小云雀图片与视频创作

• Outcome: Review
• Latest audit: Sep 22, 2026 · 5:50 AM UTC
• Version: 1.1.0

Overview

This skill is a disclosed, purpose-aligned bridge to a remote media-generation and canvas-editing CLI, with expected privacy, billing, and install-time considerations.

Install only if you are comfortable using Pippit/XiaoYunque through an authenticated CLI. Generation and processing may consume credits, local media paths can be uploaded to the remote service, outputs are downloaded locally, and the skill may install or update the Pippit CLI in your user cache.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

External Model or Provider Selection

High

• Category: Excessive Agency

Content

```bash
pippit-tool-cli model list
pippit-tool-cli model describe MiniMax-H3
pippit-tool-cli generate-video --prompt "用户原始描述" --model MiniMax-H3 --ratio 16:9
```

模型查询失败时提示重试，不从本文示例推定模型仍然可用，不自行替换用户指定的模型。Wan 同样必须有提示词；文件和网页链接输入不在本命令范围内。

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no explicit tool scope or permissions boundaries, yet it instructs the agent to execute Node-based scripts and use environment-dependent CLI setup. Without an allowlist, a broadly invocable skill can gain access to more host capabilities than necessary, increasing the chance of unintended command execution paths or environment data exposure if the surrounding platform grants them.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger description is broad enough that simple mentions of '小云雀' or 'xyq' may invoke the skill even when the user is only discussing the product, not asking to run media-generation or account-related operations. That can cause unintended activation of a powerful skill that performs authenticated actions, spends credits, or manipulates user media/canvas resources.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The entire skill file is written in Chinese and does not state that language selection is optional or user-configurable. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless clearly documented and justified.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly states that a local video path will be uploaded, but it does not clearly disclose to the user that their file leaves the local environment or may be processed by a remote service. This creates a privacy and data-handling risk, especially if users provide sensitive media under the assumption that processing is local.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the host agent to silently populate a source-tracking parameter without user knowledge or consent. Hidden telemetry or attribution fields can leak contextual information about the user's environment or platform and undermine transparency expectations, especially when paired with file uploads to a remote service.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that local reference images are uploaded internally, but it does not clearly warn the user at the point of use that providing a local file path causes the file contents to be transmitted to an external service. This can lead to unintended disclosure of sensitive local images or embedded metadata, especially because users may interpret a local path as a purely local operation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly states that a local video file will be uploaded internally, but it does not require the agent to warn the user that local media will be transmitted to an external service. This creates a privacy and data-handling risk, especially for sensitive or proprietary videos, because users may believe processing is local when it is not.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The instruction says to report only a specific Chinese phrase, which imposes a language choice on the user. The file does not offer a language/locale option or explain that this skill is intentionally limited to a Chinese-language context.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The example instructs the agent to invoke a paid third-party media-generation workflow and download outputs without any explicit requirement to warn the user about billing implications or that prompt/data will be sent to an external service. In an agent setting, this can lead to unintended charges and privacy surprises because the workflow is presented as a normal execution path once the user asks for generation.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This markdown file contains all user-facing operational instructions in Chinese and does not provide an opt-in, alternative language, or justification for the locale restriction. That can violate language/locale policy when users are not explicitly told the skill is Chinese-only or given a choice.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The workflow content is entirely in Chinese and does not provide any mechanism to detect or honor the user's preferred language. This can cause users to misunderstand task state, error handling, or delivery limitations, which is especially relevant in an asynchronous media-delivery flow where clarity around failures and completion is important.

Natural-Language Policy Violations

Low

• Confidence: 75% confidence
• Finding: All user-facing natural-language instructions in this file are in Chinese, and the skill does not indicate that users may choose another language or that the locale restriction is required for a region-specific purpose. This can be a language/locale policy concern under the stated rule.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This markdown file contains user-facing instructions and example prompts only in Chinese, which may impose a specific language/locale without offering alternatives. The policy requires flagging language or locale constraints when they are forced without explicit user opt-in or justification.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This markdown file instructs the operator to run `query-result` with `--download-dir "./xyq_output"`, which writes files to the local filesystem. The scenario text does not include any explicit warning or disclosure that outputs will be downloaded and stored locally, which is a user-impacting behavior covered by the markdown warning criterion.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: This markdown file describes behaviors that include installing a Node-based CLI, upgrading commands, reusing caches, and checking or modifying project skill directories. For markdown files, SQP-2 applies when descriptions omit warnings about actions that may affect the user's system; these lines describe system-changing behavior but do not include a user-facing warning or caution in this section.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/ensure-cli.js:66