Security audit

秘书材料星公文写作-妙笔skill

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly coherent online Chinese official-document writing skill, but it asks for account/payment integration and broad automatic cleanup of history/cache/clipboard data that users should review carefully.

Install only if you are comfortable registering with an email, sending document prompts to the publisher's gateway, using the stated paid quota/payment flow, and allowing the skill to store a local service token. Review or disable any instruction that would delete prior conversation history, caches, memory, clipboard contents, or local knowledge files without an explicit confirmation step.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: Earlier in the file, the skill states as a hard rule that the agent must first ask the user for an email and must not use a config-prepopulated email. However, the registration section later explicitly allows using an email already configured in config.json if the user does not provide a new one. This is an active contradiction in the documented intent about whether prefilled local identity data may be reused.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The file says the package contains '0 knowledge base 0 logic' and that all writing knowledge and methodology come only from the API. But the same file embeds extensive writing constraints and generation rules, including anti-fabrication rules, template flow, formatting rules, triggering boundaries, and output behavior. That is a direct contradiction between the documentation's claim about package contents and what the package documentation actually includes.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The activation text says the skill triggers whenever a user wants to write or asks about format, structure, or writing style for a long list of document types, and later examples include broad phrases like "总结怎么写" and "公文格式有哪些要求." These conditions do not provide clear exclusion boundaries beyond a few examples, so normal general-writing or advisory requests could unintentionally invoke the skill.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The description frames the skill as producing Chinese official documents under GB/T 9704 and all user-facing instructions are fixed to that locale and language, but the file does not offer an opt-in or alternative language choice. Under the stated policy, forcing a specific language or locale without user choice is a natural-language policy issue unless clearly documented as a justified region-specific constraint.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: This markdown file includes executable example code that saves a file locally via `doc.save('公文.docx')`. The surrounding instructions describe how to generate the document, but there is no explicit warning that running the script will create or overwrite a local file, which is the type of file-affecting behavior SQP-2 asks markdown/code reviewers to disclose.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The instructions are framed as the default export guidance and require GB/T 9704-2012 official-document formatting, Chinese fonts, and Chinese title/body conventions. Because the skill text does not state that this is only for China-specific government-document use cases or offer an alternative locale/format, it appears to impose a specific language/locale convention without opt-in.

Static analysis

No suspicious patterns detected.