Security audit

选题生成器

Security checks for vulnerabilities and agentic risk

Overview

This skill is a content-idea helper with disclosed local output and optional integrations, and I did not find artifact-backed evidence of deception, credential theft, destructive behavior, or hidden persistence.

Install only if you want a Chinese-oriented content-planning helper. Review or request confirmation before it saves files, exports to Tencent Docs/Excel, chains into video generation, or is scheduled through a cron skill; the packaged script appears basic and may not actually fetch live multi-platform trends as advertised.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The documented behavior promises dynamic hotspot retrieval, user preference analysis, and multi-platform adaptation, but the analysis indicates undeclared local file writes and behavior that may rely on preset data while hardcoding a single platform. This mismatch is dangerous because users may grant trust or provide data based on false assumptions about what the skill actually does, and hidden side effects like file writes expand risk beyond the stated purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The skill advertises automatic collection of hotspot data from multiple platforms without explaining data sources, terms-of-use considerations, or privacy implications. While likely intended for public trend gathering, this opacity can mislead users about what is collected and how external queries occur, increasing legal, privacy, and trust risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example invocation "帮我生成今天的视频选题，领域是AI工具测评" is a generic conversational request rather than a narrowly scoped trigger phrase. In a markdown skill description, this can blur when the skill should activate versus when a user is just asking generally for help, because no explicit trigger constraints or negative examples are provided nearby.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The README states that generated content can be saved locally or to Tencent Docs, but it does not warn users what data may be stored, where it will be sent, or when external services are involved. In practice, prompts, business plans, or audience data could be persisted or transmitted off-platform without informed user consent, creating confidentiality and compliance risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill describes writing outputs to the local workspace and saving idea libraries, but it does not declare any explicit tool scope or permissions boundary. This creates a transparency and least-privilege problem: users and the host agent may not understand that the skill can persist data locally, which increases the risk of unintended file creation, overwriting, or data retention.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases include very common requests such as '给我一些选题建议' and '今天做什么内容', which can overlap with normal conversation and cause the skill to activate unexpectedly. Unintended activation becomes more concerning here because the skill also advertises saving files and invoking downstream automation, so a casual prompt could trigger broader actions than the user intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill advertises automatic saving to local Markdown, Tencent Docs, Excel, and even direct execution via another video-generation skill, but it does not clearly warn users about data persistence or downstream system effects. This is risky because users may expect simple idea generation while the skill can instead store content externally or trigger additional automation chains.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The scheduled automation example shows unattended daily execution with push delivery into the chat window, but it does not clearly warn that the skill can run on a timer without an active user request. Unattended execution increases the chance of unexpected content generation, repeated writes, noisy notifications, and accidental propagation of poor or sensitive outputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s natural-language descriptions and class docstring are written entirely in Chinese, while user-facing output strings elsewhere are in English, indicating the skill assumes a specific language context without documenting user opt-in or locale selection. The policy requires flagging language or locale constraints when the skill does not explicitly offer a language choice or justify the restriction.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill persists generated content to local files even though the described behavior is only to generate idea suggestions. This creates an unnecessary side effect that can expose user-derived content, leak data into shared storage, or violate least-privilege expectations for a skill that should be read-only from the user's perspective.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Most of the operational documentation and examples are written only in Chinese, effectively imposing a language/locale choice on users without an explicit opt-in or justification. The policy requires avoiding forced language constraints unless the user is given a choice or the locale restriction is clearly documented as intentional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 70% confidence
Finding: The activation phrases, instructions, and examples are entirely in Chinese, and the document does not indicate that other languages are supported or that Chinese is optional. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.