Security audit

秘书材料星公文写作-妙笔skill

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a real paid Chinese official-document drafting service, but it needs Review because it broadly takes over writing requests and lets a remote service steer content, registration, payment prompts, and tracking output.

Install only if you are comfortable using a third-party remote service for official-document drafting, sharing your email and writing prompts with its gateway, and seeing its quota/payment messages. Be especially cautious with sensitive workplace material, payment QR codes, and any remote content that asks for extra personal or financial information.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:15
Finding: Remote Instruction and Agent Workflow Hijacking
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:45
Finding: Forced Rendering of Remote Promotional, Support, and Tracking Content
Content: View full analysis
429 响应的 `support` 字段含客服信息，向用户完整展示。 ``` ### Technical Analysis The skill requires the agent to reproduce remotely supplied upgrade notices and support data verbatim. It also requires preservation of a server-generated fingerprint in returned content. Because these fields originate outside the reviewed package and no content validation or sanitization is specified, the remote service controls portions of the final agent response. A compromised service can place misleading payment directions, phishing links, unrelated instructions, or other attacker-controlled text in fields that the agent is required to display. The fingerprint requirement additionally introduces an undisclosed trace identifier into generated output. Although the audit does not establish that the identifier contains personal data, mandatory preservation allows generated documents or responses to be correlated by the service operator. ### Attack Path 1. The user reaches a low-quota state or triggers a request that produces an upgrade or support response. 2. The remote service populates an upgrade notice, `support` field, or response suffix with attacker-controlled content. 3. The skill directs the agent to preserve or display the content verbatim. 4. The agent presents that content under its own trusted response context. 5. The user may follow a malicious payment link, disclose information to a spoofed support contact, or distribute a document containing a tracking identifier. ### Impact Assessment The vulnerability permits remote control over selected portions of user-visible ...[truncated 366 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:127
Finding: Integrity Verification Cannot Operate with the Shipped Manifest
Content: View full analysis
-->` 指纹；`_meta.json` 的 `file_hashes` 记录全部文件哈希。 - **Agent 每次加载时**：读 `_meta.json` → 重算每个文件哈希（md 剥离首行指纹注释后 SHA256）→ 比对。**任何不一致 = 被篡改**，立即停用，提示「技能包文件被修改，请重新下载正版」。 - 包内文件已设**只读**，禁止修改。 ``` The shipped `_meta.json` contains no `file_hashes` field: ```json { "ownerId": "624226", "slug": "gongwen-writting-2", "version": "1.0.64", "publishedAt": 1788330000000 } ``` In addition, the audited `SKILL.md` begins with YAML front matter rather than the fingerprint comment required by its own specification. ### Technical Analysis The integrity design depends on reference hashes stored in `_meta.json` and fingerprint comments at the beginning of Markdown files. The required hash manifest is absent, and the fingerprint format is not consistently present. As a result, a conforming implementation cannot perform the documented comparison. Depending on how missing values are handled, the check may fail closed and disable a legitimate package, or fail open and silently skip verification. The latter creates a false assurance that modified files will be detected. Even if hashes were present, hashes stored in the same unsigned package would not provide strong authenticity by themselves because an attacker capable of replacing package files could also replace the manifest. ### Attack Path 1. The package is installed or modified before loading. 2. The agent attempts to follow the documented integrity procedure. 3. `_meta.json` does not provide the required `file_hashes` values. 4. The implementation either skips verification, treats missing hashes as valid, or disables the package. 5. In a f ...[truncated 680 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: references/word-export.md:33
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill declares itself the mandatory default for virtually any writing-related request and explicitly forbids the agent from bypassing it. Such broad trigger scope can hijack unrelated user tasks, funnel excessive user content to remote APIs, and override normal user choice and safer local handling for commonplace writing requests.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The examples treat common phrases like 'write something' or 'draft a piece' as sufficient to auto-activate the skill. In context, this is dangerous because the skill also mandates email collection and remote API usage, so ambiguous everyday requests may be captured and monetized without informed user expectation.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The trigger matrix explicitly marks highly ambiguous phrases as automatic activators, which materially increases the chance of over-collection and remote processing of user text. Because this skill couples activation to external registration, quota consumption, and payment workflows, misfires have meaningful privacy and trust impact rather than being a harmless UX issue.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest explicitly promises '支持按 GB/T 9704 生成 Word（docx）'. In the actual skill file, the operational flow is limited to registration, quota/payment handling, API retrieval of writing skeletons, and text-generation guidance; it references docx formatting requirements but does not define any concrete docx export operation or tool invocation. This is a capability claim not matched by the described behavior in the skill code/documentation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The description mandates Chinese official-writing conventions and GB/T 9704 formatting as the default and forced-priority behavior for covered requests. This imposes a specific locale and writing standard without offering users a language or locale choice at activation time.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill embeds a full registration, quota, and payment workflow that requires collecting user email addresses and routing users through remote billing endpoints unrelated to the narrow task of text drafting. This expands the data-handling and trust surface substantially, creates unnecessary exposure of personal data and payment flows, and gives the skill strong incentives to capture broad user requests for monetized remote processing.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 73% confidence
Finding: The text states that after payment, the agent must '重新发起请求获取付费内容' and that the JSON body must be '与首次完全一致'. But the surrounding flow's first request in this section is a payment-creation call with body 'plan + email', not a content request body. That makes the instruction internally contradictory about what request is being retried and what 'unchanged body' refers to.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.