Smarter Content

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:37 AM UTC
• Version: 1.1.0

Overview

The skill’s writing workflow is coherent, but its scripts contain unsafe shell, URL, and HTML handling that could let crafted content or reference URLs execute commands or browser scripts.

Review before installing or using this skill on untrusted prompts, reference URLs, or Markdown. The main issue is not its content-writing purpose, but unsafe helper code: crafted article text or URLs may be able to run local commands, and exported HTML may execute scripts if opened or published. Use only after the subprocess calls are replaced with non-shell APIs, URL fetching is restricted to safe public HTTP(S) targets, and HTML export uses a real sanitizer.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/content-generator.js:94

Finding

Shell Command Injection Through Fact-Check Content

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/style-mimic.js:4

Finding

Command and JavaScript Injection Through the Reference URL

Content

View full analysis

{ console.log(JSON.stringify(result)); }); "`, { encoding: 'utf8', maxBuffer: 1024 * 1024 * 2 }); return JSON.parse(content); } catch (e) { console.error('Failed to fetch URL:', e.message); return null; } } ``` ### Technical Analysis The user-provided `url` is inserted without validation or escaping into two nested interpreter contexts: 1. A shell command passed to `execSync()`. 2. A single-quoted JavaScript string inside a `node -e` program. A crafted URL containing quote characters and JavaScript or shell syntax can terminate the intended string and inject executable instructions. This design requires separate, correct encoding for both JavaScript and shell contexts; neither is implemented. The current code imports `execSync` from `child`, which is not a standard Node.js module and normally prevents this path from running. This implementation defect reduces immediate exploitability in a normal installation but does not remove the injection vulnerability. The unsafe path becomes reachable if the import is corrected to `child_process` or if an installed package resolves the `child` module. ### Attack Path 1. An attacker provides a malicious reference URL to the style-mimic CLI or to functionality wrapping `fetchAndExtract()`. 2. The URL contains characters that terminate the single-quoted JavaScript URL literal or interfere with the surrounding shell command. 3. The application interpolates ...[truncated 778 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/style-mimic.js:6

Finding

Server-Side Request Forgery Through Unrestricted Reference URLs

Content

View full analysis

{ console.log(JSON.stringify(result)); }); "`, { encoding: 'utf8', maxBuffer: 1024 * 1024 * 2 }); return JSON.parse(content); } catch (e) { console.error('Failed to fetch URL:', e.message); return null; } } ``` ```js if (require.main === module) { const url = process.argv[2]; if (!url) { console.error('Usage: node style-mimic.js '); process.exit(1); } fetchAndExtract(url).then(result => { if (!result) { console.log(JSON.stringify({ error: 'fetch failed' })); return; } const analysis = analyzeStyle(result); const guidelines = generateStyleGuidelines(analysis); console.log(JSON.stringify({ analysis, guidelines, content: result })); }); } ``` ### Technical Analysis The program accepts a URL directly from command-line input and requests it from the Agent environment. It does not restrict URL schemes, hostnames, resolved IP addresses, ports, redirects, loopback addresses, private network ranges, link-local ranges, or cloud metadata endpoints. Consequently, the feature intended to retrieve a public reference article can be used as a server-side network request primitive. Resources that are inaccessible from the attacker's own network may be reachable from the Agent host. The current invalid `require('child')` statement ordinarily prevents execution in a standard Node.js installation. Nevertheless, the SSRF design flaw remains ...[truncated 1281 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/export.js:10

Finding

Stored Script Injection in Exported HTML Documents

Content

View full analysis

${content.split('\n')[0].replace(/^#\s*/, '')} body { max-width: 800px; margin: 0 auto; padding: 20px; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; } pre { background: #f5f5f5; padding: 10px; border-radius: 5px; overflow-x: auto; } img { max-width: 100%; } ${markdownToHtml(content)} `; fs.writeFileSync(outputPath, html, 'utf8'); console.log(`Exported HTML to ${outputPath}`); return true; } ``` ```js function markdownToHtml(markdown) { // Very basic conversion let html = markdown .replace(/^# (.*$)/gm, '

$1

') .replace(/^## (.*$)/gm, '

$1

') .replace(/^### (.*$)/gm, '

$1

') .replace(/\*\*(.*?)\*\*/g, '$1') .replace(/\*(.*?)\*/g, '$1') .replace(/\[([^\]]*)\]\(([^)]*)\)/g, '$1') .replace(/^\- (.*)$/gm, '

$1

') .replace(/^\d+\. (.*)$/gm, '

$1

'); ``` ### Technical Analysis The exporter treats input content as trusted HTML. It inserts the first line directly into the `` element and inserts the converted body directly into the HTML document without contextual escaping or sanitization. The regular-expression converter does not remove or encode existing HTML. Consequently, raw tags and event-handler attributes survive conversion. The link conversion also inserts the destination into an `href` attribute without ...[truncated 1526 chars]

