Security audit

研究文章匠人

Security checks for vulnerabilities and agentic risk

Overview

This writing skill is mostly a research-article assistant, but it asks for command execution, broad file handling, API connections, and possible credentials without enough scoping or user control.

Review this carefully before installing. It may be acceptable if you specifically want an article-writing assistant that can inspect local files and use tools, but only enable command execution or API credentials in a constrained environment and avoid giving it access to sensitive projects, secrets, or broad filesystem areas unless you explicitly need that.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is presented as a research/article-writing assistant, but the documentation later expands it into generic file handling, command execution, and external-service usage. This capability drift is dangerous because users and orchestrators may grant broader permissions than are necessary, increasing the chance that a writing request triggers sensitive local or external actions unexpectedly.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The 'main features' describe a general automation utility rather than a narrow writing assistant, creating a mismatch between declared purpose and effective capability. Such overbroad functionality undermines least privilege and can lead to misuse of local tools or data under the guise of harmless content generation.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: Later sections introduce API integration and command execution that are not reflected in the primary article-writing description, indicating hidden or poorly disclosed operational scope. This inconsistency makes the skill more dangerous because reviewers and users may not anticipate network access, credential use, or system interaction when enabling it.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: System command execution is not justified by the stated purpose of researching and drafting long-form articles. Giving a writing skill exec access materially raises the risk of arbitrary local command execution, file discovery, data exfiltration, or environment manipulation if prompts or downstream logic are abused.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The documentation introduces API keys and external service connectivity without a clear connection to the core article-writing purpose. This creates unnecessary credential-handling and outbound-data risks, especially if user content, local files, or prompts are sent to third-party services without clear disclosure.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The quick-start guide expands behavior to API connection setup, interface invocation, file preparation, and command execution, which exceeds the expected role of a writing assistant. This broader operational envelope increases the chance that a benign writing workflow becomes a vehicle for sensitive file access, network transmission, or execution on the host.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill describes writing files, using commands, external APIs, and credential setup without a clear user-facing warning about system, privacy, or data-transfer impact. This weak disclosure can mislead users into invoking a seemingly harmless writing skill that may touch local resources or transmit data externally.

Static analysis

No suspicious patterns detected.