Security audit

Automation Tool

Security checks for vulnerabilities and agentic risk

Overview

This content automation skill is coherent, but it asks for script, file, messaging, and scheduled publishing powers without enough user controls.

Install only if you are comfortable with a content automation skill that may run scripts, read or write batches of files, send generated content, or schedule posts. Before using those features, require explicit review of the exact files, commands, destinations, content preview, and any scheduled publishing setup.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Natural-Language Policy Violations

Medium

Confidence: 86% confidence
Finding: The skill description, workflow, examples, and invocation guidance are all written as Chinese-only instructions, and the capability list includes multilingual translation without giving users a choice of operating language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy issue unless clearly justified as region-specific.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill advertises `exec`, `read/write`, and `message` capabilities as part of normal operation, but it does not clearly warn users that these can modify files, run local scripts, or send content externally. This creates a meaningful risk of unintended system or data impact if the skill is invoked casually, especially given its automation and batch-processing framing.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The timed publishing example describes automatic scheduled external actions without an explicit warning or approval model. Scheduled posting is dangerous because it can continue acting after the initial interaction, potentially publishing unintended, incorrect, or sensitive content to external platforms without real-time human review.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases are very broad (e.g., common requests like '帮我写文章' or '生成报告'), which can cause the skill to activate for routine conversations without the user realizing it is invoking a higher-capability automation workflow. In this skill, that matters because the declared capabilities include execution, file writing, and external messaging/publishing, increasing the chance of unintended tool use or scope escalation from ordinary prompts.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: This markdown file presents all user-facing content exclusively in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-only regional context. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The entire markdown file is written in Chinese and presents the generated article as the skill output, with no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. Under the policy, language-specific output without opt-in or clear justification is a natural-language policy violation.

Static analysis

No suspicious patterns detected.