Remediation

View remediation

` tags, title termination, event handlers, quoted link attributes, encoded schemes, SVG payloads, and `javascript:` links. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:111

Finding

Unpinned Remote Package Execution in Installation Instructions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Fetching and analyzing arbitrary reference URLs for style imitation is a materially different capability than simple content generation and introduces external-content ingestion risk that is not clearly declared. This can expose users to privacy issues, processing of hostile content, and unexpected network access, especially when the skill context encourages supplying third-party URLs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Fetching and analyzing arbitrary reference URLs for style imitation is a materially different capability than simple content generation and introduces external-content ingestion risk that is not clearly declared. This can expose users to privacy issues, processing of hostile content, and unexpected network access, especially when the skill context encourages supplying third-party URLs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Fetching and analyzing arbitrary reference URLs for style imitation is a materially different capability than simple content generation and introduces external-content ingestion risk that is not clearly declared. This can expose users to privacy issues, processing of hostile content, and unexpected network access, especially when the skill context encourages supplying third-party URLs.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: smarter-content
description: ✍️ 智能多平台内容生成器 - 从想法到成品一站式写作，自动适配微信/知乎/小红书/Blog 格式，内置 SEO 优化 + AI 事实核查保证准确性。
---

# ✍️ Smarter Content - 智能多平台内容生成器

从想法到成品一站式内容创作，自动适配不同平台的风格格式，内置 SEO 优化，写完自动事实核查保证信息准确。

## ✨ 特色功能

| 功能 | 说明 |
|------|------|
| 🎯 **多平台适配** | 自动适配微信公众号/知乎/小红书/个人博客/ClawHub 不同风格格式 |
| 🔍 **SEO 优化

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/style-mimic.js (reported line 71)May include surrounding context.

js

guidelines += '- 常用有序列表 (1. ) 排列步骤\n';
    }
    
    return guidelines;
}

module.exports = {

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 76% confidence

Finding

The skill advertises network-dependent behavior such as fetching reference URLs and using web search, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, this creates ambiguity about what external access the skill expects and can lead to unintended network use, data exfiltration, or execution under broader-than-necessary privileges.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description and examples present the skill as a Chinese content generator targeting Chinese platforms, but there is no explicit statement that language is configurable or user-selected. This can violate language/locale policy because it implicitly defaults users into a specific language without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill encourages users to provide reference article URLs and relies on web search, but it omits a privacy/data-use warning about sending queries and URLs to external services. In practice, users may unknowingly expose confidential topics, internal links, or proprietary research targets through these network operations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

Using npx clawhub without pinning a version introduces supply-chain risk because the installed package can change over time and may execute arbitrary code at install time. A compromised or unexpectedly updated package could run malicious scripts on the user's machine during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The platform guidelines and generated outline are written to enforce Chinese-language formatting and labels such as 微信公众号, 知乎, 小红书, 简介, and 目录, with no indication that the user can choose another language or locale. This is a natural-language policy issue because the skill appears to force a specific language context rather than offering an opt-in or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill invokes a local subprocess to fact-check generated content by constructing a shell command and executing it synchronously. In this file, the subprocess is fed with content-derived data and combined with shell execution, which expands the attack surface from pure text processing into command execution and can enable command injection or abuse of local resources if upstream input is attacker-controlled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The command string embeds untrusted content directly into a shell command: node ai-fact-checker/scripts/fact-check.js "${content...}". Escaping double quotes alone is insufficient because shell metacharacters such as backticks and $(...) remain dangerous inside double-quoted shell strings, making command injection plausible when content is user-controlled.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code constructs a shell command containing untrusted user input (url) and executes it via execSync, which introduces command-injection risk in addition to unnecessary subprocess execution. In a writing tool, spawning a shell to fetch a URL is not justified when direct library calls could perform the same task more safely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill sends user-supplied URLs to an external fetch mechanism without any visible disclosure, which can expose sensitive internal or private URLs and trigger unexpected outbound requests. In this context, the tool is explicitly content-generation related, so silent network access is more risky because users may not expect remote retrieval side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script invokes a child process with execSync to run an inline Node command, but this execution is not disclosed to the user through a prompt, log, or clear documentation. For code files, subprocess execution should not be silent unless it is clearly part of the skill's stated purpose and disclosed to the user.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The generated guideline text is hard-coded in Chinese, which imposes a specific language on users regardless of their preferences. The policy allows locale constraints only when users can opt in or when the restriction is clearly documented and justified, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The package description is written as a Chinese-language content generator description and presents the skill as targeting specific Chinese platforms without indicating that users can choose another language or locale. This may violate a language/locale policy if the skill implicitly forces Chinese output or a Chinese-platform context without explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/content-generator.js:112