content-orchestrator

• Outcome: Review
• Latest audit: Aug 15, 2026 · 3:54 AM UTC
• Version: 1.0.0

Overview

This skill is a powerful publishing orchestrator, but it needs Review because it can execute broad local pipelines, publish externally, and persist tenant workflow data with weak user-facing boundaries.

Install only in an environment where this skill is allowed to publish to connected accounts and run local helper scripts. Before use, require a preview/approval step for every publish or schedule action, lock down writable pipeline and override files, restrict environment-controlled project roots, and avoid using it with sensitive tenant uploads until local fallback storage and tenant-filtered listing are fixed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (49)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

stdin_payload = json.dumps({"action": action, **params}, ensure_ascii=False)
    try:
        # v2.6修复(BUG-E2E-020): 添加PYTHONUTF8=1环境变量+errors=replace
        result = subprocess.run(
            cmd, capture_output=True, text=True, timeout=300,
            encoding="utf-8", errors="replace", cwd=str(_PROJECT_ROOT),
            env={**os.environ, "PYTHONUTF8": "1", "PYTHONIOENCODING": "utf-8"},

• Confidence: 95% confidence
• Finding: The orchestrator executes skill scripts via subprocess using paths derived from runtime-discovered files under a project root that can be influenced by environment/configuration and external pipeline definitions. Although shell injection is mitigated by argument lists and a skill-name regex, this still creates a code-execution surface where untrusted or tampered skill files can be launched with attacker-controlled parameters.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)
                    _kw_str = ",".join(step_params.get("keywords", []) or [step_params.get("topic", "")][:10])
                    try:
                        _proc = _sp.run(
                            [sys.executable, _matcher_script,
                             "--tenant-id", str(step_params.get("tenant_id", "")),
                             "--keywords", _kw_str,

• Confidence: 91% confidence
• Finding: The pipeline can invoke a local helper script for material matching with parameters influenced by pipeline inputs and a path assembled from project-root filesystem state. In this orchestrator context, the issue is not shell metacharacters but that untrusted pipeline execution can trigger local code execution of helper scripts without strong trust boundaries or integrity checks.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

_bridge_params = dict(step_params)
                        _bridge_params.setdefault("tenant_id", str(step_params.get("tenant_id", "")))
                        try:
                            _bridge_proc = _sp2.run(
                                [sys.executable, _bridge_script,
                                 "--action", _bridge_action,
                                 "--params", json.dumps(_bridge_params, ensure_ascii=False)],

• Confidence: 93% confidence
• Finding: The orchestrator executes novel_bridge.py as a subprocess based on pipeline step routing, creating another local code-execution boundary driven by pipeline configuration and runtime parameters. Because this skill is a high-privilege content/publishing orchestrator, compromise or substitution of that script would give broad access to downstream systems and tenant data flows.

Tainted flow: '_PROJECT_ROOT' from os.environ.get (line 488, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

stdin_payload = json.dumps({"action": action, **params}, ensure_ascii=False)
    try:
        # v2.6修复(BUG-E2E-020): 添加PYTHONUTF8=1环境变量+errors=replace
        result = subprocess.run(
            cmd, capture_output=True, text=True, timeout=300,
            encoding="utf-8", errors="replace", cwd=str(_PROJECT_ROOT),
            env={**os.environ, "PYTHONUTF8": "1", "PYTHONIOENCODING": "utf-8"},

• Confidence: 97% confidence
• Finding: _PROJECT_ROOT is taken from an environment variable and later used to resolve which script gets executed and as the subprocess working directory. An attacker who can influence the environment or deployment config can redirect execution to attacker-controlled files within an alternate tree, leading to arbitrary code execution in the orchestrator process context.

Tainted flow: '_PROJECT_ROOT' from os.environ.get (line 488, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

)
                    _kw_str = ",".join(step_params.get("keywords", []) or [step_params.get("topic", "")][:10])
                    try:
                        _proc = _sp.run(
                            [sys.executable, _matcher_script,
                             "--tenant-id", str(step_params.get("tenant_id", "")),
                             "--keywords", _kw_str,

• Confidence: 96% confidence
• Finding: This subprocess ultimately depends on helper-script paths derived from the environment-selected project root, so path control can become execution control. In a multi-tenant orchestration service that already auto-injects tenant context and calls many downstream tools, that creates a dangerous privilege amplification point.

Tainted flow: '_bridge_script' from os.environ.get (line 2299, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

_bridge_params = dict(step_params)
                        _bridge_params.setdefault("tenant_id", str(step_params.get("tenant_id", "")))
                        try:
                            _bridge_proc = _sp2.run(
                                [sys.executable, _bridge_script,
                                 "--action", _bridge_action,
                                 "--params", json.dumps(_bridge_params, ensure_ascii=False)],

• Confidence: 96% confidence
• Finding: The novel bridge script path is built from the environment-influenced project root and then executed directly. If an attacker can alter that root or place a malicious replacement in the searched tree, they can execute arbitrary Python in the context of a privileged publishing orchestrator.

