T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:178- Finding
Overbroad Enumeration of Credential-Related Environment Variables
- Content
View full analysis
- Remediation
View remediation
Security audit
写作助手基础版
Security checks for vulnerabilities and agentic risk
Overview
This writing assistant is mostly coherent, but it asks for shell access and gives unsafe credential-checking and unclear data-flow instructions that users should review before installing.
Install only if you are comfortable with a writing skill that can use shell commands and may rely on external APIs or callbacks. Do not let it run broad environment-variable checks, and require confirmation before any command execution, network request, callback URL use, or handling of API keys and private drafts.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document states that FREE-version data is stored locally and not uploaded, but elsewhere admits some features require network access and external APIs. This is a serious trust and privacy issue because users may share proprietary drafts, API keys, or confidential content under a false assumption that nothing leaves the machine.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The keyword list is excessively broad and overlaps with ordinary language such as writing, document, style, and editing. In agent ecosystems that auto-select skills from metadata, broad tags can cause unintended activation and expose user content to unnecessary tool execution or external transmission paths.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill enables the exec tool but does not prominently warn users in its description that shell commands may be run as part of fulfillment. Hidden command-execution capability is dangerous because users may provide untrusted content or assume a text-only assistant while the agent is actually permitted to invoke the local shell.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The input format supports callback URLs and the document also references external APIs, but there is no explicit warning that user content may be sent to third-party endpoints. This can lead to silent exfiltration of prompts, drafts, or metadata if an agent follows the documented workflow without informed consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The invocation guidance is broad enough that an agent could over-activate the skill for generic writing-related requests without clear boundaries. Over-broad triggering increases the chance that the skill will run tools, including exec or networked actions, on inputs the user did not intend to route through this skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill presents itself as local/basic while also declaring that some functionality may access external APIs and requires network connectivity. This mismatch can mislead users and host agents about data-flow and trust boundaries, causing sensitive writing prompts or documents to be sent off-host unexpectedly.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The visible display name, summary, and nearly all user-facing instructions are presented only in Chinese, while the skill is described as usable across multiple generic AI agent platforms and does not indicate that Chinese is optional or region-specific. This can be a language/locale policy issue because the skill does not offer users a language choice or opt-in.
- Content
Static analysis
No suspicious patterns detected.