Security audit

Writing Pipeline

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed writing workflow skill, but its publish stage can upload article assets to external services and rewrite local article files.

Install this only if you want an agent-assisted writing and publishing pipeline. Before using the Publish stage, review the target article directory, the images to be uploaded, and the intended platforms; avoid using it on confidential, licensed, or unpublished-sensitive material unless you are comfortable sending assets to R2 and WeChat. Approve writing-style skill updates only when the proposed rules clearly reflect your preferences.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill expands from a writing pipeline into external social-media collection by fetching tweet contents and performing X searches. That creates unnecessary data egress and unbounded retrieval behavior relative to the manifest, increasing privacy, integrity, and prompt-injection risk from untrusted third-party content.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The documented publish flow uploads article images and derived assets to third-party services such as R2 and WeChat, then rewrites source content to point at those external URLs. This is a material capability expansion beyond formatting output and can leak unpublished or sensitive content while mutating canonical files in ways the user may not expect.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The quick commands are very broad phrases like '发布' and '开始新文章', which can easily appear in normal conversation and accidentally trigger workflow transitions. In this skill, accidental activation is more dangerous because later stages perform file mutations, asset uploads, and multi-platform distribution steps.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill sends article text, images, infographics, and covers to external services including storage and platform upload tools without an upfront user warning. Because the content may be drafts or private materials, the lack of informed consent creates a significant confidentiality and compliance risk.

Static analysis

No suspicious patterns detected.