Cjl Plugin

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:09 AM UTC
• Version: 0.1.0

Overview

The skill collection is not clearly malicious, but it needs review because it combines broad file-writing workflows with browser-cookie use, mutable dependency installation, subagents, and instructions that weaken normal verification.

Review before installing. Use it only if you are comfortable with skills writing notes under ~/Documents/notes and outputs under ~/Downloads. Do not use the Chrome-cookie fallback unless you explicitly intend to let yt-dlp read browser session cookies. Prefer confirming output paths, pinning dependencies, and checking generated cards/slides for hardcoded attribution or remote scripts before sharing them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: skills/cjl-card/SKILL.md:51

Finding

Forced Third-Party Branding and False Authorship in User Deliverables

Content

View full analysis

来源文字`，否则空字符串。 ``` `skills/cjl-writes/SKILL.md:32-39`: ```org ### Org file header #+title: {title} #+date: [{YYYY-MM-DD Day HH:MM}] #+filetags: :write: #+identifier: {YYYYMMDDTHHMMSS} #+author: 李继刚 ``` ### Technical Analysis The card skill requires generated visual deliverables to contain a fixed logo and personal name. The writing skill independently assigns the same fixed person as the author of generated documents. These instructions are not derived from user input and are applied as part of ordinary output generation. Consequently, loading the skill changes the agent's output objective from producing a neutral user deliverable to producing content branded or attributed to a third party. This is instruction-level output hijacking because the behavior is embedded directly in the skill text rather than being requested by the user. ### Attack Path 1. A user invokes `cjl-card` to create a visual asset or `cjl-writes` to create an article. 2. The agent loads and follows the corresponding `SKILL.md`. 3. The card workflow inserts the fixed logo and personal name, or the writing workflow inserts the fixed `#+author` value. 4. The generated file is delivered to the user with third-party branding or authorship. 5. If the user republishes the output with ...[truncated 540 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: skills/cjl-paper-flow/SKILL.md:12

Finding

Workflow Instructions Explicitly Disable the Host Agent's Planning and Verification Process

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: skills/cjl-x-download/SKILL.md:70

Finding

Chrome Authentication Cookies Are Accessed as a Download Troubleshooting Fallback

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: skills/cjl-card/SKILL.md:39

Finding

Unpinned Playwright Installation Executes an Unreviewed Dependency Chain

Content

View full analysis

[fullpage] ``` Dependency: Playwright under `~/.claude/skills/cjl-card/node_modules/`. If an error occurs: ```bash cd ~/.claude/skills/cjl-card && npm install playwright && npx playwright install chromium ``` ``` Original dependency instruction: ```text 依赖：`~/.claude/skills/cjl-card/node_modules/` 中的 playwright。如报错： ```bash cd ~/.claude/skills/cjl-card && npm install playwright && npx playwright install chromium ``` ``` ### Technical Analysis The recovery command installs `playwright` without an exact version, package lock, or integrity policy. Package resolution therefore depends on the registry state at execution time and can produce a dependency graph different from the one reviewed by the skill author. The command also invokes `npx playwright install chromium`, executing package-provided code and downloading a browser binary. npm package installation may execute lifecycle scripts unless separately restricted. The audited artifact does not include the referenced `assets/capture.js`, card templates, or a lockfile, so the complete rendering path cannot be independently reviewed or reproduced from the submitted files. ### Attack Path 1. A user invokes the card-generation skill. 2. The expected Playwright dependency is missing or the rendering command fails. 3. The skill recommends `npm install playwright`. 4. npm resolves the current registry version and its transitive dependency graph. 5. Package lifecycle behavior may execute during installation. 6. `npx playwright install chromium` runs package code and downloads an external browser build. 7. If the package source, account, registry response, transitive dependency, or down ...[truncated 738 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Note

• Location: skills/cjl-slides/SKILL.md:202

Finding

Generated Presentations Retrieve and Execute Remote JavaScript Despite Offline-Operation Claims

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (67)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to save sensitive relationship disclosures and psychological analysis locally but does not warn the user that this will happen. In this context, omission of a storage warning is particularly dangerous because users may reveal intimate, reputational, or mental-health-related details under the assumption that the exchange is transient.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · skills/cjl-x-download/SKILL.md (reported line 73)May include surrounding context.

=jpg&name=orig" curl -L -o ~/Downloads/tweet_ID_2.jpg "https://pbs.twimg.com/media/yyy?format=jpg&name=orig"

