Security audit

Gov Service Wechat Layout

Security checks for vulnerabilities and agentic risk

Overview

This skill is a purpose-aligned WeChat government-service article layout template pack with no evidence of hidden execution, data theft, persistence beyond normal installation, or destructive behavior.

Install this when you specifically want Chinese government/public-service WeChat article templates. Review generated HTML and replace all placeholders, phone numbers, links, QR codes, dates, and legal/policy details before publishing; avoid running the auxiliary icon script unless you edit its output path.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose describes a user-facing WeChat article formatting/layout skill with templates and theme-color switching. The actual code chunk does not perform article formatting, template application, theme switching for content, or any公众号排版 behavior. Instead, it is an internal asset-generation script that creates a static icon image and saves it locally. While the icon visually relates to the skill’s branding, this code’s primary behavior is materially different from the declared purpose, so this chunk is a mismatch.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill description and all user-facing examples are presented only in Chinese and are scoped to Chinese public-account formatting, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README advertises very broad trigger phrases like '给这篇社保推文排版' and '套用模板' without clear scoping or explicit activation boundaries. In an agent ecosystem, generic invocations increase the chance of accidental routing on ordinary user requests, which can cause unintended HTML generation, content transformation, or interference with other skills handling similar public-service content workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file describes activation using open-ended examples like "排版这篇社保推文" and "用办事指南模板排这篇" without defining a precise trigger boundary or exclusion conditions. Because the examples resemble normal conversational editing requests, the skill could be invoked in contexts broader than intended.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description lists trigger phrases such as “套用模板” and “换色,” which are generic requests that can occur in many unrelated writing or design contexts. Without stronger scoping in the trigger itself, these broad phrases could cause unintended invocation outside the intended government WeChat-layout use case.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire template, including all user-facing instructional text, is written exclusively in Chinese and provides no indication that language selection is optional or configurable. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This file is a natural-language template and all user-facing text is fixed in Chinese, with no indication that users can choose another language or that the template is limited to a Chinese-language audience by policy. Under the stated rule, forcing a specific language without user opt-in is a language/locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Line L49 explicitly specifies '国家医保局官方 CHS 字形色', indicating a Chinese-language/locale-specific requirement in the skill content. The file does not offer any language or locale choice, nor does it explain that the skill is restricted to a region-specific workflow, so this appears to violate the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire document prescribes Chinese-specific content patterns, wording, and typography conventions such as Chinese headings, Chinese copy templates, and WeChat public-account formatting, but it does not state that this skill is region-specific or that users may opt into another language. This can violate language/locale policy because it effectively forces a single language and locale without explicit user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The entire SOP is written as a Chinese-only workflow and includes language-specific style guidance such as "中文无衬线为主" and maintaining a unified persona tone, but it does not indicate that language choice is optional or limited to a justified region-specific use case. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations in natural-language text. This changelog switches to Chinese for substantive release notes, with no indication that the skill is China-specific or that users can choose another language, which can conflict with organizational language-choice expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The English README directs users to README.md in Chinese for the full guide, which effectively imposes a specific language for essential usage details. This can violate language-choice expectations because no English alternative or opt-in is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file is natural-language template content written entirely in Chinese and assumes a Chinese-speaking audience throughout, including headings, warnings, and user guidance. Under the policy rule for language/locale, this is a violation unless the skill explicitly offers a language choice or clearly documents a justified region-specific constraint, which this file does not.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The template content is entirely written in Chinese and provides no indication that users can select another language or locale. Under the policy rule for natural-language violations, this constitutes a locale/language constraint without user opt-in or documented justification in the file itself.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s instructional comments and user-facing template content are entirely written in Chinese and assume Chinese-speaking end users (for example, city hotline, public account, and citizen-facing phrasing). Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the constraint is explicitly documented and justified, which this template does not do.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This template is written fully in Chinese and includes fixed user-facing Chinese copy such as headings, guidance, and footer text. Under the language/locale policy rule, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The script saves output directly to a hard-coded filesystem path, which is a file write operation covered by the missing-user-warnings rule for code files. While the module docstring explains the script's purpose, there is no warning or prompt about overwriting or creating the file at that specific location before the save occurs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.