Ae1
High
- Category
- analysis-evasion
- Content
- `scripts/create_it_solution.js` — 核心创建函数库
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
it-integration-solution
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local Word document generator for Chinese IT integration proposals, with some documentation inconsistencies but no evidence of hidden access, exfiltration, persistence, or unsafe authority.
Install this only if you want Chinese-format enterprise IT proposal .docx generation. Review the generated table of contents behavior in Word because the documentation and code disagree on whether it is manual text or a Word TOC field.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)
Vague Triggers
Medium
- Confidence
- 91% confidence
- Finding
- The skill's trigger phrases are broad enough to intercept common document-writing requests beyond narrowly scoped IT integration proposals. Over-broad routing can cause the agent to invoke this skill in inappropriate contexts, leading to incorrect task execution, user-intent hijacking, or application of unsuitable formatting and content templates to unrelated requests.
Natural-Language Policy Violations
Medium
- Confidence
- 88% confidence
- Finding
- The skill hard-codes Chinese language and PRC enterprise formatting conventions without offering locale or language selection. In a multi-tenant or general-purpose assistant, this can override user intent, mis-handle international requests, and produce documents with incorrect linguistic or regulatory conventions, especially if the skill is auto-selected via broad triggers.
Intent-Code Divergence
Medium
- Confidence
- 95% confidence
- Finding
- L135-L142 说明目录页由 `createTableOfContents()` 生成，但同时写明用户需在 Word 中手动通过“引用→目录→自动目录”插入目录，这与“使用函数生成目录”的表述冲突。该矛盾在 L308 进一步加重，因其又声明“目录不使用 Word 域”，与“自动目录”机制本身相悖，导致技能意图与实际实现说明不一致。
Intent-Code Divergence
Medium
- Confidence
- 97% confidence
- Finding
- L136-L140 说明目录依赖 Word 自动目录并预定义 TOC1/TOC2/TOC3 样式，这通常意味着基于 Word 域生成目录；但 L308-L309 明确说“目录不使用 Word 域，采用纯文本手动目录”。这不是简单遗漏，而是对目录机制的直接相反描述，容易误导调用方对技能实际能力的判断。
Natural-Language Policy Violations
Medium
- Confidence
- 92% confidence
- Finding
- The file’s natural-language interface is entirely in Chinese, including the top-level usage instructions and examples, which establishes a fixed language expectation for users. The skill does not offer any language/locale choice or explain that it is intentionally limited to a China-specific or Chinese-only context.
Intent-Code Divergence
Medium
- Confidence
- 99% confidence
- Finding
- The comment at L1242 says post-processing removes the TOC SDT wrapper while preserving dirty markers so Word can update fields, but removeTOCSDT() explicitly strips all w:dirty="true" attributes at L0803-L0805. This is a direct contradiction between the documented intent and the actual XML mutation performed by the code.
Intent-Code Divergence
Low
- Confidence
- 91% confidence
- Finding
- L041 规定页码格式为“第N页 / 共N页”，并明确使用 `SECTIONPAGES` 域；但 L302 又写明使用 `PageNumber.CURRENT` 和 `PageNumber.TOTAL_PAGES`。`SECTIONPAGES` 与 `TOTAL_PAGES` 代表不同的总页数语义，这属于文档实现意图之间的直接冲突。
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
"license": "ISC", "description": "", "dependencies": { "docx": "^9.7.1" } }- Confidence
- 40% confidence
- Finding
- Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Intent-Code Divergence
Low
- Confidence
- 96% confidence
- Finding
- The inline comment at L1148 states this is a placeholder page where the user manually inserts a table of contents, but the implementation immediately calls createTableOfContents(), which constructs a real TableOfContents field object. This is an active documentation contradiction about what the code does, even though the overall feature remains within the skill's purpose.
Static analysis
Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+2 more)
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- node_modules/@types/node/child_process.d.ts:55
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/@types/node/repl.d.ts:30
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/@types/node/vm.d.ts:508
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/docx/dist/index.cjs:31023
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/docx/dist/index.iife.js:31024
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/docx/dist/index.mjs:31026
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/docx/dist/index.umd.cjs:31026
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/jszip/dist/jszip.js:11404
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/jszip/dist/jszip.min.js:13
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/setimmediate/setImmediate.js:17
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/xml-js/dist/xml-js.js:7928
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/xml-js/dist/xml-js.min.js:8
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- node_modules/@types/node/http.d.ts:1349
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- node_modules/@types/node/test.d.ts:340
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- node_modules/@types/node/crypto.d.ts:521
Potential obfuscated payload detected.
Warn
- Code
- suspicious.obfuscated_code
- Location
- node_modules/jszip/dist/jszip.js:1297
Potential obfuscated payload detected.
Warn
- Code
- suspicious.obfuscated_code
- Location
- node_modules/jszip/lib/utils.js:382