Security audit

mifu-chem-mindmap

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent chemistry mind-map generator, but its HTML renderer can carry unsafe content from input data and its validation claims are stronger than the code supports.

Install only if you will use trusted JSON inputs and manually review generated HTML before sharing it with teachers or students. Do not rely on the script's all-green validation as a complete safety or correctness guarantee; equations with skipped parsing and rendered output counts need human review, and the renderer should be fixed to escape HTML/SVG content before handling untrusted data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/mindmap_tools.py:219
Finding: Unescaped JSON Content Allows Stored HTML and SVG Injection
Content: View full analysis
★{note.get("text","")}') svg.append('') return '\n'.join(svg) def render_node(nd): parts = ['
'] if nd.get('text'): parts.append(f'{nd["text"]}') if nd.get('eq'): parts.append(f'
{nd["eq"]}
') extra = nd.get('extra') if extra: parts.append(f'
{extra}
') if nd.get('tag'): for t in nd['tag'].split('|'): cls = {'常考': 'tag-red', '易错': 'tag-yellow', '可推': 'tag-green', '必须记': 'tag-gray'}.get(t.strip(), 'tag-gray') parts.append(f'{t.strip()}') parts.append('
') return '\n'.join(parts) ``` Additional unescaped insertion points in `render_html` include: ```python secs.append(f'
▸ {sec.get("title","")}
{nodes}
') branch_html.append( f'
' f'
{b.get("id", idx+1)}{b.get("title","")}
' + ''.join(secs) + '
') {meta.get('module','')}｜三层思维导图
{meta.get('module','')}｜三层思维导图

主题式包装：{meta.get('theme','')} ｜ {meta.get('grade_region','')} · {meta.get('textbook','')} ｜配套教案：mifu-chemistry-lesson-prep

{stats_line} ｜ validate: {data.get('_validate_status','未运行')} ｜生成日期：{today} ｜米赋教育教研中心 · mifu-chem-mindmap v{meta.get('skill_ver ...[truncated 2413 chars]
Remediation: View remediation
` elements - Event-handler attributes - SVG element termination - Quotes in SVG coordinates and IDs - Remote image or frame elements ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/mindmap_tools.py:150
Finding: Validation Logic Can Falsely Mark Unverified or Inconsistent Output as Passing
Content: View full analysis
{msg}') ... v1_pass = len(errors) == 0 v2_pass = coverage >= 85 ... status = '✅ 全绿' if (v1_pass and v2_pass) else '❌ 未通过' ``` The V3 equation-count condition is always true because a string count cannot be negative: ```python n_nodes = sum(len(sec.get('nodes', []) ) for b in data.get('branches', []) for sec in b.get('sections', [])) n_eq_html = html.count('class="eq"') residue = [p for p in ['None', '{{', '}}'] if p in html] print('-' * 60) print(f'V3 渲染检查: HTML已生成 {out} ({len(html)}字节)') print(f' 方程式块渲染数: {n_eq_html} | 节点数(数据): {n_nodes} | 残留占位符: {residue if residue else "无"}') v3_pass = (not residue) and n_eq_html >= 0 print(f'交付门槛: V1={"✅" if v1_pass else "❌"} V2={"✅" if v2_pass else "❌"} V3={"✅" if v3_pass else "❌"}') ``` The `all` command also writes the output before enforcing the final validation result: ```python if cmd == 'all': data['_validate_status'] = status out = sys.argv[3] html = render_html(data, count_stats(data)) with open(out, 'w', encoding='utf-8') as f: f.write(html) ``` ### Technical Analysis The validation workflow fail ...[truncated 2416 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs the agent to create and render output files such as JSON and HTML and explicitly references commands that write artifacts, but it does not declare any tool scope or permissions boundaries. That mismatch can cause an execution environment to grant broader file-write capability than users expect, increasing the risk of unintended overwrites or writes outside the intended workspace.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file contains instructional content exclusively in Chinese and does not indicate that users may choose another language or locale. Under the policy rule for language/locale constraints, forcing a single language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire skill guidance is written only in Chinese and provides no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module usage text states that validate <data.json> performs V1方程式守恒+V2完整度+V3渲染一致性. In the implementation, the validate path only runs v1_validate and v2_validate; V3 checks are executed only inside the all branch after HTML rendering.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This Python file embeds natural-language output that forces the generated HTML to use lang="zh-CN" and presents the interface text entirely in Chinese. Under the policy for natural-language violations, a fixed language/locale without user opt-in should be flagged unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The markdown specifies a fixed Chinese font fallback chain ("PingFang SC / Hiragino Sans GB") and the skill content is written as mandatory Chinese-language output guidance, with no opt-in or alternative locale path. Under the policy rule, forcing a specific language/locale presentation without user choice can be a natural-language policy concern unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

{meta.get('module','')}｜三层思维导图

T09 · Insecure Skill Coding Practices

SkillSpector

Undeclared Tool Scope

Natural-Language Policy Violations

Natural-Language Policy Violations

Intent-Code Divergence

Natural-Language Policy Violations

Natural-Language Policy Violations