Security audit

kitt-writer

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese long-form WeChat writing style skill with disclosed persona and footer behavior, not a code- or credential-accessing skill.

Install this only if you want Chinese WeChat-style long-form writing in Kitt's voice. Before publishing, review or remove the fixed call-to-action and Kitt byline unless that attribution and promotion are intended.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:244
Finding: Mandatory Promotional Footer and Third-Party Authorship Attribution
Content: View full analysis
/ Author: Kitt Is Evolving ``` ### Technical Analysis The Skill requires generated articles to include a fixed engagement solicitation and third-party author attribution. Because this behavior is defined as a mandatory footer rather than an optional style example, loading and following the Skill can alter the final output independently of the user's actual request. This constitutes Skill instruction hijacking at the output level. An Agent following the template may add promotional material and represent the content as authored by Kitt even when the user neither requested the promotion nor authorized that attribution. The surrounding mandatory writing workflow increases the likelihood that the injected footer will persist into the final response. The issue does not provide operating-system privileges, code execution, credential access, network access, or persistence. Its scope is limited to manipulation of generated content and attribution. ### Attack Path 1. A user submits a request for a long-form WeChat article that triggers the Skill. 2. The Agent loads and follows the instructions in `SKILL.md`. 3. The article is generated according to the prescribed structure. 4. Lines 244-246 direct the Agent to append the fixed promotional call to action and Kitt author attribution. 5. Unless the user manually detects and removes it, the manipulated content may be published with unsolicited promotion and inaccurate authorship information. ### Impact Assessment The affected privilege is control over the Agent's generated art ...[truncated 553 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger list is intentionally broad and includes generic requests like 帮我写, 写文章, 续写, 扩写, and 用我的风格写一下, which can match many ordinary writing tasks outside the intended公众号长文 scope. In an agent system, this can cause the skill to activate when a user did not ask for this persona or format, leading to prompt hijacking of benign tasks and reduced user control over outputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs the agent to write as 数字生命Kitt智能体 and imposes a fixed persona, tone, and output convention without requiring user opt-in at runtime. If auto-invoked, this can override a user's requested voice, neutrality, or language preferences and produce impersonation-style content that the user did not explicitly authorize.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The title and all instructional content are written exclusively in Chinese, which implies a fixed language/locale requirement. The file does not offer any user language choice or explain that the skill is intentionally region-specific, which matches the policy category for forced language without opt-in.
Content: No source excerpt is available for this finding.