照片配文工具免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.2

Overview

This caption-writing skill is mostly plain instructions, but it asks for command execution and file read/write access that its own documentation says it does not need.

Review before installing. The caption behavior itself is coherent, but install it only in an environment that ignores or tightly restricts the declared exec and write permissions, or after the publisher removes those permissions and narrows activation to photo-caption tasks. Avoid providing precise home, travel, or identifying location details unless you intend them to appear in public captions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:47

Finding

Unnecessary Command Execution and Filesystem Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–50
Vulnerability Type: Excessive tool permissions violating least privilege
Risk Level: Medium

Vulnerable Code

yaml

tools:
  - read
  - exec
  - write

The excessive permission declaration is contradicted by the skill's own runtime documentation at line 328:

text

- **Classification**: MD (pure Markdown instructions, no exec command-line capability required)

The error-handling guidance at line 336 nevertheless recommends shell execution:

text

| Network error | Connection timed out or unreachable | Execute the ping command to test network connectivity, check firewall and proxy settings, then execute the ping command again and refer to domestic alternatives |

Technical Analysis

The skill's stated purpose is to generate social-media captions through an agent's built-in language model. Its dependency documentation states that no external captioning or image-recognition API is called and that command-line execution is unnecessary. Consequently, granting exec, write, and potentially read is not justified by the legitimate workflow.

If the host grants capabilities according to this manifest, the skill obtains a shell-execution channel and filesystem access that are unrelated to caption generation. The ping guidance creates a concrete path by which the unnecessary exec capability may be invoked. Although the reviewed file contains no directly malicious command, this permission configuration increases the damage that crafted user input, instruction confusion, or a later unauthorized modification could cause.

Attack Path

1. An agent platform loads SKILL.md and grants the declared read, exec, and write tools.
2. A user supplies crafted content or a request that induces the agent to interpret troubleshooting or caption-related input as an instruction to use those tools.
3. The agent invokes `ex ...[truncated 1024 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec and write from the declared tool list.
2. Remove read unless the host demonstrably requires it to load the skill itself; caption generation does not require arbitrary file access.
3. Remove the ping command recommendation at line 336 and replace it with non-executable guidance, especially because the skill claims not to use external services.
4. Explicitly state that the skill must not execute commands or read or modify local files.
5. Restrict activation to photo-caption requests rather than the broad marketing, writing, title-optimization, and general content-creation trigger at lines 187–189.
6. Enforce host-side capability controls independently of the manifest, including sandboxing, command allowlists, workspace-scoped filesystem access, and user confirmation for sensitive operations.
7. Add a validation check that rejects tool declarations not required by the documented workflow.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger condition expands from photo-caption generation to general marketing copy, writing content, title optimization, and content creation. In an agent environment, such overbroad routing can cause the skill to activate for unrelated tasks, increasing exposure of user data and, given the unnecessary exec/write permissions, broadening the situations in which dangerous capabilities are available.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation explicitly states the skill is pure Markdown and does not require exec, while the manifest still grants exec. This mismatch is dangerous because reviewers or users may trust the lower-risk description while the runtime actually has higher privileges, enabling command execution contrary to the stated design.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill declares both exec and write capabilities even though its documented function is pure text caption generation and later documentation says no exec is required. This creates unnecessary privilege that could let the agent execute commands or modify files if the skill is invoked in a broader workflow, turning a harmless content task into a system-impacting one.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill encourages users to provide location, equipment, and contextual photo details but does not warn that these may reveal sensitive personal information such as home patterns, travel status, or identifying metadata. For a consumer social-posting workflow, omission of such guidance can lead users to unintentionally disclose personal or trackable information in generated captions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Defaulting caption language based on location infers behavior from geographic information without explicit user choice. While not as severe as code execution issues, it can leak assumptions about the user's context, mishandle multilingual cases, and increase privacy sensitivity by treating location as an input for behavioral decisions.

Content

No source excerpt is available for this finding.