Security audit

Star Office

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Star Office dashboard skill, but its public-sharing and agent-sync design exposes too much control and local activity without enough protection.

Review carefully before installing. Use only on localhost unless you have changed all default secrets, removed sample join keys, disabled or authenticated public mutation and memo endpoints, and verified the exact code being run. Do not run the remote downloaded office-agent-push.py; use an audited local copy instead, and assume status details and yesterday memos may contain private information unless you explicitly curate them.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (8)

other

Error

Location: office-agent-push.py:40
Finding: Continuous Export of Local Agent Activity to a Hard-Coded Third-Party Service
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: frontend/join-office-skill.md:17
Finding: Unpinned Remote Python Payload Is Downloaded and Executed
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: backend/app.py:873
Finding: Administrative and Main-State Mutation Endpoints Lack Authentication
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: backend/app.py:820
Finding: Public Agents Endpoint Discloses Reusable Join Credentials and Activity Details
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: frontend/index.html:3422
Finding: Stored Cross-Site Scripting Through Unsanitized Agent Names
Content: View full analysis
{ const name = agent.name || '未命名访客'; ... const pendingActions = `交换skill` + `离开房间`; return `

${name}

${subtitle}

${pendingActions}

`; }).join(''); ``` ### Technical Analysis The backend accepts an arbitrary agent name through `/join-agent`. The frontend then interpolates that name into HTML content, an HTML attribute, and a quoted inline JavaScript handler before assigning the result to `innerHTML`. An attacker can break out of any of these contexts and inject executable markup or JavaScript. The vulnerable pattern also exists in `frontend/electron-standalone.html`. ### Attack Path 1. The attacker obtains a join key, including through `/agents` or the predictable sample key. 2. The attacker joins using a name containing an HTML or event-handler payload. 3. The backend stores the malicious name. 4. A victim opens the dashboard, which fetches the agent list. 5. `renderGuestAgentList()` inserts the name using `innerHTML`. 6. The attacker’s JavaScript executes in the dashboard origin and can invoke authenticated same-origin endpoints. ### Impact Assessment Injected code can act with the victim’s web session, alter assets and layout, trigger image generation, change Gemini configuration, read same-origin data, remove agents, or exfiltrate information accessible to the page. If the owner h ...[truncated 81 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: backend/app.py:1223
Finding: Unauthenticated Memory Disclosure and HTML Injection in Yesterday Memo
Content: View full analysis
'); ``` ### Technical Analysis The endpoint has no authentication and reads Markdown files from the parent `memory` directory. The sanitizer does not cover API keys, passwords, bearer tokens, private keys, URLs containing credentials, session cookies, non-root filesystem paths, or arbitrary confidential prose. The frontend subsequently inserts the returned value using `innerHTML`. Truncation does not constitute HTML sanitization, so suitable short markup can remain executable. ### Attack Path 1. A daily Agent memory file contains confidential text or attacker-influenced HTML. 2. The backend selects that file as the latest previous-day memo. 3. The limited sanitizer leaves the sensitive ...[truncated 452 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: backend/app.py:800
Finding: Fresh Deployments Activate a Publicly Known Reusable Join Key
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: backend/app.py:83
Finding: Universal Weak Defaults Protect Sessions and Sensitive Configuration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (128)

Tainted flow: 'LOCAL_STATUS_URL' from os.environ.get (line 47, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · frontend/office-agent-push.py (reported line 172)May include surrounding context.
python
headers = {} if LOCAL_STATUS_TOKEN: headers["Authorization"] = f"Bearer {LOCAL_STATUS_TOKEN}" r = requests.get(LOCAL_STATUS_URL, headers=headers, timeout=5) if r.status_code == 200: data = r.json() state = normalize_state(data.get("state", "idle"))

Tainted flow: 'LOCAL_STATUS_URL' from os.environ.get (line 55, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 96% confidence
Finding: The script reads LOCAL_STATUS_URL from an environment variable and performs an authenticated HTTP GET to that URL, optionally attaching a bearer token. This creates an SSRF-style primitive and token disclosure risk: a local operator or wrapper can redirect the request to an attacker-controlled endpoint and cause the script to send OFFICE_LOCAL_STATUS_TOKEN or probe internal services.
Content: Scanner excerpt · office-agent-push.py (reported line 180)May include surrounding context.
python
headers = {} if LOCAL_STATUS_TOKEN: headers["Authorization"] = f"Bearer {LOCAL_STATUS_TOKEN}" r = requests.get(LOCAL_STATUS_URL, headers=headers, timeout=5) if r.status_code == 200: data = r.json() state = normalize_state(data.get("state", "idle"))

