Security audit

公众号复刻蒸馏写作

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly coherent, but it should be reviewed because it can use a third-party API and create or update persistent local agent skills.

Install only if you are comfortable giving the skill access to a RedFox API key, allowing it to fetch platform content, and letting it create or update local persona skills. Prefer manually pasted or clearly authorized materials, review any generated SKILL.md before installation, and keep backups before updating existing personas.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The workflow instructs the agent to create a new installed skill under ~/.workbuddy/skills, which is a persistent local file write that changes the user's agent environment. Persistent skill installation is more dangerous than ephemeral text generation because it can plant future-executing instructions or overwrite trusted local automation without an explicit consent gate.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill directs authenticated third-party API access using an environment-sourced API key and user-supplied account identifiers. This creates data exfiltration and external-action risk because the agent may transmit identifiers and retrieve content from an external service without a strong trust boundary, explicit consent flow, or minimization controls.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The README states the skill can be used by simply describing needs in natural language, without narrowing accepted intents or defining boundaries. For a skill that can collect platform content, read pasted material, and operate on specified file paths, overly broad invocation increases the chance of unintended activation, misuse on sensitive local content, or execution in contexts the author did not explicitly constrain.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The example trigger phrases are generic requests like analyzing articles, writing in a target style, and updating a persona, but they do not specify authorization, source restrictions, or safety boundaries. In this skill's context, that ambiguity can enable misuse such as cloning non-consenting authors, scraping content broadly, or steering the skill to process arbitrary data under a seemingly valid trigger.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger list is extremely broad and includes generic phrases like '分析文风' and '写作风格分析' that can overlap with ordinary writing-assistance requests. This increases the chance of unintended activation, which can cause the agent to pull external content, analyze user-supplied paths, or initiate cloning-style workflows when the user only intended a normal writing task.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The instruction that users can 'directly use natural language descriptions without remembering commands' makes activation boundaries ambiguous and encourages the skill to interpret broad user input as permission to run. In this skill's context, that is more dangerous because the described behavior includes automatic article collection and processing of pasted content or specified file paths, so accidental invocation could lead to unintended data access or external fetching.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The workflow describes automatic platform collection but does not clearly warn that account identifiers and retrieved content will be sent to a third-party API. That weakens informed consent and privacy transparency, making it easy for users to trigger data transmission they may not expect.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The instructions tell the agent to write SKILL.md files into the user's home directory without an explicit warning or consent gate. Silent local writes are dangerous because they create persistent artifacts that may later be trusted or executed by the surrounding agent ecosystem.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The update flow modifies an existing SKILL.md in place without clearly warning the user that a local trusted file will be edited. In-place modification of persistent agent instructions can alter future behavior and may overwrite prior customizations or introduce unsafe logic without adequate review.

Static analysis

No suspicious patterns detected.