Viral Copy Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:27 AM UTC
• Version: 1.1.0

Overview

This skill is a coherent copywriting web app, but users should review it because it sends text to third-party translation and TTS services while some documentation says data stays local.

Install only if you are comfortable sending copy, product details, and generated text to the named translation and TTS services. Avoid entering secrets, personal data, or proprietary drafts, prefer opening the static HTML file or using `python -m http.server`, and treat the advertised CSP/XSS/privacy claims as overstated until fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: index.html:1539

Finding

Persistent DOM-Based Cross-Site Scripting Through Unvalidated Stored Records

Content

View full analysis

📭

暂无保存记录

生成的文案可以保存到这里，方便后续查看

`; return; } container.innerHTML = records.map(record => `

${record.platformName} ${record.savedAt}

▶ 📋 删除

${escapeHtml(record.content)}${record.translation ? '\n\n【翻译】' + escapeHtml(record.translation) : ''}

🏷️ 一键生成标题和标签

`).join(''); ``` ### Technical Analysis The application treats data obtained from `localStorage` as trust ...[truncated 2116 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.html:945

Finding

Content Security Policy Is Declared but Not Enforced, While Inline Event Handlers Remain Enabled

Content

View full analysis

× × 🔄翻译并覆盖 🚀 生成爆款文案 📋 💾 ▶ 🔄 重新生成（换表达重写） 📋 💾 ▶ 🗑️ 一键清空全部记录 ``` The declared policy in `skill.json` includes: ```json "contentSecurityPolicy": { "default-src": "'self'", "script-src": "'self' 'unsafe-inline'", "style-src": "'self' 'unsafe-inline'", "connect-src": "'self' https://tts.wangwangit.com https://api.mymemory.translated.net", "img-src": "'self' data: blob:", "media-src": "'self' blob:" } ``` The ...[truncated 2162 chars]

Remediation

View remediation

`, while recognizing that response headers provide stronger and more complete enforcement. 5. Move the inline application script into a local JavaScript file, or authorize it with a per-response nonce or a fixed hash. 6. Update `SKILL.md`, `skill.json`, and `manifest.json` so their security claims accurately describe the implemented and enforced controls. 7. Add an automated test that fails if inline event-handler attributes or an absent CSP are detected. ]]>

T08 · Insecure Dependencies

Note

• Location: README.md:47

Finding

Unpinned Third-Party Package Execution Through npx Startup Instructions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (23)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The privacy statement claims that all data is stored locally and that no user information is uploaded, but the same document describes TTS and translation features that require external network services. This can mislead users into entering sensitive text under a false privacy expectation, causing unintentional disclosure of content to third-party providers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README names external TTS and translation services but does not clearly warn users that their submitted text will be transmitted to those third-party endpoints for processing. In a skill that encourages users to paste arbitrary copy and generate voice output, this can lead to accidental disclosure of sensitive or proprietary content under a mistaken belief that data stays local.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill describes external TTS and translation services but does not clearly and prominently warn that user-entered text will be sent to third-party providers for processing. This creates a privacy risk because users may paste drafts, personal data, or proprietary content without realizing it leaves the local app boundary.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation makes a security claim that the translation API uses POST to avoid exposing user input in URLs, but elsewhere it points to MyMemory's /get endpoint and presents contradictory usage. This is dangerous because it can mislead users and reviewers about where sensitive text goes and how it is transmitted, weakening informed consent and trust assumptions around data exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The configured translation endpoint sends user text to an external domain, which is a genuine data-exposure surface even if it is necessary for functionality. In a content-generation skill, users may submit unpublished marketing copy or personal text, so undisclosed or under-disclosed external transmission increases privacy and confidentiality risk.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

翻译配置

javascript

const TRANSLATE_API_URL = 'https://api.mymemory.translated.net/get';

存储配置

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The API example explicitly shows translation requests to a third-party service, confirming that user content leaves the local environment. This is risky in context because the skill markets local storage and privacy-oriented behavior, so users may underestimate that their inputs are transmitted externally for processing.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

翻译服务

http

POST https://api.mymemory.translated.net/get
Content-Type: application/x-www-form-urlencoded

q={text}&langpair={source}|{target}

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are very broad and overlap with ordinary requests such as '生成文案', 'TTS', or '语音合成', which can cause the skill to activate when a user did not intend to use it. In this skill's context, unintended activation matters because it may route user text into third-party translation or TTS services and perform actions outside the user's expectations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents network-dependent TTS and translation behavior but does not provide a clear, consistent privacy warning; instead, the later privacy section contradicts that behavior. This increases the chance that users will submit proprietary or personal text to remote services without understanding that external processing occurs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document declares lang="zh-CN", which signals a fixed Chinese-language experience. Elsewhere the UI supports multiple output languages, but the page itself does not offer a language or locale choice, so this appears to impose a specific locale without user opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The hardcoded external translation endpoint expands the application's data-sharing surface and sends user text to infrastructure outside the app author's control. Even though the UI includes a privacy hint, the risk remains because copied marketing text, drafts, or other business-sensitive content may be disclosed to the service operator or intermediaries.

