Security audit

content-pregenerator

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what a content pre-generator would need, but it can broadly change publishing readiness across tenant and system queues in a way the user-facing description does not clearly disclose.

Install only if this skill will run under an administrative account in an environment where broad tenant and system publish-readiness changes are acceptable. Before production use, require explicit tenant/date scoping, dry-run or confirmation for all-tenant runs, audit logging, and removal or narrowing of the system-wide content_publish updates.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares powerful execution surfaces (`exec`, Python, environment-variable use, and database connectivity) but does not clearly declare permissions or constrain shell/environment access. This creates a transparency and least-privilege gap: operators may invoke a skill that can execute commands and access sensitive configuration without an explicit permission model or warning.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior says the skill only pregenerates content and skips publishing, but the finding indicates it also mutates task states and marks `content_publish` tasks as ready across tenant scopes, including the `system` tenant. This is dangerous because hidden state transitions can bypass expected approval boundaries, enable premature publication workflows, and create cross-tenant impact that users and reviewers would not expect from the description.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The pre-generator updates task_queue rows for content_publish, including all pending publish tasks for the tenant and even all system-level publish tasks, despite only generating one task's content. This creates a privilege/scope violation where generation success for one item can unlock unrelated publish workflows, causing unauthorized or premature publication across tenant or global queues.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger list includes broad natural-language phrases such as '预生成' and '凌晨生成', which increases the chance of accidental invocation by unrelated user requests or operational chatter. Because this skill performs batch processing and database writes across many tenants, an unintended trigger could launch high-impact actions without deliberate authorization.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill description does not warn that it can read and write broadly across all tenants and update database-backed task state. In context, this is more dangerous because the skill is designed for multi-tenant batch operation during unattended hours, so a user or orchestrator may underestimate the blast radius and invoke it without understanding the cross-tenant consequences.

Static analysis

No suspicious patterns detected.