Security audit

书籍插画助手(专业版)

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly for book illustration project management, but it asks for broad command, file, local-storage, and optional network integration behavior without clear enough limits.

Review this carefully before installing. It is not backed by executable code in the artifact, but if connected to a real CLI it could read and write project files, maintain local databases, store illustration assets, send notifications, and integrate with publishing systems. Use it only in a dedicated workspace, verify the CLI source separately, avoid broad project directories until scoped, and enable callbacks, email notifications, remote mode, or API synchronization only after confirming what data leaves the machine.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The skill claims operation is purely local and requires no extra API keys, yet other sections describe callback URLs, email-like notifications, and optional integration with external publishing systems. This inconsistency can mislead users into exposing project data over the network without informed consent or appropriate controls.

Intent-Code Divergence

Low

Confidence: 73% confidence
Finding: The security section advises configuring API keys via environment variables, while the dependency section says no extra API key is required. This is not directly exploitable by itself, but it creates ambiguous operator expectations and can lead to unsafe ad hoc secret handling when integrations are later enabled.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation condition includes broad phrases such as improving efficiency, automation, batch processing, and workflow optimization, which overlap with many unrelated user requests. In an agent environment with exec capability, this can cause the skill to activate unexpectedly and steer tasks into filesystem or command-execution flows the user did not specifically request.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The scope keyword list is excessively expansive and includes generic terms that are not tightly bound to book illustration management. Overbroad matching increases unintended invocation risk, especially because the skill advertises file operations, search, and command execution capabilities.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The markdown describes writing outputs such as plans and reports to local directories, but does not clearly warn users that local files and project state may be created or modified. In an agent with read/write and exec-style behavior, silent local modification can affect existing project data and reduce user control.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The input format includes a callback_url for asynchronous completion notifications, but there is no clear privacy or transmission warning explaining that task data or metadata may be sent to an external endpoint. This can lead to unintentional disclosure of sensitive publishing project details.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The example showing reminder notifications to an email address implies external transmission of project metadata, deadlines, or status information, but the documentation does not clearly disclose that such information may leave the local environment. For publishing workflows, this may expose schedules, contributor identities, or project names.

Static analysis

No suspicious patterns detected.