Security audit

秘书材料星公文写作-妙笔skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent online Chinese official-document writer, but it needs Review because it gives remote API responses instruction-level authority and asks the agent to perform broad cleanup/deletion and identity-linked data handling.

Review before installing. Use this only if you are comfortable sending your email and document request details to the publisher's gateway, and avoid including confidential names, finances, policy details, or internal plans unless the service's privacy terms are acceptable. The publisher should narrow remote response authority, remove broad deletion instructions, clarify retention/privacy disclosures, and pin optional dependencies.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:31
Finding: Remote API Responses Are Granted Instruction-Level Authority
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:163
Finding: Skill Directs Broad Deletion of Files and Cross-Session User State
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/word-export.md:33
Finding: Word Export Guidance Installs an Unpinned Third-Party Dependency
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:18
Finding: Privacy Disclosure Contradicts the Document Data Sent to the External Gateway
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger and description frame the skill as operating specifically for Chinese official document writing, and the instructions repeatedly require GB/T 9704-compliant output. While this may be justified by domain, the file does not explicitly state that the locale/language constraint is intentional or offer user opt-in/choice, so it reads as a forced locale policy in natural-language instructions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: L019 states as a hard rule that the agent must first ask the user for an email and must not prefill it from config. Later, L194 says that if config.json already has an email and the user does not provide a new one, the existing configured email may be used. These instructions are materially inconsistent because one forbids config-prefilled email while the other authorizes it.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: L515 says the fixed API paths are /api/register, /api/consume, /api/search, etc. But the operational sections repeatedly instruct calls to /register, /consume, /search, /quota, and /kb/search (for example L216-L221, L242, L290-L299, L527). This is an active contradiction in the documentation of what the agent should call.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The title and formatting requirements are explicitly tied to Chinese official-document standards (GB/T 9704-2012) and prescribe Chinese fonts and conventions throughout. Under the policy rule, forcing a specific language/locale without offering user choice can be a natural-language policy violation unless clearly justified as region-specific; this file does not state such a limitation explicitly.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.