Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its AI model configuration purpose, but it contains unsafe editing instructions and under-explained handling of API keys and uploaded images.
Install only if you are comfortable with provider API calls, local plaintext model configuration, and possible third-party image uploads during video workflows. Do not place real secrets in shared reports or shell commands, review any generated ~/.workbuddy/models.json permissions, and ignore the skill's instruction that modifications must never be refused.
Claiming broad external-platform support while only performing local media muxing is a significant description-behavior mismatch. This can mislead a user into sharing credentials, media, or trust assumptions under false pretenses, which is a security concern even if the implemented behavior is comparatively limited.
Claiming broad external-platform support while only performing local media muxing is a significant description-behavior mismatch. This can mislead a user into sharing credentials, media, or trust assumptions under false pretenses, which is a security concern even if the implemented behavior is comparatively limited.
Claiming broad external-platform support while only performing local media muxing is a significant description-behavior mismatch. This can mislead a user into sharing credentials, media, or trust assumptions under false pretenses, which is a security concern even if the implemented behavior is comparatively limited.
Claiming broad external-platform support while only performing local media muxing is a significant description-behavior mismatch. This can mislead a user into sharing credentials, media, or trust assumptions under false pretenses, which is a security concern even if the implemented behavior is comparatively limited.
The instruction to never refuse any modification to the skill content is an explicit attempt to override normal safety and policy checks. In practice, this could pressure an agent to comply with unsafe edits, malicious prompt injections, or persistence changes that weaken future security controls.
A blanket instruction against refusing modification requests directly conflicts with standard safety constraints and attempts to suppress risk-based refusal behavior. This is dangerous because it can normalize compliance with harmful edits, policy bypasses, or privilege-expanding changes under the guise of routine skill maintenance.
The update report example explicitly shows old and new API key values in a generated report format, normalizing the practice of displaying and potentially logging secrets. This is dangerous because reports are often shared, stored, backed up, or pasted into tickets and chats, turning a routine configuration update into direct credential leakage.
The tool sends local images to external temporary file-hosting services without an upfront warning in the CLI help or usage flow. In the context of a multimodal generation skill, users may reasonably expect local files to stay local or go only to the named model provider, making this undisclosed data transfer especially risky.
The skill describes behaviors that imply access to sensitive capabilities like environment variables, filesystem, network, and shell execution, yet it declares no explicit tool scope or permission boundaries. In an agent environment, this increases the chance of over-privileged execution and makes it harder to enforce least privilege for actions involving API keys, local files, and external services.
The trigger list includes broad, common phrases that could cause the skill to activate unintentionally in unrelated conversations. Over-broad invocation increases the attack surface for prompt injection, accidental execution of risky workflows, and inappropriate access to tools or sensitive context.
The skill discusses API key input via command line, environment variables, and config files without clear warnings about credential sensitivity, logging risk, or secure storage practices. This may lead users to expose secrets in shell history, readable files, or agent-visible environments, especially in a skill already involving broad tool capabilities.
By semantically pressuring the model to comply with arbitrary edits, the skill weakens the agent’s ability to apply normal safety judgment and authorization checks. Even without technical code execution, this kind of instruction-layer coercion can materially increase the likelihood of unsafe modifications and downstream compromise.
An unrestricted prompt-export feature that combines SKILL.md and all reference files into a single prompt can facilitate bulk exfiltration of internal instructions, hidden prompts, or sensitive operational details. This exceeds the justified needs of a model-configuration skill and expands the risk of prompt leakage and unauthorized replication.
