小云雀创作工具包

• Outcome: Pass
• Latest audit: Sep 23, 2026 · 10:20 AM UTC
• Version: 1.2.0

Overview

This skill is a disclosed Pippit/XYQ media and canvas automation wrapper, with expected account, upload, install, and canvas-write behaviors for that purpose.

Install this only if you intend to use the XYQ/Pippit service with your account. Expect the skill to install/cache the Pippit CLI, open or reuse CLI login, upload referenced local media to the service, consume credits for generation/processing, download results locally, and modify personal Canvas documents when you ask it to.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · commands/generate-video.md (reported line 32)May include surrounding context.

bash

pippit-tool-cli model list
pippit-tool-cli model describe MiniMax-H3
pippit-tool-cli generate-video --prompt "用户原始描述" --model MiniMax-H3 --ratio 16:9

模型查询失败时提示重试，不从本文示例推定模型仍然可用，不自行替换用户指定的模型。Wan 同样必须有提示词；文件和网页链接输入不在本命令范围内。

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is broad enough that a user merely mentioning '小云雀' or 'xyq' alongside loosely related media tasks could activate this skill unintentionally. That can cause the agent to route requests into a capability-heavy skill that performs authentication checks, media generation, downloads, and account-affecting actions, increasing the chance of unintended execution or unnecessary exposure to external services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The display name and description are entirely in Chinese, which indicates a language-specific presentation without any visible user opt-in or documented justification in this file. Under the stated policy, forcing a specific language or locale without choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly states that local reference images are uploaded automatically by the command, but it does not require an explicit user-facing warning or confirmation at the point of use. This creates a real privacy and data-transmission risk because users may provide local files assuming they are processed locally, when in fact they are sent to a remote service and may contain sensitive personal or proprietary content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The command documentation explicitly states that a local video file will be uploaded internally, but it does not clearly warn about data transmission, external processing, or privacy implications. This can cause users or host agents to send sensitive local media off-device without informed consent, which is especially risky for personal, proprietary, or regulated content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file’s instructions and example user interactions are fully Chinese-language, which can amount to a language/locale restriction if the skill is intended for general use. There is no visible opt-in, alternative language option, or justification that this skill is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file contains user-visible error/help text in Chinese, which imposes a specific language on all users. The policy allows locale constraints only when users are given a choice or the constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The Node/version and platform support errors are presented only in Chinese. Because this is executable code intended to interact with users, Chinese-only messaging constitutes a language policy violation unless the locale limitation is disclosed or user-selectable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The command usage/help and runtime failure output are emitted only in Chinese, forcing a language choice on users. No opt-in, fallback language, or documented regional scope is present in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s operational instructions are exclusively in Chinese, which can impose a specific language on users or operators without opt-in. The policy allows fixed locale only when the skill offers language choice or clearly documents a justified regional constraint, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file’s user-facing instructions are entirely in Chinese, which can impose a language requirement on users without any opt-in or alternative locale. The policy explicitly calls for flagging language or locale constraints when the skill forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instructions direct the agent to modify an existing user canvas by creating a new role node, but they do not require an explicit confirmation or warning immediately before making the change. In an agent setting, this increases the chance of unintended writes to user data, especially if the provided canvas ID is wrong, stale, or ambiguously referenced.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file presents all user-facing instructions and examples only in Chinese. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill file presents all instructions and expected behaviors only in Chinese, with no indication that the user can choose another language or that the locale restriction is intentional and justified. This can violate a language/locale policy when a skill implicitly forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The markdown specifies automatic installation, upgrade, cache reuse, and path-related behavior for a CLI, which can affect the user's local system state. In this description, there is no explicit warning that the skill may install or upgrade tooling or modify environment-related state during execution.

Content

No source excerpt is available for this finding.