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code only exposes simple GET/POST handlers that return static JSON indicating service health and basic metadata. The Flask section similarly provides '/' and '/health' endpoints with status information. There is no code for deploying a UI, rendering a dashboard, managing agents, visualizing statuses, handling mobile-specific presentation, or configuring/publicly exposing infrastructure. The declared description substantially overstates the implemented behavior, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description matches part of the implementation: multi-agent joining, status visualization support, and web/mobile/public serving are consistent with the Flask UI backend. However, the supplied code does substantially more than a simple one-click deployment/dashboard backend. It exposes a full authenticated asset-management system, supports image upload and rollback, generates new backgrounds through an external Gemini image-generation pipeline, stores runtime configuration including API keys, and reads memo files from a separate memory directory. These are material undeclared capabilities rather than incidental implementation details, so the description does not accurately represent the full behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says this skill deploys a Star Office UI/dashboard system with multi-agent support and access features. The supplied code does something entirely different: it processes local memo markdown content for display, including extracting bullet points, redacting sensitive data, truncating lines, and appending a random quote. There is no evidence of deployment logic, UI setup, agent management, visualization, mobile support, or public network access. This is a clear purpose/behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description focuses on deploying and operating a Star Office UI/dashboard experience, including collaboration and access features. The actual code chunk does not implement any of those behaviors. Instead, it provides narrow security-related helper logic for environment detection and credential strength checks. While such utilities could support a larger application, this chunk’s actual behavior is materially different from the declared primary purpose and introduces an undeclared security-validation capability. Therefore, this code chunk does not accurately represent the stated description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents this skill as an end-user deployment/operations tool for Star Office UI, focused on provisioning a dashboard and enabling agent participation, visualization, mobile access, and public exposure. The supplied code does none of that. It only processes local frontend image files, converting selected PNG assets to WebP format for optimization. This is a materially different primary purpose and introduces an undeclared capability (asset conversion) unrelated to the advertised behavior. Therefore, the description does not accurately represent the actual code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises substantial end-user functionality related to deploying and operating a Star Office UI dashboard. However, the supplied code chunk is merely a standard Rust/Tauri build script with no visible implementation of those features. While build.rs is a supporting file, based on the provided chunk alone the actual behavior does not match the declared purpose and shows none of the advertised capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description emphasizes one-click deployment of a Star Office dashboard with multi-agent access, mobile access, and public exposure. The supplied code instead implements local desktop application logic: reading state/layer/map files, rendering assets, controlling Tauri windows, spawning a local backend, polling a localhost status endpoint, and opening URLs externally. While status visualization is plausibly related, the primary behavior is a desktop UI/runtime component, not a deployment automation skill. Important declared features such as multi-agent onboarding, mobile viewing support, and public internet access are not implemented in this chunk, while undeclared capabilities like launching a backend process and opening arbitrary URLs are present.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a specific office dashboard deployment tool with networking/access features and multi-agent visualization capabilities. The supplied code chunk does not show any of those behaviors. It is only a Rust main function for a Tauri desktop application that delegates execution to star_desktop_pet_lib::run(). Based on the filename/module naming (desktop-pet) and the lack of any visible office/dashboard, mobile, agent, or public access logic, the code's apparent purpose materially differs from the declared purpose. While this snippet is small and may not expose the full library behavior, the provided chunk itself does not substantiate the declared description, so this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description is about deploying and presenting a pixel office dashboard with multi-agent support, visualization, mobile access, and public exposure. The provided code does not implement dashboard deployment, agent management, visualization, mobile support, or networking/public access. Instead, it creates a preload compatibility layer exposing IPC methods and window-control functionality in an Electron environment. This is a materially different primary purpose and includes undeclared capabilities related to desktop app window manipulation and interprocess communication.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a high-level deployment skill with operational capabilities such as one-click setup, multi-agent support, mobile access, and public exposure. The supplied code chunk does not implement any of those behaviors. It is only a static JavaScript configuration object for scene layout and rendering metadata in an Electron/office-themed UI, including positions, depth ordering, and asset rules. While this may be a supporting asset for the visual interface of such a system, this chunk alone materially differs from the declared purpose and lacks the claimed capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a complete deployment-oriented skill with collaboration and access features, but the supplied code chunk is only a static frontend layout/config file. It contains no deployment logic, no agent management, no status visualization implementation, no mobile adaptation handling, and no networking or public exposure capability. While the layout config may support a Star Office UI scene visually, it does not substantiate the broader declared purpose, so the description materially overstates what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broad 'one-click' deployment skill for setting up the Star Office UI, including dashboard provisioning, multi-agent support, visualization, mobile access, and public exposure. The supplied code does not deploy or configure such a system. Instead, it is a specific agent-side script whose purpose