博客写作助手基础版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:36 AM UTC
• Version: 1.0.3

Overview

The skill is a blog-writing assistant, but it asks for broad agent tools and includes unclear network/API, credential, and automatic-execution behavior that users should review before installing.

Review this skill before installing. Use it only if you are comfortable with a Chinese-language blog-writing workflow that may edit files, run shell commands, and use external APIs. Avoid running its generic environment-variable scan, and require explicit approval before any Bash command, file write, callback_url use, or external API call involving drafts, links, samples, or credentials.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:157

Finding

Unnecessary Enumeration of Credential-Related Environment Variables

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 157
Vulnerability Type: Unnecessary access to process environment data
Risk Level: Low

bash

env | grep -E "API|KEY|TOKEN|SECRET" | sed "s/=.*/=***/"  # Linux/macOS

Technical Analysis

The skill recommends executing env, which enumerates the Agent process's complete environment before filtering for variable names associated with API keys, tokens, and secrets. Although the final sed operation masks variable values in displayed output, the command still accesses the complete environment and reveals which credential-related variables are available.

Environment reconnaissance is not necessary for the skill's stated blog-writing functionality. The skill also declares access to the Bash tool, meaning an Agent following these instructions could execute the command in a host environment containing unrelated credentials. This violates the principle of least privilege.

No instruction that transmits the discovered information to an external party was identified. The provided pipeline also does not directly display secret values, so the immediate exposure is limited primarily to credential variable names and the existence of configured credentials.

Attack Path

1. A user activates the blog-writing skill in an Agent with shell access.
2. The Agent follows the environment-validation instructions in SKILL.md.
3. The Agent executes the supplied pipeline using the declared Bash capability.
4. The env process reads all environment variables available to the Agent.
5. The pipeline identifies credential-related variables and displays their names while masking their values.
6. The resulting credential inventory could provide reconnaissance for a subsequent attack if combined with another command-injection, prompt-injection, or data-exfiltration mechanism.

Impact Assessment

The command operates with the environment-access privileges of the Ag ...[truncated 555 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the broad env enumeration command from the configuration-validation instructions.
2. If a specific API credential is genuinely required, check only that explicitly named variable without printing its value. For example, use a platform-appropriate existence test that returns only a boolean status.
3. Document every required environment variable by exact name rather than searching for generic patterns such as KEY, TOKEN, or SECRET.
4. Remove the Bash tool from the skill's declared tools unless shell execution is essential to its core functionality.
5. If shell access must remain available, restrict execution to a minimal allowlist of commands and prevent user-supplied text from being interpolated into shell commands.
6. Ensure logs and Agent responses never include environment-variable values or unnecessary credential metadata.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document states that all FREE-version data is stored locally and not uploaded, but elsewhere it describes external API access and network-dependent features. This creates a deceptive privacy boundary: users may provide sensitive drafts, links, or credentials under the false assumption that nothing leaves the machine, which can lead to unintended disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The display name and nearly all user-facing instructions are presented in Chinese, while no opt-in or language selection mechanism is described. For a general-purpose writing skill, this can violate language/locale policy expectations if users are not given a choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The description at L008 says the skill is not suitable for pure technical documentation. However, the documented scenario at L107-L109 specifically describes generating a technical article from a topic and research links, which is a contradictory intent statement within the skill documentation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation language is very broad, covering common writing and title-optimization requests, which increases the likelihood that the skill is invoked unintentionally. In an agent environment with Write/Edit/Bash tools available, accidental activation can expand tool access and cause unintended file modification or external calls in contexts where the user only wanted generic assistance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill says the agent will automatically parse natural-language requests, call tools or APIs, execute operations, and return results without defining strict trigger conditions. This ambiguity is risky because normal conversation could be interpreted as authorization to run tools, leading to unintended command execution, file writes, or network interactions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The FREE tier is described as not supporting batch processing, yet the performance section advertises batch handling of 100 files. Such contradictory capability claims can cause operators to enable or attempt unsupported bulk workflows, increasing the chance of unintended large-scale data processing or accidental overexposure of content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.