Security audit

Aicwos

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed copywriting and knowledge-management pipeline, but it grants broad persistent write/delete authority and has unsafe path and remote-sync handling that can overwrite or remove files outside the intended workspace.

Review before installing. This skill is designed to store and manage copywriting work, lecturer samples, profiles, knowledge documents, and series state on disk and in SQLite. Only use it in a dedicated workspace with non-sensitive content, avoid untrusted cloud knowledge URLs or imported lecturer packages, and do not rely on it for temporary drafting unless you are comfortable with automatic persistence and deletion behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:11
Finding: Skill-Wide Instruction Hijacking Forces Unrequested Retrieval and Persistent Storage
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/knowledge_sync.py:111
Finding: Remote Manifest Path Traversal Enables Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: scripts/core/knowledge_service.py:175
Finding: Untrusted Cloud Knowledge Is Injected into Mandatory Agent Context
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/core/copywriting_service.py:30
Finding: Lecturer, Series, and Sample Identifiers Permit Filesystem Path Traversal
Content: View full analysis
Optional[Path]: if not self.data_dir: return None plan = self.get_series_plan(series_id) if not plan: return None lid = plan["lecturer_id"] return self.data_dir / "讲师列表" / lid / "系列文案" / series_id ``` Episode titles are used directly as filenames: ```python ep_dir.mkdir(parents=True, exist_ok=True) filename = f"E{episode_num:02d}_{title}.txt" (ep_dir / filename).write_text(content, encoding="utf-8") ``` Lecturer and sample identifiers are also used directly: ```python lec_dir = self.data_dir / "讲师列表" / lecturer_id lec_dir.mkdir(parents=True, exist_ok=True) (lec_dir / "profile.json").write_text( json.dumps(profile, ensure_ascii=False, indent=2), encoding="utf-8" ) ``` ```python samples_dir = self.data_dir / "讲师列表" / lecturer_id / "样本" samples_dir.mkdir(parents=True, exist_ok=True) (samples_dir / sample_name).write_text(content, encoding="utf-8") ``` Deletion moves an identifier-derived directory and may recursively remove a pre-existing destination: ```python lec_dir = self.data_dir / "讲师列表" / lecturer_id dest = trash_dir / lecturer_id if dest.exists(): shutil.rmtree(dest) shutil.move(str(lec_dir), str(dest)) ``` The CLI forwards `--id`, `--lecturer`, and JSON-provided `sample_name` without path validation. ### Technical Analysis The code assumes identifiers are safe path components, but neither the CLI nor service layer rejects separators, absolute paths, parent-directory components, or platform-specific path syntax. A crafted lecturer ID or series ID containing `. ...[truncated 2045 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/db_query.py:129
Finding: Caller-Selected Staging Files Are Deleted Without Workspace Containment
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/core/semantic_model.py:270
Finding: Downloaded ONNX Model Is Loaded Without Integrity Verification
Content: View full analysis
bool: try: import urllib.request import shutil if desc: print(f"Downloading {desc}...", file=sys.stderr) dest.parent.mkdir(parents=True, exist_ok=True) tmp_path = dest.with_suffix(dest.suffix + ".tmp") try: with urllib.request.urlopen(url, timeout=300) as resp: total = resp.headers.get("Content-Length") if total: total = int(total) with open(tmp_path, "wb") as f: shutil.copyfileobj(resp, f) tmp_path.rename(dest) return True ``` The source list includes multiple independently controlled origins: ```json { "sources": [ { "name": "HF-Mirror", "base_url": "https://hf-mirror.com/shibing624/text2vec-base-chinese/resolve/main", "path_type": "repo" }, { "name": "Tencent Cloud COS", "base_url": "https://tools-1307431188.cos.ap-chongqing.myqcloud.com/model", "path_type": "flat" }, { "name": "HuggingFace", "base_url": "https://huggingface.co/shibing624/text2vec-base-chinese/resolve/main", "path_type": "repo" } ] } ``` The downloaded model is later passed to ONNX Runtime: ```python self.session = ort.InferenceSession( str(model_path), sess_options=opts, providers=["CPUExecutionProvider"], ) ``` ### Technical Analysis TLS protects transport to the selected host but does not establish that the returned model is the reviewed model version. A compromised upstream r ...[truncated 2090 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (55)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims to support copywriting, style learning, knowledge access, and series progress in user conversations, yet the described behavior aligns more with migration/import/export and synchronization utilities. That mismatch increases the chance that an agent invokes a privileged data-management tool during routine conversation, exposing data or mutating state far beyond what the user intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims to support copywriting, style learning, knowledge access, and series progress in user conversations, yet the described behavior aligns more with migration/import/export and synchronization utilities. That mismatch increases the chance that an agent invokes a privileged data-management tool during routine conversation, exposing data or mutating state far beyond what the user intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims to support copywriting, style learning, knowledge access, and series progress in user conversations, yet the described behavior aligns more with migration/import/export and synchronization utilities. That mismatch increases the chance that an agent invokes a privileged data-management tool during routine conversation, exposing data or mutating state far beyond what the user intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims to support copywriting, style learning, knowledge access, and series progress in user conversations, yet the described behavior aligns more with migration/import/export and synchronization utilities. That mismatch increases the chance that an agent invokes a privileged data-management tool during routine conversation, exposing data or mutating state far beyond what the user intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill claims to support copywriting, style learning, knowledge access, and series progress in user conversations, yet the described behavior aligns more with migration/import/export and synchronization utilities. That mismatch increases the chance that an agent invokes a privileged data-management tool during routine conversation, exposing data or mutating state far beyond what the user intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims to support copywriting, style learning, knowledge access, and series progress in user conversations, yet the described behavior aligns more with migration/import/export and synchronization utilities. That mismatch increases the chance that an agent invokes a privileged data-management tool during routine conversation, exposing data or mutating state far beyond what the user intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill claims to support copywriting, style learning, knowledge access, and series progress in user conversations, yet the described behavior aligns more with migration/import/export and synchronization utilities. That mismatch increases the chance that an agent invokes a privileged data-management tool during routine conversation, exposing data or mutating state far beyond what the user intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill claims to support copywriting, style