiple third-party image-generation APIs and user-supplied API keys, but does not warn that prompts, images, and possibly metadata may be transmitted to external providers. This creates privacy and data-handling risk, especially if users submit sensitive topics or store API credentials insecurely.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The activation phrases are broad terms like '创作' and '写文章', which can cause the skill to trigger in unrelated contexts. Over-broad activation can unexpectedly invoke network calls, file writes, or credential-requesting behavior when the user did not intend to use this skill.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The skill proposes saving files to local paths, including default locations, without an explicit safety confirmation about filesystem effects. In an agent setting, implicit file creation can surprise users, overwrite content, or disclose path information about the local environment.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill directs the agent to send user topics and article material to external search/fetch and image-generation services without a privacy notice or consent step. User prompts may contain unpublished ideas, business data, or personal information that would then be transmitted to third parties.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill tells users to provide API keys directly in chat, which creates a direct social-engineering pathway for secret collection. Chat channels are often logged, retained, or visible to systems/operators, so requesting credentials there materially increases exposure risk.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The documentation advises placing publisher credentials in a markdown file, encouraging plaintext secret storage in project content. Such files are easy to leak through backups, version control, sharing, or later prompt/context inclusion.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The workflow explicitly offers saving and publishing destinations such as local storage, Feishu, and Obsidian without any prompt to confirm sensitivity, privacy expectations, or destination trust. This can lead users to disclose confidential draft content to third-party platforms or synced knowledge bases unintentionally, especially because the SOP presents these outputs as routine next steps.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The image-generation, layout, and publishing flow implies external processing and eventual publication, but it does not warn that prompts, article text, or generated assets may be sent to external services or publicly exposed. In a content-writing skill, this is materially risky because drafts may contain unpublished business plans, internal marketing copy, or personal information that users do not realize will leave the local environment.

Ssd 3

High

Confidence: 99% confidence
Finding: The workflow operationalizes credential collection by instructing the assistant to ask for API keys, receive them in conversation, and use them for configuration/testing. This is a classic sensitive-data handling anti-pattern that exposes secrets through logs, model context, and accidental reuse.

Ssd 3

High

Confidence: 99% confidence
Finding: Directing users to place appid/secret values into TOOLS.md promotes plaintext credential persistence in a human-readable project artifact. This sharply increases the chance of secret exfiltration via source control, file sharing, prompt ingestion, or local compromise.

Ssd 2

Medium

Confidence: 97% confidence
Finding: The instruction to 'automatically crop' the bottom of images specifically to remove watermarks is an evasion pattern aimed at bypassing provenance or branding protections. Even if technically simple, the purpose is to defeat a safety/ownership marker, which makes the workflow materially riskier.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.