首席创意官助手-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.3

Overview

This looks like a creative-planning skill, but it requests command execution and file-write authority without a clear need or tight limits.

Review before installing. The artifact does not show malware, persistence, or data exfiltration, but it asks for powerful local capabilities that are not clearly needed for creative strategy work. Install only if your host can deny or tightly sandbox exec/write access, and avoid using it around sensitive files or credentials unless those permissions are removed or explicitly controlled.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Excessive and Inconsistent Tool Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5 and SKILL.md:17-20
Vulnerability Type: Excessive tool privileges and inconsistent access-control declarations
Risk Level: Medium

Vulnerable Configuration

yaml

allowed-tools: read exec

yaml

tools:
  - exec
  - read
  - write

Technical Analysis

The Skill is described as a text-based assistant for producing creative strategies, visual-style guidance, and marketing concepts. These ordinary functions do not require arbitrary command execution or unrestricted filesystem access.

Nevertheless, the configuration declares exec, read, and write capabilities. The permission declarations are also inconsistent: write appears in the tools list but is absent from allowed-tools. Depending on how the hosting Agent resolves this discrepancy, it may grant the broader permission set or behave unpredictably.

The document also claims command execution, API integration, and general file-processing capabilities near SKILL.md:207-210, but it does not define enforceable command allowlists, permitted filesystem paths, destination allowlists, write confirmation requirements, or sandbox boundaries. Merely advising that only allowlisted commands should be used does not implement such a control.

No instruction in the reviewed file directly attempts to abuse these privileges. The issue is a violation of least privilege that unnecessarily expands the consequences of prompt manipulation or unsafe host behavior.

Attack Path

1. A hosting Agent loads the Skill and interprets one or both tool declarations.
2. The platform grants filesystem or command-execution capabilities to the Skill.
3. Untrusted task content, indirect prompt injection, or an unsafe generated action induces the Agent to invoke one of those tools.
4. The Agent reads files unrelated to the creative task, modifies workspace content, or executes a system command.
5. Any ac ...[truncated 916 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec, read, and write from the Skill because its documented creative-planning workflow only requires text generation.
2. Maintain one authoritative tool-permission declaration to eliminate inconsistent permission resolution.
3. If file access is later required, restrict reads to files explicitly selected by the user and constrain access to a dedicated workspace directory.
4. Require explicit user confirmation before every write, overwrite, deletion, or operation affecting files outside generated-output directories.
5. Avoid exposing a general-purpose exec tool. If command execution becomes essential, replace it with narrowly scoped operations using fixed executables and argument validation.
6. Enforce command, path, environment-variable, and network-destination allowlists at the platform level rather than relying on documentation.
7. Run the Skill under a sandboxed, low-privilege process without access to unrelated credentials, personal files, or host-level resources.
8. Add tests that verify denied access to paths and tools outside the Skill's legitimate operational scope.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The activation text is overly broad, effectively positioning the skill for generic AI model calling, agent orchestration, and LLM applications rather than a narrow creative-planning use case. In combination with privileged tools, this broad trigger surface increases the likelihood that the skill is invoked in unrelated contexts where its capabilities can be abused or where users do not expect tool use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Command execution is not justified by the stated function of generating creative strategy and marketing ideas. Granting exec to a largely conversational skill creates unnecessary attack surface: prompt injection or misuse could steer the agent into running local commands unrelated to ideation, leading to data exposure, system tampering, or abuse of the host environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is presented as a creative-planning assistant, but the document also advertises automation features such as file handling, API use, and system command execution that materially expand its authority. This mismatch can cause the agent to invoke privileged tools in contexts where users expect only text generation, increasing the risk of unauthorized file modification, command execution, or broader task hijacking.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description states '支持中文交互' and the document consistently frames operation in Chinese, but it does not present this as an opt-in preference or explain a justified locale restriction. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless clearly documented as region-specific or optional.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

File write access is not necessary for a skill whose described output is creative guidance for discussion and reference. Unnecessary write permissions enable the agent to alter local files, overwrite project content, or drop misleading artifacts if prompted or compromised, turning a low-risk advisory skill into one with persistent side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The usage model relies on open-ended natural language without clear boundaries on what the skill should refuse or when tools may be used. For a skill with read/write/exec capability, vague triggers make it easier for unrelated or malicious prompts to be interpreted as in-scope, causing unreviewed tool invocation or scope creep.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill claims it only produces textual creative guidance, but elsewhere describes automation behavior including writing files and executing commands. These contradictions make operator expectations unreliable and can bypass human scrutiny, because a reviewer may approve the skill assuming it is passive while it actually has active side-effect capabilities.

Content

No source excerpt is available for this finding.