Security audit

xiangsheng-writer

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese crosstalk writing skill with low-risk local file output and no evidence of hidden execution, data access, or persistence.

Install this if you want a Chinese xiangsheng-focused writing workflow. Be aware it may be triggered by broad comedy-writing prompts and that completed scripts may be saved locally under `xiangsheng/`; review generated content for style, originality, and appropriateness before public use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The README states that the skill should auto-trigger on very broad, everyday phrases such as '写段相声', '编个段子', and '把 XX 写成相声'. In an agent environment, overly broad triggers can cause unintended activation, hijack ordinary conversations, and route unrelated user input into this skill, which is a prompt-scope and control-flow weakness even though the skill itself is not inherently harmful.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill advertises broad trigger phrases such as '写段相声', '编个段子', and '把这段话写成相声', which can overlap with ordinary user requests outside a deliberate skill invocation flow. This can cause unintended activation or routing, leading the agent to apply this skill in contexts where the user did not explicitly opt into its workflow or stylistic constraints.

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The entire skill reference is written exclusively in Chinese and provides no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. Under the policy, natural-language files that impose a language/locale without opt-in can be a policy violation.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The entire skill file is written in Chinese and provides no indication that language choice is optional or that the locale restriction is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: The defaults specify "京味或中性普通话" as the style, which imposes a language/locale preference by default. Although alternatives are listed, the file sets a default regional/linguistic style rather than clearly obtaining user opt-in first.

Description-Behavior Mismatch

Low

Confidence: 93% confidence
Finding: The manifest describes the skill as helping users write, revise, and diagnose xiangsheng scripts through a guided creative process. In SKILL.md, the delivery step additionally directs the agent to persist the script to `xiangsheng/<主题>-<日期>.md`, which is a concrete file-write behavior not stated in the manifest description.

Static analysis

No suspicious patterns detected.