learning, knowledge access, and series progress in user conversations, yet the described behavior aligns more with migration/import/export and synchronization utilities. That mismatch increases the chance that an agent invokes a privileged data-management tool during routine conversation, exposing data or mutating state far beyond what the user intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims to support copywriting, style learning, knowledge access, and series progress in user conversations, yet the described behavior aligns more with migration/import/export and synchronization utilities. That mismatch increases the chance that an agent invokes a privileged data-management tool during routine conversation, exposing data or mutating state far beyond what the user intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims to support copywriting, style learning, knowledge access, and series progress in user conversations, yet the described behavior aligns more with migration/import/export and synchronization utilities. That mismatch increases the chance that an agent invokes a privileged data-management tool during routine conversation, exposing data or mutating state far beyond what the user intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill claims to support copywriting, style learning, knowledge access, and series progress in user conversations, yet the described behavior aligns more with migration/import/export and synchronization utilities. That mismatch increases the chance that an agent invokes a privileged data-management tool during routine conversation, exposing data or mutating state far beyond what the user intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims to support copywriting, style learning, knowledge access, and series progress in user conversations, yet the described behavior aligns more with migration/import/export and synchronization utilities. That mismatch increases the chance that an agent invokes a privileged data-management tool during routine conversation, exposing data or mutating state far beyond what the user intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims to support copywriting, style learning, knowledge access, and series progress in user conversations, yet the described behavior aligns more with migration/import/export and synchronization utilities. That mismatch increases the chance that an agent invokes a privileged data-management tool during routine conversation, exposing data or mutating state far beyond what the user intended.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill declares itself mandatory for very broad, common phrases such as general requests to write copy, scripts, learn lecturer style, continue a series, or inspect knowledge. Overbroad triggers are dangerous because they can hijack normal conversations, force use of a stateful and mutating tool, and increase the probability of unnecessary file/database writes or deletions in response to routine user prompts.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: --query-file causes the program to read arbitrary local files before request processing, with no restriction that the file be a safe temporary input from the skill workspace. In an agent context, this can be abused to exfiltrate sensitive file contents by loading unexpected files and then surfacing parse errors, downstream content, or side effects through the tool output.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script requires a user-supplied --data-dir and later uses it for recursive enumeration and service operations without constraining it to a trusted base path. In an agent environment, an attacker could point the tool at arbitrary local directories to inspect their contents or operate on unintended data stores, creating a clear local file disclosure and boundary-bypass risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill advertises and documents capabilities that involve file reads, file writes, and network-backed synchronization, but it does not declare any explicit tool scope or allowed-tools boundary. That creates a governance gap: reviewers and runtime policy engines cannot easily constrain what the skill may access, increasing the risk of unintended filesystem traversal, persistent writes, or remote data sync during normal use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description does not clearly and prominently warn users that their content, lecturer samples, profiles, and series outputs may be persistently written to both a database and the filesystem. This is dangerous because users may provide sensitive drafts or private materials expecting ephemeral assistance, while the workflow insists on automatic save operations and write-through persistence.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger table uses broad categories like Copywriting, Lecturer, Series, Revision, Knowledge, and Management without enough limiting conditions. In the context of a skill that can read/write local files, sync data, and delete content, coarse activation categories increase the risk of overreach and misuse for requests that do not actually need privileged operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire specification is written only in Chinese and presents the format as a mandatory standard, with no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. This can violate language/locale policy where skills should not force a specific language without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The workflow instructs the agent to delete existing episode data and the corresponding .txt file before saving revisions, but it does not require explicit user confirmation or a safety interlock before performing the destructive action. In a copywriting skill with persistent storage, this creates a real risk of unintended data loss from ambiguous user requests, wrong episode selection, or automated execution errors.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The workflow documents a destructive delete operation for lecturer data and describes recovery as a separate manual process, but it does not instruct the agent to obtain explicit confirmation, warn about data loss scope, or clearly state recovery limitations. In a skill that manages persistent lecturer profiles, samples, and series assets, this increases the risk of accidental or overbroad deletion of sensitive business content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The delete_episode method deletes both database metadata and the corresponding .txt file via unlink(), but there is no confirmation prompt, warning log, or other visible user disclosure before the destructive action. Because this operation permanently removes user-authored content, it is safety-relevant and should be explicitly disclosed or gated.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring states that every data change updates both DB and filesystem and describes a write-through architecture. However, the add_doc docstring says this method 'only indexes' and 'does not write files back', so the documented architecture claim is contradicted by actual add behavior, with only delete performing filesystem cleanup.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest describes mandatory support for lecturer profile access, style learning, series continuity/progress, and copywriting workflow persistence. In this file, the implemented behavior is limited to storing, deleting, listing, and searching knowledge-base documents and chunks, with no code for lecturer profiles, style replication, series progress tracking, or script generation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.