文本人性化工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.3

Overview

This skill is mainly a text-rewriting helper, but it asks for command execution and file write-style capabilities that are not clearly needed or safely scoped.

Review before installing. The skill appears to be a writing helper rather than malware, but it should not need broad command execution or file mutation authority. Prefer a version that removes exec/write permissions, narrows activation to explicit text-humanization requests, and asks before saving or exporting user content.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Excessive and Inconsistent Tool Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5 and 18–21
Vulnerability Type: Excessive filesystem and command-execution privileges
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: read exec

yaml

tools:
  - exec
  - read
  - write

Technical Analysis

The skill performs text analysis and rewriting, which does not inherently require general-purpose command execution or filesystem access. Nevertheless, it requests exec, read, and write capabilities.

These permissions violate the principle of least privilege:

• exec may allow commands to run with the privileges of the hosting agent.
• read may expose local files unrelated to the text-rewriting task.
• write may allow local files to be created or modified.
• The declarations are inconsistent: write is listed under tools but omitted from allowed-tools, creating ambiguity about the skill's effective permissions.

The document also recommends running a network diagnostic command at line 233. Network troubleshooting is not necessary for a tool described as a pure Markdown-based text rewriter and unnecessarily broadens its operational scope.

No malicious command, credential-access instruction, destructive operation, persistence mechanism, or exfiltration behavior was identified. The risk arises from unnecessary capabilities that could be misused if the agent processes prompt-injected or otherwise attacker-controlled content.

Attack Path

1. A user or external source supplies attacker-controlled text for rewriting.
2. The text contains prompt-injection instructions intended to influence the tool-enabled agent.
3. Because the skill declares filesystem and command-execution capabilities, the manipulated agent may invoke read, write, or exec for actions unrelated to rewriting.
4. Subject to the host agent's sandbox and approval controls, the attacker could cause local data access, file ...[truncated 702 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec, read, and write because ordinary text rewriting requires no external tools.
2. Remove the network diagnostic instruction at line 233.
3. Make allowed-tools and tools consistent so that the effective permission set is unambiguous.
4. If file-based input is required, allow access only to files explicitly selected by the user and restrict operations to the smallest necessary directory.
5. If output must be saved, require explicit user confirmation and use a narrowly scoped write operation rather than unrestricted filesystem access.
6. If command execution is retained for a documented requirement, enforce a fixed command allowlist, reject user-controlled command arguments, disable shell interpretation, and run commands in a restricted sandbox.
7. Treat all text submitted for rewriting as untrusted data and explicitly prohibit instructions inside that text from initiating tool calls.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says the skill should be used whenever the user needs marketing copy, writing content, title optimization, or content creation. These are very broad, everyday requests, and the file does not define precise trigger phrases, constraints, or negative examples beyond excluding purely technical writing, which could cause unintended invocation for many generic writing tasks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

A text rewriting skill has no clear operational need for shell execution, yet the manifest grants exec capability. Unnecessary command-execution privileges violate least privilege and create a path for arbitrary local command use if the skill is invoked in an agent environment that honors those permissions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is presented as a text-humanization tool, but the body broadens it into generic create/query/modify/delete, import/export/save, and runtime configuration operations. This kind of capability inflation obscures the true scope of what the skill may do and can normalize unsafe persistence or modification behaviors unrelated to rewriting text.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill advertises export/save/convert behaviors without a clear warning that user content may be persisted or modified. In an agent setting, silent persistence of user-provided text can create confidentiality, integrity, and data-governance risks, especially when the skill scope is nominally just text polishing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file states that the skill covers scene keywords such as '面向个人用户的', '文本痕迹去除工具', and '让写作更自然', which are descriptive and vague rather than bounded trigger conditions. Without a specific trigger list or non-trigger examples, these phrases are too general to reliably distinguish when the skill should or should not run.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation is internally inconsistent: it claims to be a pure Markdown tool needing no extra API key, yet also discusses command execution, network diagnostics, and environment-variable key handling. That mismatch can mislead users and reviewers about the real execution and data-exposure surface, increasing the chance that the skill is granted more trust and permissions than its stated purpose warrants.

Content

No source excerpt is available for this finding.