A股复盘转公众号格式工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:41 AM UTC
• Version: 1.2.0

Overview

The skill is a WeChat article formatter, but it automatically saves generated content to a root-level Hermes directory without clear opt-in, so it should be reviewed before installation.

Install only if you are comfortable with generated articles being written to disk automatically. Review the output path and article title before use, avoid feeding sensitive chats or notes unless saving is intended, and prefer a version that asks before writing files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:33

Finding

Mandatory Promotional Content Injection into Generated Articles

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33-37
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Relevant instruction translated into English:

markdown

3. Fixed ending template:
   ---
   **Risk Notice:** The above content is only a personal market review and does not constitute investment advice. The stock market involves risks; invest cautiously.
   ---
   *If you found this helpful, please like, recommend, and share it.*

Technical Analysis

The skill requires every generated article to include a fixed engagement-solicitation message. This instruction affects the agent's final output independently of whether the user requested promotional content.

Because the ending is mandatory rather than optional, loading and applying the skill changes the output-generation objective from transforming user-provided material to also promoting engagement. The injected language could be incorporated into content that a user expects to be publication-ready without a separate review or consent step.

The behavior is limited to generated content. The reviewed file does not contain instructions to disable safety controls, execute code, retrieve remote payloads, or acquire system privileges.

Attack Path

1. The skill is loaded for a text-to-article conversion request.
2. The user provides source material for a WeChat Official Account article.
3. The skill applies its mandatory fixed-ending rule.
4. The agent appends the engagement-solicitation message even when the user did not request it.
5. If the result is published without review, the injected promotional language appears in the public article.

Impact Assessment

The issue affects the integrity and editorial control of generated content. Users may unknowingly publish promotional language attributed to them or their organization.

No operating-system privileges, credentials, execution capabilities, or ...[truncated 142 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the requirement to append promotional language to every article.
• Make engagement language an explicit opt-in setting.
• Display the proposed ending to the user and obtain confirmation before including it.
• Preserve user-supplied endings unless the user specifically requests replacement.
• Separate neutral risk disclosures from optional marketing or engagement content.
• Document all automatically inserted text in the skill description.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:27

Finding

Automatic File Write to a Privileged Agent Directory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 27
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Relevant instruction translated into English:

markdown

2. Automatic save function: The generated article is automatically saved to the user's designated Official Account directory. Default path: `/root/.hermes/hermes-agent/gzh/[date]_[title].md`

Technical Analysis

The skill directs the agent to perform an automatic filesystem write under /root/.hermes/hermes-agent, although its primary purpose is content generation. The instruction does not require explicit confirmation before writing, validate that the destination is user-controlled, define collision handling, or require sanitization of the title used in the filename.

If the runtime has permission to write to the specified directory, a user-controlled or model-generated title may influence the destination filename. Without normalization and containment checks, unsafe filename components could potentially cause path traversal. A predictable filename could also overwrite an existing article if the underlying write tool permits replacement.

The instruction does not itself provide a privilege-escalation mechanism. Its practical effect is constrained by the permissions already held by the agent process and by the safety properties of the file-writing tool.

Attack Path

1. A user invokes the skill and supplies content or a crafted article title.
2. The skill constructs a filename from the date and title.
3. The agent automatically attempts to write the generated article beneath /root/.hermes/hermes-agent/gzh/.
4. If filename components are not sanitized, crafted separators or traversal sequences may alter the intended destination.
5. If overwrite protection is absent and the resolved path already exists, existing content may be replaced.

Impact Assessment

A successful exploitation coul ...[truncated 526 chars]

Remediation

View remediation

Remediation Suggestions

• Do not save generated content automatically; require explicit user confirmation.
• Default to a non-privileged, user-controlled workspace rather than a directory under /root.
• Treat generated titles as untrusted filename input.
• Remove path separators, traversal sequences, control characters, and reserved filename characters.
• Resolve and canonicalize the destination path, then verify that it remains inside the approved output directory.
• Use exclusive file creation or prompt before overwriting an existing file.
• Apply restrictive file permissions and execute the agent under a dedicated non-root account.
• Return the final resolved path to the user before and after the write operation.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger section says the skill applies when a user sends 'any colloquial text/chat logs/draft material' and other loosely bounded content types. This is ambiguous and broad enough to overlap with many ordinary writing requests, with no explicit exclusions or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is presented as a text conversion/formatting tool, but its instructions add an automatic local file-write side effect that is not justified by the manifest or clearly bounded by user consent. Hidden or weakly disclosed write behavior can lead to unintended persistence of sensitive user content and expands the skill's effective privileges beyond content transformation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Automatically writing generated output into /root/.hermes/hermes-agent/gzh/ gives a simple formatting skill unnecessary filesystem write capability, and the path is inside a privileged/root-owned area. If the generated content includes sensitive notes, chats, or analysis, this creates unintended data retention and could interfere with other agent state or files in the same environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill describes automatic saving to a filesystem path without clearly warning the user that their content will be written to disk or disclosing the default location in a consent-oriented way. For a tool handling chats, notes, and analysis, silent persistence increases privacy risk, can surprise users, and may expose sensitive data to later access within the agent environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.