Security audit

pengyouquan-pangyu

Security checks for vulnerabilities and agentic risk

Overview

This skill is a focused WeChat Moments writing assistant that stores user-provided writing samples locally for personalization, with no code execution or network behavior found.

Install this only if you are comfortable with the skill keeping your provided posts and approved drafts in its local reference files for future style matching. Review or delete those reference files if you do not want older writing samples reused.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill advertises ongoing accumulation of past writing style but provides no upfront warning about storage, retention duration, or reuse of that content. Users may share personal or identifying text expecting ephemeral assistance, while the system is designed to retain it for future generations.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The feature's purpose is personalization, but it normalizes indefinite accumulation of user content and inferred style data for future reuse, which is a genuine privacy and retention risk. Even without malicious intent, the context makes this more dangerous because a writing-style corpus can reveal identity, habits, relationships, and sensitive life events over time.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to immediately persist user-provided reference materials to disk without first obtaining consent for that specific save action or presenting any privacy notice. Because the content is personal writing intended to model the user's style, this creates a real data-retention risk and may store sensitive personal information unexpectedly.

Ssd 3

Medium

Confidence: 98% confidence
Finding: This is a true retention vulnerability because the skill mandates automatic storage of user writing samples into a persistent reference library without per-item confirmation. In context, the stored data is likely to contain personal experiences, emotional reflections, and social details, increasing privacy exposure if reused, accessed unexpectedly, or retained longer than intended.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The markdown content presents the skill behavior entirely in Chinese and does not indicate any user language selection or opt-in. This may violate a language/locale policy if the broader environment expects language choice rather than a forced locale.

Static analysis

No suspicious patterns detected.