text

文件扩展名跟随 URL 中的 `format` 参数（jpg/png/webp）。

### 4. 汇报结果

下载完成后，用 `ls -lh` 列出已下载的文件：文件名、大小、路径。

## 故障排除

### 需要登录

yt-dlp 报错含 `login` / `Sign in` / `age-restricted` 时，加 `--cookies-from-browser chrome`：

```bash
yt-dlp --cookies-from-browser chrome -o "~/Downloads/%(uploader)s_%(id)s.%(ext)s" "URL"

推文无媒体

纯文字推文没有可下载的媒体。告知用户即可。

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · CLAUDE.md (reported line 3)May include surrounding context.

md

# CJL Skills Collection — Development Guide

This is a personal Claude Code skills repository. Each skill is a self-contained directory installable to `~/.claude/skills/` to extend Claude Code's capabilities.

## Repository Structure

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CLAUDE.md (reported line 45)May include surrounding context.

md

## Adding a New Skill

1. Create `skills/cjl-{name}/SKILL.md`
2. Add frontmatter with `name`, `description`, `user_invocable`, `version`
3. Write the skill content
4. Update `README.md` skill table

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README says skills are triggered via '/skill-name or natural language' without defining what natural-language phrases qualify or where the boundary is. This broad activation description could overlap with ordinary conversation and lead to unintended invocation because no examples, constraints, or exclusions are provided.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

At L46 the design principle says each skill is "自己完結型: 外部状態依存なし" (self-contained, no external state dependency). However, the README elsewhere states installation from GitHub (L56, L62), a Node.js + Playwright dependency for cjl-card (L71), and includes skills whose described functions inherently rely on external platforms or sources such as X/Twitter downloading (L33) and travel/investment research (L29, L35). This is an active contradiction in the documentation about the plugin's operational model.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that each skill can be launched via '/skill name or natural language' without defining what phrases qualify, what context is required, or what should not trigger activation. This is an ambiguous invocation description in a markdown file and could cause unintended activations from ordinary user requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

L33 介绍了“X/Twitter 媒体下载器”，这类功能可能涉及下载第三方内容、账户相关数据或受平台规则约束的媒体。当前文档仅陈述功能名称，没有提醒用户注意版权、隐私影响或遵守平台条款。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

L47 写明技能可“通过 /技能名 或自然语言激活”，但没有列出具体触发短语、适用范围或不应触发的负例。对于 README 这类说明文件，这种宽泛表述会让调用条件变得模糊，增加与日常表达重叠而误触发的风险。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The plugin advertises 17 skills and static analysis detected file read/write capabilities, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. That creates an unnecessary trust gap: users and the host agent cannot easily constrain or audit what file operations the skill may perform, increasing the risk of unintended file access or modification if any sub-skill is unsafe or prompt-injectable.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest says the plugin is 'User-invocable' via '/cjl-{name} or natural language', while the overall description covers many unrelated tasks. Broad natural-language activation can cause accidental invocation of the wrong skill, which matters more here because the plugin bundles many commands and at least some detected code capabilities include file access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description lists activation phrases such as 'cast', 'comic', and 'whiteboard', which are common everyday words and not sufficiently constrained to this skill's specific function. The file does not provide exclusion conditions or negative examples to clarify when these terms should or should not trigger the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The skill instructs use of npx playwright without pinning a specific version, which can pull the latest package or execute package-provided install logic unpredictably. In a user-invocable skill that produces files locally, this increases supply-chain risk if a compromised or breaking upstream version is fetched at execution time.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are broad enough to activate on generic requests like '分析这个项目' or when users paste meeting notes or interviews, which can cause the wrong skill to run without clear user intent. In this context, unintended invocation matters because the skill is opinionated, performs research, and is configured to write files, increasing the chance of unwanted data processing and side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to write output directly to a fixed path under the user's home directory without requiring confirmation, existence checks, or a safer workspace boundary. This creates a real risk of unintended filesystem side effects, including silent creation of files containing sensitive investment notes or overwriting/cluttering personal directories if the skill is triggered unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are very broad and overlap with common requests like 'explain concept' or 'learn concept,' increasing the chance the skill activates in routine conversations. Because the skill includes side-effecting behavior such as file creation, broad activation makes those side effects more likely to occur without the user understanding that a specialized skill has taken over.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language instructions are written as a fixed Chinese persona and the example/output structure is entirely Chinese, while the trigger list includes English phrases such as 'explain concept' and 'learn concept'. This creates a language policy concern because the skill appears to force a specific language without documenting user opt-in or offering a locale choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill goes beyond concept explanation and instructs the agent to persist content to a fixed local path in the user's Documents directory. Unprompted filesystem writes create side effects, may overwrite or expose user data patterns, and violate least-privilege expectations for an educational/explanatory skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs writing a file into the user's Documents folder without any warning, consent, or confirmation step. In context, this is more dangerous because the skill may trigger on ordinary learning requests, so users could unknowingly cause local writes and accumulation of files in a sensitive personal directory.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction to run a shell-style timestamp command and then save a file introduces unnecessary command execution and persistence for a concept-learning skill. Even a simple command expands the agent's execution surface and normalizes tool use unrelated to the stated purpose, which is risky when handling adversarial or unexpected inputs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger condition is broad enough that the skill may auto-activate whenever a user mentions multiple papers and wants both analysis and cards, even if they did not explicitly request this exact workflow. That can cause unexpected processing of multiple inputs and downstream file generation or network/file access through chained sub-skills, increasing the chance of unintended actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly creates org and PNG artifacts but does not disclose this side effect in a user-visible warning. Undisclosed file creation can surprise users, consume disk space, expose sensitive paper contents in saved artifacts, or overwrite/accumulate files in shared workspaces.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The text explicitly forces a specific operational mode rather than offering a user choice or documenting consent. Under the policy, forced language/locale-style constraints without opt-in should be flagged unless clearly justified and documented as required for a narrow context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger conditions are broad enough that the skill may activate for general requests about understanding a paper’s background or evolution. Because the skill also contains instructions to fetch external content and ultimately write local files, overbroad activation increases the chance of surprising tool use and unintended side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill includes local filesystem conventions and output-directory instructions that are not strictly necessary to answer a paper-lineage question. Even if the file access is limited in scope, embedding read/write behavior into an analysis skill expands its capability surface and can normalize unnecessary local data access.

Content

No source excerpt is available for this finding.