Security audit

多平台复刻蒸馏写作技能

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: collects or accepts writing samples, analyzes style, and creates a local writing-persona skill, with some user-impacting behavior users should understand first.

Install this only if you are comfortable using a RedFox API key, spending any associated platform credits, and creating local persona skills. Use it on your own writing or content you are authorized to analyze, and ask the agent to show the target ~/.workbuddy/skills path before creating or updating a persona.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill prominently advertises automatic collection of third-party content from WeChat Official Accounts and Douyin, but does not give a clear upfront warning about collecting external content, associated permissions, copyright/privacy concerns, or platform terms restrictions. This can lead users to unknowingly initiate scraping or ingestion of third-party material, increasing legal, privacy, and policy-compliance risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README advertises automatic collection from public platforms and automatic installation of a local sub-skill, but it does not prominently warn about privacy, copyright/consent boundaries, or the effects of writing artifacts into the local environment. In this skill’s context, that increases the chance users will trigger collection of third-party content or local changes without understanding data-handling and system-impact implications.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger list includes very broad phrases such as “分析文风”, “复制文风”, and “复刻XX”, which can overlap with ordinary writing or analysis requests and cause unintended activation. In this skill’s context, accidental triggering is more dangerous because the documented behavior includes automatic content collection and installation of a local sub-skill, expanding the effect of a simple misfire beyond a normal text response.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: Telling users they can ‘directly describe the need in natural language’ without clear activation boundaries makes the skill callable from ambiguous everyday requests. Because this skill claims side-effecting behavior such as auto-fetching platform content and installing a local sub-skill, vague invocation rules increase the risk of unintended data access or persistent local changes.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill advertises automatic collection from public platforms and installation of a generated local sub-skill, but it does not clearly warn users about privacy implications, copyright/data provenance concerns, or the effect of making persistent local changes. In context, this materially increases risk because the user may not realize that third-party content will be fetched or that the environment will be modified as part of normal use.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The workflow allows external platform collection to begin when a user mentions a platform name or account identifier, while API calls consume paid credits and may fetch third-party data. Without a mandatory explicit confirmation gate immediately before network collection, an agent could trigger billable and privacy-sensitive actions from ambiguous user input, causing unintended spend and data retrieval.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The workflow instructs the agent to create or modify files under ~/.workbuddy/skills/[作者名]-style/SKILL.md without a user-facing warning or consent step. Silent filesystem writes are dangerous because they persist generated content locally, may overwrite existing user data, and expand the agent's side effects beyond what the user may expect from a text-analysis skill.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The update flow modifies an existing SKILL.md in place and instructs incremental updates without an explicit overwrite warning, backup, or approval step. In-place modification of local configuration/skill files can unintentionally destroy prior content, introduce corrupted state, or let a user trigger persistence changes they did not clearly authorize.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The template is written entirely in Chinese and structurally assumes Chinese-language output, which can force a language/locale choice onto downstream generated sub-skills without explicit user opt-in. In a style-cloning skill, this can mis-handle user intent, reduce accessibility, and cause generated personas or content to ignore the user's preferred language or regional conventions.

Static analysis

No suspicious patterns detected.