T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_xiaohongshu.py:12- Finding
Synthetic sample records are represented as freshly collected platform data
- Content
View full analysis
- Remediation
View remediation
Security audit
运营工具skill
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly fits a social-media operations purpose, but it delegates logged-in account control to unverified external tools and can present synthetic sample data as real platform collection.
Review this skill carefully before installing. Use a dedicated low-privilege browser profile, avoid production accounts until publish controls are added, require explicit approval before every live post or account action, verify external OpenCLI and ima-skill downloads yourself, and treat bundled collector outputs as demo data unless real provenance is added.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T08 · Insecure Dependencies
Error
- Location
references/OPENCLI.md:3- Finding
Unpinned external repository installation delegates execution to mutable remote content
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
references/IMA_KNOWLEDGE.md:3- Finding
External IMA Skill archive is installed and configured with an API key without integrity verification
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:218- Finding
Authenticated browser-session integration exposes publishing operations without a mandatory final approval gate
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (72)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个功能范围很广的全链路新媒体运营技能，但当前提供的代码块只实现了其中很小的一部分——行业分析。它通过子脚本抓取平台内容数据，做基础关键词提取、互动指标计算、爆款识别，并输出报告。这与声明中的多个核心能力（竞品分析、养号、内容创作、互动设计、监控、PPT解析、知识库/浏览器/违禁词等集成能力）不一致。虽然“行业分析报告”属于声明范围的一部分，但声明的整体用途明显宽于代码实际行为，且平台声明中提到视频号，代码却使用微博，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向新媒体运营的综合业务技能，重点在分析、策略制定、内容生成与平台运营闭环；而给出的代码仅完成离线数据预处理工作，功能集中在文本清洗、垃圾过滤、相似度去重、文件合并与结果导出。这种数据清洗可以作为某些上游/下游流程的辅助组件，但并不能支撑所宣称的主要能力，也没有体现触发场景中提到的运营方案生成、竞品账号分析、养号、内容创作、互动设计等核心行为。因此该描述与代码实际行为存在明显且实质性的不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
描述声明的是一个面向新媒体运营的综合技能，应具备分析、内容生成、账号运营、互动设计以及外部工具集成等完整能力。但给出的代码只是一个本地 CLI 工具，通过关键词匹配区分“physical/service”需求，再依据固定配置分配各平台的数据量，没有任何行业/竞品分析、内容创作、账号养号、互动设计或监控逻辑，也没有调用浏览器、搜索、知识库或违禁词检测能力。其主用途与声明严重不符，因此应判定为明显 mismatch。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个广泛的新媒体运营综合技能，而提供的代码块只对应其中很小的一项子功能——内容违禁词检测。代码没有任何行业研究、竞品抓取分析、账号运营策略生成、内容创作、互动设计、浏览器自动化、网络访问或知识库调用逻辑，主用途与声明的主要用途存在明显差异。虽然声明中提到了“违禁词检测”，但该代码不足以支撑“完整运营闭环”这一整体描述，因此应判定为描述与实际行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是面向新媒体平台运营策划与执行的一体化技能，重点在品牌账号运营、竞品监控、内容创作和互动设计；而代码仅实现了基于关键词的需求分类、痛点抽取和情绪统计，属于用户反馈/评论类文本分析工具。两者的主要目的、能力边界和所需资源均明显不一致。代码没有任何浏览器操作、联网搜索、知识库调用、违禁词检测、账号运营或内容生成逻辑，因此应判定为明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个覆盖多阶段、多平台的新媒体运营综合技能，但提供的代码块只是一个单一用途的 Python 脚本。它接受关键词和数量参数，构造固定的抖音评论样例列表，附带简单情感字段，然后写入 JSON 文件。代码中没有真实网络请求，也没有浏览器控制、搜索、知识库调用、竞品/行业分析逻辑、内容生成逻辑或运营策略制定逻辑。其主功能更接近“导出抖音评论示例数据”，与声明的主要目的存在明显且实质性的偏差，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是面向社交媒体平台账号运营的一整套运营技能；而代码仅构造固定样例差评并保存为 JSON，本质上是电商评论数据导出脚本。其主要目的、目标平台、触发场景和能力边界都与声明显著不一致，属于明显的描述-行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明描述的是一个面向多平台的新媒体运营综合技能，强调分析、策划、创作和运营闭环，并提及多种外部能力接入。实际代码却只是一个单文件Python脚本，接收关键词后生成固定模板的“视频号评论”样例数据并保存为JSON。它既没有真实网络抓取逻辑，也没有浏览器操控、搜索、知识库调用、违禁词检测、竞品监控、内容生成等实现。代码的主要用途与声明的核心能力存在明显偏差，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a comprehensive new media operations capability spanning strategy, analysis, content creation, and account operations across several platforms. The supplied code instead is a narrow utility script for producing and exporting topic-based Weibo comment records. It does not implement the core declared workflows or integrations, and even targets a different platform than those emphasized in the description. This is a material description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
描述与代码行为存在明显且实质性的偏差。声明描述的是一个多平台、全流程的新媒体运营技能，而提供的代码只是一个本地 CLI 脚本，用固定样本生成最多 100 条带情感标签的小红书评论并写入 JSON。其主要目的既不是完整运营闭环，也不是行业/竞品分析或内容生成。虽然“监控对标账号”或“分析评论舆情”可以间接与评论数据有关，但当前代码既未真实访问小红书资源，也未进行分析，仅生成模拟数据，因此不能认为与声明基本一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个范围很广的新媒体运营综合技能，核心卖点包括分析、监控、内容策略制定和外部工具能力集成；但提供的代码块仅实现了“互动钩子设计”中的一个很小子集：基于静态模板生成互动话术。虽然声明中包含“互动钩子设计”，这部分与代码一致，但代码的主要行为远不足以支撑“全链路运营闭环”的整体描述，也没有任何外部资源访问或平台相关操作。因此描述显著夸大了实际能力，属于明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
