Security audit

抓取某个微博用户在某个时间发的微博内容。只需要说：抓一下XXX的微博。

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed browser workflow for collecting public Weibo posts, with no evidence of credential use, persistence, local data access, or destructive behavior.

Install this only if you want an agent to browse public Weibo pages and summarize or extract posts for a specified user. Because the activation wording is broad, confirm the target user and date range before letting it run, and avoid using it for private, logged-in, or non-consensual data collection.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The trigger phrases are broad and include generic terms like “weibo” and “看微博,” which can match ordinary conversation and cause the skill to activate when the user did not clearly request scraping. Because this skill drives a browser to collect third-party content, accidental invocation can lead to unintended browsing, over-collection of data, and confusing or privacy-impacting behavior.

Natural-Language Policy Violations

Medium

Confidence: 86% confidence
Finding: L03 的描述全文以中文规定技能使用方式和输出预期，但未说明这是可选语言，也未提供语言/locale 选择。按规则，若技能隐含强制特定语言而没有用户 opt-in，属于自然语言政策风险。

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The natural-language instructions in this file are written in Chinese and direct the operator to use the snippets in that language context, without offering an alternative language or documenting a justified locale constraint. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Static analysis

No suspicious patterns detected.