Security audit

多平台摄影配文

Security checks for vulnerabilities and agentic risk

Overview

This caption-writing skill mostly contains normal writing guidance, but it asks for shell and file-write authority plus an under-explained callback URL that do not fit the stated purpose.

Review this skill before installing and avoid granting exec, write, API-key, or callback access unless you can sandbox and constrain it. The caption guidance itself is not destructive, but the requested authorities are broader than needed for generating social media captions, so do not use it with sensitive photos, private metadata, or credentials unless those paths are clarified.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is presented as a caption-generation tool, but later advertises unrelated file handling, API integration, command execution, and information retrieval capabilities. This scope inflation can cause an agent or user to grant unnecessary authority and creates confusion about what operations the skill may legitimately perform, increasing the attack surface beyond the stated purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Declaring exec capability for a text-generation skill violates least-privilege expectations and enables shell access that the task does not require. In an agent environment, this can be abused to run arbitrary commands, inspect local files, exfiltrate data, or pivot into other system resources if the skill is invoked inappropriately.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The documentation inconsistently labels the skill as both MD+EXEC and pure Markdown-only. This ambiguity is dangerous because operators may underestimate the permissions actually available, while runtime systems may expose stronger capabilities than reviewers expect, undermining trust and safe deployment decisions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Exposing a callback_url parameter without a clear warning or restriction creates a data egress risk. Photo descriptions, metadata, and generated captions may be transmitted to arbitrary external endpoints, enabling unintended disclosure of sensitive contextual information or abuse via attacker-controlled URLs.
Content: No source excerpt is available for this finding.