该代码的核心行为非常单一：从输入JSON读取 summary、prioritized_demands、analysis 等字段，生成一份“用户需求调研报告”Markdown，并写入文件。虽然模板中提到小红书、抖音、微博、电商平台等来源，但这些只是静态文本描述，并无真实抓取、分析平台账号、制定新媒体内容策略或执行运营动作的逻辑。声明描述的是一个覆盖新媒体运营全流程的综合技能，包含外部资源访问和平台运营能力；而实际代码只是离线文本报告格式化工具，功能范围和主用途均明显不一致，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The declared description presents a broad end-to-end new media operations skill covering analysis, planning, account growth, content generation, and engagement design. This code chunk, however, is narrowly focused on monitoring competitor accounts for new posts and viral content, generating alerts, and maintaining monitoring state. While '监控对标账号' and some competitor-analysis adjacency are mentioned in the description, the supplied code does not implement most of the claimed skill scope or the named tool integrations. Its actual primary purpose is periodic competitor monitoring, which is only a subset of the declared functionality and materially different from the advertised full-chain operations capability.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向新媒体运营的综合技能，预期应包含平台运营分析、内容生成或外部资源调用等能力；但代码仅实现了对输入需求数据的分组、优先级计算、排序和 JSON 保存。其输入输出结构、算法逻辑和命令行参数都表明这是“需求分级与优先级排序”工具，和所声明的新媒体运营场景存在显著主功能偏差。代码也没有访问浏览器、联网、知识库或违禁词检测资源，因此描述与实际行为明显不符。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向新媒体运营决策与内容生产的综合技能，核心能力应包括分析、策略制定、内容生成以及外部工具调用。代码却只是一个数据验证工具，主要对输入数据做数量、质量、重复、平台覆盖检查，并输出报告。两者主目的明显不同：前者是运营执行/分析闭环，后者是数据清洗前的质量验收。虽然“平台覆盖”与“数据”概念可能可作为运营分析前置环节，但该代码不足以支撑所宣称的大部分能力，且没有任何浏览器、搜索、知识库或内容创作相关实现，因此属于明显不匹配。
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill advertises browser-driven collection, account publishing, and knowledge-base storage without any up-front warning about privacy, session access, or external data handling. In this context, those actions can expose logged-in account data, perform unintended actions on third-party platforms, and store sensitive business information externally without informed consent.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction to run
opencli listand record which platforms have active login state implicitly inventories sensitive browser session access, but gives the user no warning about what account/session information may be exposed. Because this skill targets social-media accounts, knowing and using existing authenticated sessions materially raises the risk of unauthorized account interaction or data access.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The knowledge-base setup section instructs users to obtain and configure an API key and save operational data, but does not warn about credential sensitivity or that collected content may be transmitted to external services. This can lead to accidental key exposure and unintentional storage of confidential brand, customer, or competitor information.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill includes direct publication commands for third-party platforms but does not require an explicit confirmation checkpoint immediately before posting. In an account-automation context, this creates a real risk of accidental or unauthorized publication, reputational damage, policy violations, or misuse of a logged-in brand account.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill clearly instructs use of shell commands, local file reads, and writes, but does not declare any explicit tool scope or permission boundaries. This creates unnecessary ambient authority: an agent could execute commands or access local files beyond what users reasonably expect, increasing the chance of unsafe data access or side effects.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases are broad enough to match many ordinary requests, increasing the chance the skill activates unexpectedly in contexts where users did not intend account automation, web scraping, or publication workflows. Overbroad activation is risky here because the skill includes sensitive data collection and account-affecting operations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest advertises scope limited to Douyin, Xiaohongshu, and WeChat Video, but the bundled scripts also include Weibo and e-commerce review collection. This mismatch weakens transparency and policy enforcement because reviewers, users, or automated controls may not realize the skill can access and process additional data sources beyond the declared scope.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description is extremely broad and covers end-to-end media operations, monitoring, content generation, and account warm-up without clear activation boundaries. Overbroad scope increases the chance that the agent is invoked for higher-risk actions than the user intended, including scraping, monitoring, or potentially policy-sensitive growth tactics.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The natural-language description and script labels are entirely in Chinese and are tailored to Chinese social platforms, but the manifest does not state that the skill is region-specific or that language choice is optional. This can violate language/locale policy when a skill effectively constrains interaction to one language without explicit user opt-in or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document presents all instructions in Chinese and does not indicate that the user can choose another language or that the skill is intended only for a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.