Security audit

多平台复刻蒸馏写作技能

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly transparent about what it does, but it combines third-party content collection, author-style cloning, and persistent local skill creation without enough consent, review, or uninstall safeguards.

Install only if you are comfortable with the skill fetching public-platform content through RedFox, using a REDFOX_API_KEY, reading user-specified local files or folders, and creating persistent local author-style skills. Use it only with material you own, have permission to analyze, or can lawfully process, and review any generated sub-skill before enabling or relying on it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly promotes automatic collection from public platforms and high-fidelity cloning of an author's thinking and writing style, but it provides no warnings or guardrails around copyright, consent, impersonation, or platform terms. In context, this makes the risk more serious because the core feature is not incidental analysis but systematic acquisition and replication of another creator's expression at scale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill is explicitly designed to reproduce a named author's distinctive thinking and voice without stating any consent, authorization, or permitted-use boundaries. That creates a meaningful risk of impersonation, deceptive content generation, and possible misuse of copyrighted or personality-linked expression, especially when paired with automated collection from public platforms.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README advertises automatic retrieval from third-party platforms and installation of a local sub-skill, but it does not prominently warn users about privacy, copyright, credential, filesystem, or persistence risks. Missing disclosure is dangerous because users may authorize scraping, local file access, or installation without understanding the resulting data exposure or system impact.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The usage guidance encourages invocation through very natural, loosely scoped language, which can cause the skill to trigger in situations the user did not clearly intend. For a skill that can collect external content and install a local sub-skill, overly broad activation increases the chance of unreviewed data access or unintended system changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README advertises automatic collection from public platforms but does not explain consent, copyright, privacy, platform terms, or how collected content is stored and processed. In this skill context, the feature is central and could lead users to gather third-party content or personal data without understanding legal and security implications.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README instructs users to invoke the skill via broad natural-language requests rather than a tightly scoped command. In an agent ecosystem, this can cause accidental activation from ordinary conversation, leading to unintended scraping, style cloning, or other side effects without clear user confirmation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example trigger phrases are generic requests like analyzing writing style or updating a persona, which could plausibly appear in everyday use. If the agent routes on semantic similarity, these phrases increase the chance of the skill activating when the user intended a normal discussion rather than automated collection or skill generation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README states that a generated sub-skill will be installed locally, but it does not warn users that this changes the local agent environment or describe what code, prompts, files, or permissions are being added. Automatically installing a generated artifact is especially risky because the artifact is derived from scraped or user-supplied content and may persist unsafe behavior or prompt injection into future sessions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill states it can be used via general natural-language requests, which weakens activation boundaries and increases the chance it will be invoked during ordinary writing or analysis tasks without explicit user intent. In a skill that performs external collection and style-cloning, accidental activation can trigger unauthorized content processing or policy-sensitive imitation workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger list contains broad phrases such as style analysis and imitation-related requests that can overlap with normal editorial assistance. Because this skill is designed to replicate a specific author's voice and auto-collect source material, ambiguous triggers raise the risk of unintended invocation for impersonation, copyright-sensitive copying, or unapproved scraping.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file contains user-facing instructions exclusively in Chinese, and nowhere indicates that the skill is China-region-specific or that users may opt into another language. Under the policy rule for language or locale constraints, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document is written as an internal workflow entirely in Chinese and describes the skill as a Chinese writing-distillation process, without indicating that users may choose another language or locale. This can constitute a language-policy issue because the workflow implicitly fixes the interaction and output mode to Chinese without opt-in or an explicit region-specific justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill directs use of an environment-sourced third-party API key to collect external content, expanding the skill from text analysis into authenticated network access. Even if the key is not explicitly exfiltrated, this creates unnecessary secret handling and external data access risk, especially when the target account or platform input can be influenced by the user.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Earlier sections define a full 公众号采集流程 and even label article text as a supported and core source for analysis, but the blacklist later states '微信公众号...不作为来源'. This is an active contradiction in the workflow guidance, not merely omitted detail, and can cause the agent to both fetch and reject the same source type.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The workflow instructs the agent to create and install a new local skill under ~/.workbuddy/skills/, which is a state-changing filesystem action beyond passive analysis. This can be abused to persist unreviewed instructions on the host, overwrite existing skills, or plant a capability that later executes with user trust under a new persona name.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 全文以中文定义技能模板和输出要求，且未见允许用户选择其他语言或声明该模板仅适用于中文场景的说明。根据规则，强制特定语言而无用户 opt-in 的自然语言约束属于语言/locale 政策风险。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: 该模板在描述字段中给出“像[作者名]一样写”“用[作者名]的文风”等触发词，但没有说明触发边界、排除条件或负例。对于 markdown 文件，这类触发说明过于依赖自然语言表达，可能导致技能在普通写作请求中被意外匹配。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document title and description are entirely in Chinese and present the formulas as the reference source for another skill, but there is no indication that users may choose another language or that the Chinese-only scope is intentional and justified. Under the language/locale policy, forcing a single language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The README content is entirely in Chinese and does not indicate whether other languages are supported or whether Chinese is a required locale. Per the policy, forcing a specific language without user opt-in can be a natural-language policy issue unless the restriction is documented and justified.
Content: No source excerpt is available for this finding.