Security audit

内容过滤工具

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly describes personal feed filtering, but it asks for command and file authority while also telling agents to activate for unrelated marketing and content-creation tasks.

Review this skill carefully before installing. Use it only for personal feed filtering and local rule management, not for marketing copy, ad strategy, lead generation, or growth workflows. Do not provide feed tokens unless you trust the publisher, and inspect any shell command before allowing the agent to run it.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest presents the skill as a personal content-filtering tool, but its description explicitly broadens activation to marketing copy, title optimization, and content creation. This scope drift can cause the agent to invoke the skill in unrelated contexts, increasing the chance of inappropriate tool use and misleading users about what the skill actually does.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The documentation repeatedly claims filtering functionality while also advertising workflow and content-creation capabilities outside that scope. In agent ecosystems, this kind of semantic mismatch can route user requests to the wrong skill and lead to execution of tools under false expectations.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The trigger condition says to use the skill for marketing promotion, ad placement, lead generation, and growth, which directly contradicts the stated purpose of filtering an information feed. This can cause unsafe or deceptive invocation, especially when the skill has exec/write-capable tooling available.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger description is broad enough to overlap with many ordinary writing and content-creation requests, despite the skill not being designed for those tasks. Overbroad routing criteria can make an agent select this skill unnecessarily, exposing exec/read/write functionality in contexts that do not require it.

Vague Triggers

High

Confidence: 96% confidence
Finding: The activation condition is both ambiguous and functionally mismatched, directing use for promotion and customer acquisition rather than content filtering. Because the skill declares powerful tools, incorrect activation can materially increase risk by enabling command execution and file operations during unrelated user workflows.

Static analysis

No suspicious patterns detected.