Security audit

多平台摄影配文

Security checks for vulnerabilities and agentic risk

Overview

This caption-writing skill is mostly ordinary, but it asks for broad execution and file permissions that are not justified by its stated purpose.

Review before installing. The caption guidance itself is not harmful, and no executable payload was present, but the skill should not need shell execution, broad write access, callback URLs, or generic workflow automation claims. Prefer a version limited to caption-generation instructions and least-privilege tools.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill declares `exec` capability even though the documented core function is generating social-media captions from user-provided photo context. Unnecessary command execution expands the attack surface substantially: if the agent or future revisions ever route untrusted input into shell commands, the skill could enable command execution, local file access abuse, or environment secret exposure without any business need.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The manifest description broadens this skill from caption writing into generic automation, batch processing, and workflow optimization, which can cause agents to invoke it in contexts far beyond its stated purpose. Overbroad positioning is dangerous because it increases the chance that a powerful skill with `read`/`write`/`exec` permissions is selected for unrelated tasks where those capabilities become unnecessary and risky.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The documented `callback_url` parameter implies outbound network notification behavior, but that behavior is not clearly bounded or aligned with the skill's caption-generation purpose. Callback support can become an exfiltration or SSRF-like primitive if agents later send generated content, metadata, or internal status to attacker-controlled URLs.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: Claims of advanced workflow orchestration, scheduling, retries, and audit capabilities materially expand the implied operational scope of the skill beyond text generation. In combination with powerful tools, this can mislead orchestration systems or operators into granting the skill broader trust and runtime authority than is appropriate for a caption-writing assistant.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The activation wording is broad enough to match generic productivity, automation, batch-processing, and workflow-optimization requests rather than narrowly scoped caption-generation tasks. Overbroad triggers are dangerous in an agent ecosystem because they increase accidental invocation frequency, exposing unnecessary read/write/exec capabilities in contexts where they are not needed.

Static analysis

No suspicious patterns detected.