Security audit

忘情水会问版（孟婆汤禅意情感治愈类）

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a writing-engine helper, but its own version notes say it was repackaged to bypass platform upload/security interception.

Install only if you are comfortable with a skill that edits and debugs a local text-generation project, and review any generated Node.js commands or file writes before running them. The main issue is not the writing engine itself, but the artifact's stated intent to bypass platform upload/security restrictions by inlining code and assets.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.
md
| `v1.0.3` | `v1.x` | 结构重构：全部内容内联进单一根目录 `SKILL.md`（平台拦截 `assets/`、`references/` 子目录文件） |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description states the engine is for Chinese '孟婆汤风格' copy generation and the rest of the file consistently defines invocation and operation around Chinese labels and phrasing. There is no indication that language choice is optional or that the Chinese-only constraint is a documented, justified regional requirement.
Content: No source excerpt is available for this finding.

Ssd 2

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The version notes explicitly describe restructuring content to inline code and assets in markdown in order to bypass platform upload interception and security restrictions. Even if the embedded code here is not overtly malicious, normalizing techniques to evade platform safety controls weakens trust boundaries and can be reused to smuggle harmful payloads past review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: In this markdown file, the tutorial instructs users to write generated samples to tmp/友情候选.md, which is a filesystem write affecting local data. The surrounding section presents this as a normal step but does not include any warning or note that the action creates/modifies local files.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.