Security audit

照片配文工具免费版

Security checks for vulnerabilities and agentic risk

Overview

This is a simple photo-caption writing skill, but it asks for file read, file write, and command execution permissions that its own instructions say it does not need.

Review before installing. The caption-writing behavior itself is ordinary, but the requested read, write, and exec permissions are broader than this skill appears to need. Prefer a version that removes those permissions or install only if your agent environment lets you control when files and commands are used. Avoid providing exact home locations, routines, minors' details, or other sensitive metadata in photo prompts.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The skill documentation claims it is a pure Markdown skill that does not need command execution, while the manifest still grants exec. This mismatch can mislead users and reviewers into trusting a broader privilege set than the skill actually requires, increasing the chance of unnecessary command execution through the agent runtime.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: Read and write permissions are broader than necessary for a simple caption-generation skill that can operate on user-provided text input alone. Excess file access raises confidentiality and integrity risks because the skill could read unrelated local data or write files without a clear functional requirement.

Context-Inappropriate Capability

Low

Confidence: 86% confidence
Finding: Read and write permissions are broader than necessary for a simple caption-generation skill that can operate on user-provided text input alone. Excess file access raises confidentiality and integrity risks because the skill could read unrelated local data or write files without a clear functional requirement.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger condition says the skill should be used for broad marketing copy, writing, title optimization, and content creation tasks, far beyond photo captions. Overbroad routing increases the likelihood that the skill is invoked in inappropriate contexts while still holding unnecessary permissions, which can amplify misuse or prompt-based abuse.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill encourages users to provide location, equipment, subject matter, and mood context but does not warn that these details may contain sensitive personal metadata. In a social-media workflow, such data can reveal travel patterns, home areas, possessions, or personal habits, creating privacy and safety risks if shared unnecessarily with the model or copied into generated captions.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: Automatically choosing caption language based on location and user language assumptions can infer locale-sensitive attributes without explicit opt-in and may produce unintended disclosures or awkward mismatches. While not a severe exploit by itself, it creates privacy and consent concerns by deriving output behavior from potentially sensitive geographic context.

Static analysis

No suspicious patterns detected.