Content

Scanner excerpt · index.html (reported line 1939)May include surrounding context.

html

const langPair = `${sourceLang}|${targetLang}`;
            // 使用 POST 避免用户输入暴露在 URL 中
            const response = await fetch('https://api.mymemory.translated.net/get', {
                method: 'POST',
                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
                body: `q=${encodeURIComponent(text)}&langpair=${encodeURIComponent(langPair)}`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The hardcoded external translation endpoint expands the application's data-sharing surface and sends user text to infrastructure outside the app author's control. Even though the UI includes a privacy hint, the risk remains because copied marketing text, drafts, or other business-sensitive content may be disclosed to the service operator or intermediaries.

Content

Scanner excerpt · index.html (reported line 1939)May include surrounding context.

html

const langPair = `${sourceLang}|${targetLang}`;
            // 使用 POST 避免用户输入暴露在 URL 中
            const response = await fetch('https://api.mymemory.translated.net/get', {
                method: 'POST',
                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
                body: `q=${encodeURIComponent(text)}&langpair=${encodeURIComponent(langPair)}`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The manifest explicitly includes an external translation endpoint, which creates a path for user-provided text to leave the local environment and be processed by a third party. Because the service is free, externally hosted, and the manifest provides no data minimization, consent, retention, or trust controls, sensitive user content could be exposed unintentionally.

Content

Scanner excerpt · manifest.json (reported line 23)May include surrounding context.

json

},
      {
        "name": "MyMemory Translate",
        "url": "https://api.mymemory.translated.net/get",
        "purpose": "Translation service",
        "pricing": "free",
        "rateLimit": "5000 chars/day"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill hard-codes output language and style based on platform, without stating that the user can override or opt in to that language choice. This can produce responses in an unexpected language, mis-handle multilingual requests, or cause the system to ignore explicit user preferences, which is a prompt-safety and reliability issue rather than a direct code-execution risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad and overlap with generic writing and TTS requests, which can cause the skill to activate outside its intended narrow scope. Overbroad invocation can lead to unintended routing of user prompts, confusion about which instructions govern the response, and increased chance that platform-specific or stylistic constraints are applied when the user did not explicitly request them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest explicitly declares third-party network access for TTS and translation, but there is no user-facing disclosure or consent mechanism indicating that entered text may be transmitted off-device. In a content-generation skill, users may paste drafts, marketing copy, or sensitive business text, so silent transmission to external services creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The translation API endpoint indicates that user-provided text is sent to an external third-party service. Because this skill handles arbitrary copy pasted by users, that transmission can expose sensitive or proprietary content if users are unaware or if the provider's privacy practices are insufficient.

Content

Scanner excerpt · skill.json (reported line 56)May include surrounding context.

json

}
    },
    "translate": {
      "apiUrl": "https://api.mymemory.translated.net/get"
    },
    "storage": {
      "key": "copyRecords",

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The README specifies generation of Chinese copy for Douyin, Japanese copy for TikTok Japan, and English copy for TikTok US as fixed behavior. This is a natural-language locale policy concern because the documentation presents locale-specific output defaults without stating that the user can choose or opt into those language constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document specifies fixed output languages by platform, such as Chinese for 抖音, Japanese for TikTok Japan, and English for TikTok US, without indicating that users can choose or override the language. This may violate language/locale policy expectations because the skill imposes locale behavior rather than offering an explicit user choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The inline comment at L1938 states that POST is used to prevent user input from being exposed in the URL. While the code does use POST, the documentation makes a stronger privacy assertion than the implementation can guarantee when calling a third-party /get endpoint, so the comment overstates what the code ensures. This is an intent/documentation mismatch rather than a direct vulnerability.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This is a manifest file, so vague-trigger review applies. The manifest describes external translation and TTS services but does not specify any invocation phrases, activation conditions, or exclusion rules, leaving the skill's activation scope underspecified and potentially broad.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The description focuses on 'TikTok日区' and 'TikTok美区', and the feature list repeats region-specific output targets. While not inherently disallowed, this can be a locale-policy concern when a skill appears to steer users toward fixed locales without an explicit opt-in or justification in the natural-language metadata.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.