Security audit

article-writer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent article-writing workflow, but it can save drafts locally and publish to a WeChat Official Account without a clear confirmation step.

Review this skill before installing if you do not want article content automatically archived or publicly posted. Use it only where WeChat credentials are intentionally configured, and require an explicit preview and confirmation before saving to the Obsidian vault or publishing to the Official Account.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The manifest describes behavior that includes searching, organizing, and publishing to a WeChat official account, and the body also stores content in a local vault. This implies persistent handling of user content across external and local destinations, which is risky when the skill does not clearly gate retention and publication behind explicit consent.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: article-writer description: Senior technical article editor for creating well-structured articles from research. Use when user requests to write/create a technical article with keywords like "帮我写篇文章", "写一篇关于XX的文章", "创作技术文章". Searches via tavily, organizes content, and publishes to WeChat Official Account. --- # Article Writer

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs automatic saving to a local knowledge base and publishing to a WeChat official account without requiring explicit user confirmation. This creates a real risk of unintended exfiltration or irreversible publication of user-provided or model-generated content to external and persistent destinations.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
## Related Resources - **tavily-search skill**: Search for materials (`~/.openclaw/workspace/skills/tavily-search/SKILL.md`) - **wechat-toolkit skill**: Publish to WeChat Official Account (`~/.openclaw/workspace/skills/wechat-toolkit/SKILL.md`) - **obsidian skill**: Save to knowledge base (`~/.openclaw/workspace/skills/obsidian/SKILL.md`) - **MEMORY.md**: WeChat article creation guidelines (`~/.openclaw/workspace/MEMORY.md`)

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
## Related Resources - **tavily-search skill**: Search for materials (`~/.openclaw/workspace/skills/tavily-search/SKILL.md`) - **wechat-toolkit skill**: Publish to WeChat Official Account (`~/.openclaw/workspace/skills/wechat-toolkit/SKILL.md`) - **obsidian skill**: Save to knowledge base (`~/.openclaw/workspace/skills/obsidian/SKILL.md`) - **MEMORY.md**: WeChat article creation guidelines (`~/.openclaw/workspace/MEMORY.md`)

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
- **tavily-search skill**: Search for materials (`~/.openclaw/workspace/skills/tavily-search/SKILL.md`) - **wechat-toolkit skill**: Publish to WeChat Official Account (`~/.openclaw/workspace/skills/wechat-toolkit/SKILL.md`) - **obsidian skill**: Save to knowledge base (`~/.openclaw/workspace/skills/obsidian/SKILL.md`) - **MEMORY.md**: WeChat article creation guidelines (`~/.openclaw/workspace/MEMORY.md`) ## WeChat Publishing Details

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest says the skill searches, organizes content, and publishes to WeChat, but the detailed workflow also says to save the generated article into an Obsidian database/vault. Persisting content to a local knowledge base is a material behavior beyond the summarized manifest description, not merely article generation itself.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest frames the skill as a senior article editor that researches, organizes, and publishes content. The instruction to create multiple sub-agents for drafting and verification introduces orchestration behavior that is not clearly necessary or declared as part of the skill's stated scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The markdown explicitly requires WECHAT_APP_ID and WECHAT_APP_SECRET for publishing, which are sensitive credentials. However, the skill description does not include a user-facing warning about handling credentials or that the skill's publishing flow depends on access to them.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.