SkillSpector · doubao-journal-format

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

render_docx.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

render_docx.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

render_docx.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

render_docx.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/extract_pdf_format.py

Dynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

scripts/extract_pdf_format.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/render_and_diff.py

Without declared permissions the skill's intent is opaque and cannot be validated.

SKILL.md

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

references/preservation-rules.md

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

render_docx.py

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

SKILL.md

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

scripts/extract_pdf_format.py

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

scripts/extract_pdf_format.py