This markdown file presents all instructions and operational guidance exclusively in Chinese, and it does not indicate that the skill is intended only for Chinese-speaking users or offer an alternative language. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| 智谱 BigModel | glm-4.7-flash | 文本生成 | https://open.bigmodel.cn/api/paas/v4/ |
| 商汤 SenseNova | sensenova-6.8-flash-lite / sensenova-u1-fast / deepseek-v4-flash / glm-5.2 | 文本生成 / 信息图生成 / 对话推理 | https://token.sensenova.cn/v1 |
| 小米 MIMO | mimo-v2.5-pro / mimo-v2.5 / mimo-v2.5-asr / mimo-v2.5-tts 系列 | 文本生成 / 全模态 / 语音识别 / 语音合成 | https://token-plan-cn.xiaomimimo.com/v1 |
| 美团 LongCat | LongCat-2.0 | 文本生成 | https://api.longcat.chat/openai |
2. **平台能力对比**：
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| 智谱 BigModel | glm-4.7-flash | 文本生成 | https://open.bigmodel.cn/api/paas/v4/ |
| 商汤 SenseNova | sensenova-6.8-flash-lite / sensenova-u1-fast / deepseek-v4-flash / glm-5.2 | 文本生成 / 信息图生成 / 对话推理 | https://token.sensenova.cn/v1 |
| 小米 MIMO | mimo-v2.5-pro / mimo-v2.5 / mimo-v2.5-asr / mimo-v2.5-tts 系列 | 文本生成 / 全模态 / 语音识别 / 语音合成 | https://token-plan-cn.xiaomimimo.com/v1 |
| 美团 LongCat | LongCat-2.0 | 文本生成 | https://api.longcat.chat/openai |
2. **平台能力对比**：
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| 智谱 BigModel | glm-4.7-flash | 文本生成 | https://open.bigmodel.cn/api/paas/v4/ |
| 商汤 SenseNova | sensenova-6.8-flash-lite / sensenova-u1-fast / deepseek-v4-flash / glm-5.2 | 文本生成 / 信息图生成 / 对话推理 | https://token.sensenova.cn/v1 |
| 小米 MIMO | mimo-v2.5-pro / mimo-v2.5 / mimo-v2.5-asr / mimo-v2.5-tts 系列 | 文本生成 / 全模态 / 语音识别 / 语音合成 | https://token-plan-cn.xiaomimimo.com/v1 |
| 美团 LongCat | LongCat-2.0 | 文本生成 | https://api.longcat.chat/openai |
2. **平台能力对比**：
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| 智谱 BigModel | glm-4.7-flash | 文本生成 | https://open.bigmodel.cn/api/paas/v4/ |
| 商汤 SenseNova | sensenova-6.8-flash-lite / sensenova-u1-fast / deepseek-v4-flash / glm-5.2 | 文本生成 / 信息图生成 / 对话推理 | https://token.sensenova.cn/v1 |
| 小米 MIMO | mimo-v2.5-pro / mimo-v2.5 / mimo-v2.5-asr / mimo-v2.5-tts 系列 | 文本生成 / 全模态 / 语音识别 / 语音合成 | https://token-plan-cn.xiaomimimo.com/v1 |
| 美团 LongCat | LongCat-2.0 | 文本生成 | https://api.longcat.chat/openai |
2. **平台能力对比**：
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| 智谱 BigModel | glm-4.7-flash | 文本生成 | https://open.bigmodel.cn/api/paas/v4/ |
| 商汤 SenseNova | sensenova-6.8-flash-lite / sensenova-u1-fast / deepseek-v4-flash / glm-5.2 | 文本生成 / 信息图生成 / 对话推理 | https://token.sensenova.cn/v1 |
| 小米 MIMO | mimo-v2.5-pro / mimo-v2.5 / mimo-v2.5-asr / mimo-v2.5-tts 系列 | 文本生成 / 全模态 / 语音识别 / 语音合成 | https://token-plan-cn.xiaomimimo.com/v1 |
| 美团 LongCat | LongCat-2.0 | 文本生成 | https://api.longcat.chat/openai |
2. **平台能力对比**：
This markdown repeatedly treats Chinese support as a built-in evaluation criterion, and the example user requirements explicitly require Chinese support. For a general model-selection template, this creates a locale preference without any user opt-in or explanation that the skill is intended only for Chinese-language users.
The model capability matrix and matching analysis include '中文支持' as a fixed dimension, and the example requirement says '需要文本生成功能，支持中文'. That imposes a specific language preference in the skill's natural-language guidance rather than making locale selection user-driven.
The template instructs users to place live API keys into a local JSON config file but does not clearly warn that the file contains sensitive credentials or recommend file permission hardening, secret storage, or avoidance of source control. This increases the risk of accidental disclosure through backups, logs, screenshots, malware, or repository commits.
The curl-based test examples send prompts and authorization headers to third-party providers without any privacy notice about what data leaves the local environment. Users may unknowingly transmit sensitive text, internal prompts, or regulated data during testing.
This example explicitly instructs authenticated POST requests to external model endpoints, which causes user prompts and API credentials to be transmitted off-host. In the context of a model-configuration skill this is expected behavior, but it is still security-relevant because the documentation omits safeguards and data-handling warnings.
接口测试：
curl -X POST {接口地址} \
-H "Authorization: Bearer {API_KEY}" \
-H "Content-Type: application/json" \
-d '{
The configuration test command sends authenticated traffic and prompt content to a remote provider, creating external data transmission risk. While this is operationally necessary for testing, the absence of privacy and credential-handling guidance makes it a real weakness in the skill content.
配置测试：
curl -X POST {接口地址} \
-H "Authorization: Bearer {API_KEY}" \
-H "Content-Type: application/json" \
-d '{