TechVideo Wizard - SuperMap GIS技术小视频脚本向导

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:23 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent Chinese video-script wizard, with disclosed but noteworthy automatic web searching and local Markdown file output.

Install only if you are comfortable with a Chinese-first workflow that automatically searches the web using the topic you provide after Step 1 and saves the final script as a Markdown file in the current working directory. Avoid entering confidential product names, unreleased campaign ideas, client details, or internal roadmap terms unless external search disclosure is acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- **开头要求**：必须包含问句或痛点场景（如"还在为数据导入报错发愁吗？"）
- **结尾要求**：必须包含行动号召 CTA（如"想亲自试试？评论区领安装包。"）
- 添加 5 个 CTA 示例，引导用户互动
- 更新 Output Rules，明确开头和结尾的互动要求

### v1.5.0 (2026-04-28)
- **优化 Step 3 过渡提示**：添加 5 个示例让 AI 随机选择

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- **开头要求**：必须包含问句或痛点场景（如"还在为数据导入报错发愁吗？"）
- **结尾要求**：必须包含行动号召 CTA（如"想亲自试试？评论区领安装包。"）
- 添加 5 个 CTA 示例，引导用户互动
- 更新 Output Rules，明确开头和结尾的互动要求

### v1.5.0 (2026-04-28)
- **优化 Step 3 过渡提示**：添加 5 个示例让 AI 随机选择

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The skill description and invocation guidance are presented only in Chinese, with no indication that users may choose another language or locale. This can constitute a language/locale policy issue when the skill implicitly enforces one language without offering opt-in or alternatives.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The activation examples include "帮我写个 xxx 小视频的脚本" and "帮我写个产品介绍视频的脚本", which are broad natural requests a user might say in ordinary conversation outside the intended skill context. The README does not provide limiting conditions, exclusions, or context boundaries to distinguish when the skill should activate versus when a general assistant should just answer normally.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The workflow claims automatic detection of already-published videos after Step 1, conflicting with the described 6-step interactive script-writing process. Hidden or automatic checks introduce undeclared behavior that may trigger network access or content inspection outside user expectations.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The README states the skill performs duplicate-content checks against external platforms, which expands behavior beyond a local script-generation wizard into external discovery and monitoring. This creates a scope mismatch that can lead users or hosting agents to access third-party services and process external content without clear disclosure, permissions, or manifest alignment.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Checking third-party video platforms for duplicate content is not necessary for generating a video script and introduces unrelated external data access. This increases privacy, compliance, and abuse risk because the skill may send user concepts or titles to outside services for reasons unrelated to the core task.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The invocation criteria are broad enough to match generic multimedia or content-creation requests, increasing the chance the skill activates in contexts where users did not intend this workflow. Overbroad triggering can cause unnecessary data collection, external searching, or file writes when a simpler response would have sufficed.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The workflow and all verbatim prompts require Chinese-language interaction, including mandated Chinese responses and examples, but the file does not offer a language choice or explain a justified locale restriction. This is a natural-language policy issue because it imposes a specific language without opt-in.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The duplicate-content check performs cross-platform reconnaissance on WeChat Video Channels, Bilibili, and Douyin that is not strictly necessary for generating a video script. In practice, this can expose sensitive campaign ideas or internal feature names and may encourage competitive intelligence collection outside the user's expectations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill auto-triggers web searches immediately after collecting the one-line introduction, without a clear warning that user content will be sent to external services. If the introduction contains proprietary product names, roadmap items, or client details, those terms may be disclosed to third parties unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill is presented as a script-writing wizard, but it silently expands scope into automatic third-party web reconnaissance after Step 1. This can transmit user-provided product names, features, or unreleased topics to external services without clear consent, creating privacy and data-handling risk beyond the declared purpose.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Automatically generate the final video script based on all collected context.

**Do NOT ask the user anything in this step.** Execute the following generation logic:

### Terminology Constraints (CRITICAL)

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill writes a Markdown file into the working directory automatically, but does not clearly warn the user before creating a local artifact. Unexpected file creation can leak sensitive content to shared environments, overwrite expected outputs, or violate least-surprise expectations in agent workflows.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: This markdown file includes natural-language instructions that require fixed Chinese formatting for step numbering and explicitly prohibit the English form 'Step 1'. That imposes a locale/language constraint without any opt-in or documented justification, which matches the policy-violation category for language or locale restrictions.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The display name and description are written entirely in Chinese, which suggests the skill is presented in a fixed language without any indication of user opt-in or locale-specific scope. Under the policy for natural-language violations, forcing a specific language without choice or documented justification is in scope.

Static analysis

No suspicious patterns detected.