Tainted flow: 'matcher_script' from os.environ.get (line 512, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

if matcher_script.exists():
            try:
                kw_str = ",".join(keywords)
                proc = subprocess.run(
                    [sys.executable, str(matcher_script),
                     "--tenant-id", tenant_id,
                     "--keywords", kw_str,

• Confidence: 90% confidence
• Finding: `matcher_script` is built from `JUEJIN_HOME`, which is sourced from an environment variable and then used as the basis for a Python script executed via `subprocess.run()`. An attacker who can influence the environment or deployment configuration could redirect execution to a malicious `scripts/material_matcher.py`, resulting in arbitrary code execution under the skill's privileges.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares powerful tools (`read`, `exec`) and documents capabilities including environment access, file reads, shell execution, networked MCP calls, and external API use, but it does not present a matching explicit permission model or user-facing capability boundary. In a skill that can generate, transform, upload, and publish content across many external services, this gap increases the risk of over-privileged execution, unexpected data exposure, and unsafe command execution through dynamically discovered dependencies and exec scripts.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The pipeline performs a self-learning step from publish feedback even though the stated purpose is only to generate and publish a digital-human video. Hidden or under-documented memory/learning behavior is security-relevant because publish feedback may contain sensitive tenant, platform, or moderation data, and persisting it can change future behavior without clear operator consent or scope limits.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This pipeline is described as a hot-topic content generation flow, but it also performs marketplace item publication and multi-platform distribution. That capability expansion is security-relevant because it turns a research/generation pipeline into an autonomous action pipeline with external side effects, increasing the chance of unintended posting, unauthorized commerce actions, or policy bypass if callers rely on the description to assess risk.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The pipeline is labeled as a lip-sync content generation flow, but it also performs autonomous multi-platform publishing and post-publication learning. This scope expansion is dangerous because users or higher-level orchestrators may invoke what appears to be a media-generation pipeline while unintentionally granting it the ability to distribute content externally and feed results back into adaptive systems, increasing the risk of unauthorized publication and amplification of bad outputs.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The pipeline is described only as a 'new product content generation' workflow, but it also performs autonomous publishing, scheduling, analytics collection, and self-learning. This scope mismatch is dangerous because callers may invoke it expecting low-risk drafting behavior while actually triggering external side effects across platforms and accounts.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The pipeline includes direct cross-platform posting to Douyin, Xiaohongshu, and Shipinhao, which materially expands its authority beyond content generation. In a multi-tenant orchestrator, this can cause unintended mass publication, brand damage, account misuse, or policy violations if activated under an overly broad or misunderstood trigger.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Post-publication analytics and self-growth learning exceed the declared purpose of generating new product content and create longer-lived behavioral side effects. This is risky because it can silently collect operational data and feed it into future model behavior without clear user awareness, approval, or retention boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This pipeline defines a full news-graphic generation and publishing workflow, but the skill metadata’s declared pipeline set does not list PL-NEWS-GRAPHIC. Undeclared capabilities are dangerous because they can bypass operator review, policy gating, and user expectations, especially in a system that auto-routes and auto-injects tenant/platform context.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The pipeline description says it is for generating a news short video, but the workflow also performs multi-platform publishing. This hidden capability materially changes the risk profile because generated news content can be externally distributed without an explicit, clearly disclosed publish boundary or separate user confirmation, increasing the chance of accidental mass posting, policy violations, or reputational harm.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: The self-learning step ingests publish feedback despite the stated purpose being content generation, and the file does not define what data is learned, how it is bounded, or whether feedback may contain sensitive tenant or platform information. This can create unintended data retention, cross-tenant leakage, or unsafe model adaptation from externally influenced signals.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The pipeline is described as a novel chapter generation flow, but it also saves drafts, performs multi-platform publication, updates publish status, and feeds publication results into a learning step. This creates a dangerous scope mismatch: a caller may invoke what appears to be a content-generation pipeline and unintentionally trigger external side effects, including public posting and downstream model/agent adaptation.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The module persists pipeline records to local JSON files as a fallback and enumerates them from a shared directory. In a multi-tenant orchestration skill, this expands the data surface beyond the declared PG/RLS model and can expose pipeline metadata or content to other local users, processes, or later commands if filesystem permissions and tenant partitioning are not strictly enforced.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The non-active CLI list path directly reads every local CP-*.json file and returns them without applying the PG-first tenant-aware access model or any tenant filter. In this skill's multi-tenant context, that creates a straightforward cross-tenant information disclosure path for pipeline titles, step outputs, errors, and metadata stored in local fallback files.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are extremely broad (`生成内容`, `发布内容`, `一条龙`, `日常运营`, etc.), making accidental invocation likely during normal conversation. In this skill, accidental routing is especially dangerous because invocation can cascade into file processing, external API calls, automated content generation, and real publishing actions across multiple platforms.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill advertises one-click generation and publishing to multiple external platforms but does not provide a clear warning that user content, tenant data, and generated material may be transmitted to third-party MCP servers and published externally. In a multi-tenant orchestrator with dynamic dependency discovery and auto-routing, lack of consent and action transparency can cause unintended disclosure, unauthorized posting, and cross-system data propagation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The upload pipeline processes user-supplied files, extracts text/images/OCR content, and routes that content into downstream generation and publishing flows without a prominent warning about file handling, extraction, retention, or onward transmission. This creates elevated privacy and security risk because uploaded documents may contain sensitive data that is automatically transformed and sent to additional tools or external platforms.

Vague Triggers

Low

• Confidence: 87% confidence
• Finding: The manifest defines a broad end-to-end daily content pipeline but does not encode concrete invocation constraints, approval gates, or trigger conditions inside the file itself. In a skill that can generate, optimize, and publish content across platforms, this increases the risk of accidental or unauthorized execution, especially when combined with downstream auto-publish and scheduling steps.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The pipeline includes a multi-platform publish step with no manifest-level warning, confirmation, or explicit approval requirement. Because this skill is an orchestration layer for tenant-aware content generation and distribution, automatic publishing can cause unauthorized posting, brand damage, policy violations, or cross-tenant operational mistakes if invoked incorrectly or by prompt manipulation upstream.

Static analysis

No suspicious patterns detected.