is to join an existing office service and periodically push local status updates to it. It also inspects local state files and optionally queries a local /status endpoint, which are behaviors not reflected in the declared description. While the script is related to the office ecosystem and supports one aspect of multi-agent status display, its actual primary function is much narrower and materially different from the claimed end-to-end deployment capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description describes an office/dashboard deployment skill with collaboration, visualization, mobile access, and public exposure features. The supplied code does none of those things. It is a local image-processing script using PIL to convert GIF frames into a sprite sheet, with simple CLI arguments for input/output paths and target height. There are no networking features, no UI/dashboard setup, no agent management, and no mobile/public access behavior. This is a clear description-behavior mismatch with a materially different primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents this skill as a deployment/setup capability for the Star Office UI product, emphasizing dashboard provisioning and user-facing features like multi-agent support, visualization, mobile access, and public exposure. The supplied code chunk does not implement deployment or those UI/product features. Instead, it performs operational maintenance: checking a local backend health endpoint, logging results, and restarting a backend service when unhealthy. This is a materially different primary purpose from the declared one, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents this as a one-click deployment skill for a Star Office UI/dashboard with features like multi-agent participation, visualization, mobile viewing, and public exposure. The supplied code does not deploy or configure such a UI. Instead, it is an agent-side utility that uses a join key to register with an existing remote office server, discovers local status from state.json files or a localhost /status API, and repeatedly posts that status to remote endpoints (/join-agent and /agent-push). While this may support a larger office system, the chunk’s primary purpose is status synchronization for a single agent, not dashboard deployment or access enablement. Therefore the description materially overstates and mischaracterizes what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a deployment/operations skill for standing up a Star Office UI system with agent management and access features. The supplied code does none of that. It is a standalone image-processing script using PIL to transform a spritesheet file into a grid layout and save a new PNG locally. There are no triggers, networking actions, service setup steps, agent-related functions, visualization features, or public/mobile access configuration. This is a clear material mismatch in primary purpose and capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a broad deployment/automation skill for setting up an office UI system with multiple product features. The supplied code does not implement deployment, dashboard orchestration, agent management, visualization logic, mobile access, or public exposure. It only performs image resizing on one map/background image and writes the result to a frontend file path. While this may be a minor supporting asset-preparation step for such a system, the actual code chunk’s primary behavior is materially narrower and different from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill is for one-click deployment of a Star Office UI dashboard with multi-agent joining, visualization, mobile access, and public exposure. The supplied code does none of that. Its sole purpose is image generation through Google's Gemini API, using a text prompt and optional reference image, then writing resulting image files locally. This is a materially different primary purpose and introduces undeclared external API usage and image-processing capabilities unrelated to the stated office-dashboard deployment functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents the skill as a deployment and UI setup tool for Star Office, focused on provisioning a dashboard and enabling agents, visualization, mobile access, and public exposure. However, the actual code does not deploy, configure, launch, or manage any UI or office components. Instead, it performs a security validation routine: reading environment variables, invoking git to enumerate tracked files, scanning repository contents for secret-like tokens, and reporting failures/warnings. This is a materially different primary purpose and includes undeclared capabilities related to security auditing and repository inspection. Therefore, the description does not accurately represent the code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: The declared description presents this skill as an operational deployment tool for setting up the Star Office UI dashboard and enabling features like multi-agent participation, mobile access, and public exposure. However, the supplied code only performs smoke testing against an existing HTTP service by checking endpoints such as /health, /status, /agents, /yesterday-memo, and POST /set_state. This is materially different from deployment or feature enablement. While the tested endpoints are related to the same product domain, the primary behavior is validation/monitoring of a running service, not one-click setup or access configuration.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description claims an end-to-end deployment skill for Star Office UI, including dashboard setup, multi-agent participation, visualization, mobile access, and public exposure. The supplied code only validates a status argument and writes state data to a local state.json file. While this could be a supporting component for status visualization, it does not perform deployment, networking, mobile support, or agent onboarding. Therefore the declared purpose materially overstates and misrepresents the actual behavior of this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a UI/deployment skill for a collaborative office dashboard, including multi-agent support, visualization, mobile access, and public access. The supplied code does none of that. Instead, it is an image-processing script that opens an animated WebP, iterates its frames, optionally resizes them, and writes a horizontal spritesheet PNG. This is a materially different primary purpose and an unrelated capability set. No dashboard deployment, agent management, status visualization, mobile interface, or networking behavior appears in the code.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
python3 -m pip install -r backend/requirements.txt

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.install_untrusted_source

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: electron-shell/main.js:168

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: frontend/vendor/phaser-3.80.1.min.js:1

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: desktop-pet/src-tauri/tauri.conf.json:17