Security audit

GEO内容发布助手

Security checks for vulnerabilities and agentic risk

Overview

This skill automates public posting with persistent credentials and a background browser-control agent, but its triggers, credential handling, and platform-control claims are too broad and inconsistent for automatic approval.

Install only if you are comfortable giving this publisher an API key/invite code and allowing a persistent local agent to control your browser, use platform login cookies, upload selected local media, and publish publicly. Prefer a dedicated account or limited-scope key, confirm every publish action manually, check platform rules, and make sure you know how to revoke credentials and stop the local agent.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The document explicitly claims it does not simulate human behavior, yet elsewhere it mandates 'humanized' mouse trajectories and anti-detection style behavior across platforms. This contradiction is dangerous because it indicates the skill is designed to evade platform detection and disguises that fact, increasing the likelihood of policy bypass, account sanctions, and operator deception.

Vague Triggers

High

Confidence: 93% confidence
Finding: The skill defines automatic activation for any speech 'related to GEO business' and says it should immediately run the full workflow. In this context, activation can lead to browser launching, credential prompts, local agent startup, and publication actions, so an overly broad trigger surface creates a real risk of unintended high-impact actions from ordinary conversation.

Vague Triggers

High

Confidence: 95% confidence
Finding: Several trigger phrases are short and common enough to collide with normal conversation, yet they map directly to binding, publishing, and account operations. Given this skill's power to start local processes and automate posting, vague triggers materially increase the chance of unauthorized or accidental execution.

Ssd 3

High

Confidence: 97% confidence
Finding: The skill instructs the agent to ask for a user's API key once and store it for future use, and elsewhere relies on invite codes as membership credentials. Persisting long-lived secrets obtained through chat-driven flows significantly increases the blast radius of leakage, misuse by the local agent, and accidental disclosure, especially because these credentials authorize backend actions and account-linked publishing.

Ssd 3

High

Confidence: 98% confidence
Finding: The file tells users their only required action is to provide a platform/API key directly to the skill, which normalizes sharing sensitive credentials in conversational or loosely controlled contexts. Because the skill then uses those credentials to start a local engine and perform authenticated backend actions, interception or misuse of the secret would enable account abuse and unauthorized publishing.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The examples encourage placing sensitive API keys and invite codes into environment variables and command lines, which can be exposed through shell history, process listings, logs, screenshots, or shared terminal sessions. In a local automation skill that launches scripts and background agents, these exposure channels are realistic and can lead to credential compromise and downstream account abuse.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:150