Security audit

热点分析与爆款挖掘

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Chinese-language content-trend research guide that uses public web/search analysis and does not include code, installation steps, persistence, credential use, or hidden execution behavior.

Install this if you want Chinese-language public trend research for content planning. Review the broad trigger wording and recency assumptions, and verify important platform metrics manually because the skill itself notes that search snippets can be incomplete or estimated.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger examples include broad, natural-language phrases such as asking for the latest topics or recent hot trends, which can overlap with ordinary user requests and cause the skill to activate unintentionally. Because the metadata also says the skill 'must' be used for these classes of prompts, this increases the chance of overbroad routing and unintended delegation to external trend-mining behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description uses broad trigger phrases and says the skill 'must' be used for common requests like recent hot topics or topic recommendations. Overbroad mandatory activation can cause unintended invocation, increasing the chance that the agent routes benign conversations into external-search and content-mining behavior without sufficient relevance checks or user intent confirmation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation instructions mandate use for loosely bounded scenarios and do not provide clear limits, exclusions, or disambiguation rules. In an agent system, this can hijack task routing, cause unnecessary tool usage, and expand exposure to untrusted web content when a safer or simpler response path would be more appropriate.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 482)May include surrounding context.
md
### 网络搜索工具不可用 | 情况 | 处理方式 | | ---------------- | --------------------------------------------------------------------------------------------------- | | 搜索工具返回错误 | 1. 向用户说明当前无法获取实时数据 2. 基于已有知识提供一般性分析 3. 建议稍后重试或提供具体话题 | | 搜索结果为空 | 1. 尝试使用更宽泛的关键词 2. 更换搜索词组合 3. 如仍无结果，标注"该平台暂无相关爆款" |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 497)May include surrounding context.
md
### 时效性无法满足 | 情况 | 处理方式 | | ---------------------- | ------------------------------------------------------------------------------------------- | | 搜索结果均为 2026 年前 | 1. 标注"近期内容较少，以下为历史参考" 2. 建议用户更换话题 3. 或基于旧数据提供趋势分析 | | 无法确认发布时间 | 1. 标注 🕐 时间待确认 2. 降低该数据权重 3. 优先使用有时间戳的内容 |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The title and entire guide are written exclusively in Chinese, which signals a fixed language/locale for the skill content. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire markdown file is written in Chinese and presents the guidance as the default operating language, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-specific compliance or regional context. Under the policy rule, a forced language or locale without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file contains only Chinese-language headings and content, and nowhere indicates that the user may choose another language or that the file is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: 整个 README 仅以中文描述能力、触发方式和示例输入，没有说明是否支持其他语言，也没有提供用户可选择输出语言的选项。按自然语言政策要求，若技能在语言或 locale 上形成隐性强制，且未提供 opt-in 或选择机制，可能构成语言策略问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language interface, trigger examples, and operating instructions are entirely in Chinese, and the skill requires use based on Chinese-language phrasing without any opt-in or language-selection guidance. This can violate language/locale policy where users should be given a choice rather than having a language implicitly forced.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: L137 将时效性标准写为“必须为 2026 年后发布，优先近 30 天内”，L153 又称“必须确保数据源为近一个月内（2026 年之后）”。这两处把“近一个月内”和“2026 年之后”混为同一强制要求，实际约束范围明显不同，属于文档内部对技能执行标准的主动矛盾。
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: 主流程在 L150-L153 规定 30 天以上内容应排除，且 2026 年前内容应排除或仅标注为历史数据；但异常处理在 L499 明确允许当搜索结果均为 2026 年前时“基于旧数据提供趋势分析”。这不是简单遗漏，而是对是否允许使用过期/历史数据给出了相互冲突的操作指令。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown guide presents all instructions in Chinese and does not indicate that language selection is optional or configurable. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.