Security audit

Save Article Miaoyan

Security checks for vulnerabilities and agentic risk

Overview

The skill does save articles to Miaoyan, but it automatically fetches links, writes notes, and can send URLs or content to third-party services with conflicting privacy disclosure.

Review before installing. Use this only if you are comfortable with automatic fetching and Markdown file creation in an iCloud-synced Miaoyan folder. Avoid private, authenticated, internal, or sensitive links unless the skill adds confirmation, a local-only mode, and clearer disclosure for Jina/Tavily processing.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documentation describes capabilities that access environment variables, write files, make network requests, and invoke shell tooling, yet it declares no permissions. This weakens user awareness and platform policy enforcement, making it easier for the skill to perform sensitive actions without explicit consent or review. The context increases risk because it saves content locally and uses third-party fetch services, so hidden capabilities directly affect privacy and integrity.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented behavior goes beyond a simple save-article skill by auto-triggering on detected links, invoking local scripts via hardcoded paths, and sending URLs/content to third-party services. This creates both a transparency problem and a data exfiltration risk, since users may not realize their messages or fetched page data are being processed externally or automatically acted upon. In this skill context, article content can include private or access-controlled material, which makes external transmission more dangerous.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The README claims content is not uploaded to any cloud service, but the documented path is an iCloud-backed Miaoyan directory, so article contents may sync off-device automatically. This creates a privacy and transparency problem because users may believe saved content remains strictly local when it can be replicated to cloud storage.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill reads a Tavily API key and can route requested article retrieval through a third-party extraction service, which expands data handling beyond simply saving content to Miaoyan. That means user-supplied URLs, and potentially retrieved article content, may be disclosed to an external provider without clear disclosure in the skill description.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code sends arbitrary user-provided URLs to Jina Reader and optionally Tavily, exposing browsing targets and potentially sensitive article content to external parties. In the context of a note-saving skill, this is more dangerous because users may expect local processing and not realize private/internal links could be transmitted off-device.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill is described as automatically fetching and saving content when a link is sent, but it does not prominently warn that full article contents will be written to disk and potentially to iCloud-backed storage. In a chat context, automatic persistence can surprise users and lead to unintended retention of sensitive or copyrighted material.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation description is broad enough that the skill may trigger on generic conversation about articles or saving content, not just explicit user intent to execute this workflow. Over-broad triggering can cause unintended network access, third-party data sharing, and local file writes without clear user authorization. The risk is higher here because the skill performs side effects rather than just answering questions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The trigger explicitly performs a side-effecting action immediately when a matching WeChat article URL appears in a message, including invoking a local Python script and writing a Markdown file, without requiring user confirmation. This can cause unintended file creation, storage pollution, privacy issues, or abuse via unsolicited links in chats, especially because the skill is configured as high priority and to execute immediately.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The code automatically triggers saving as soon as a matching WeChat URL appears in a message, with no confirmation, provenance check, or user consent step. In an agent context, this can cause unintended outbound processing and persistence of attacker-supplied content, increasing exposure to malicious or privacy-sensitive links.

Static analysis

No suspicious patterns detected.