T09 · Insecure Skill Coding Practices
Error
- Location
test.html:282- Finding
Undisclosed Plaintext Transmission of Sensitive User Decision Data
- Content
View full analysis
- Remediation
View remediation
Security audit
do-it-gungun - 滚滚判断
Security checks for vulnerabilities and agentic risk
Overview
The skill’s life-decision purpose is mostly coherent, but it handles sensitive personal information with unsafe network exposure and weak privacy controls.
Review before installing. Do not enter sensitive personal, financial, employment, or relationship details unless you understand where they are sent and stored. Avoid using test.html as-is, bind the API to localhost with authentication, remove or anonymize bundled case records, add explicit privacy/retention controls, and replace plaintext or mutable external resources with safer alternatives.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/api_server.py:226- Finding
Unauthenticated Case Data Exposure Through an API Bound to All Network Interfaces
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
web/index.html:7- Finding
Mutable Third-Party Script Executes with Access to Sensitive Browser History
- Content
View full analysis
``` The application stores and retrieves decision history from `localStorage`: ```javascript function saveToLocalStorage(problem, result) { const history = JSON.parse(localStorage.getItem('doit_history') || '[]'); history.unshift({ date: new Date().toISOString(), problem: problem, result: result.analysis }); localStorage.setItem('doit_history', JSON.stringify(history)); } ``` ```javascript const history = JSON.parse(localStorage.getItem('doit_history') || '[]'); ``` ### Technical Analysis The pages execute JavaScript directly from `cdn.tailwindcss.com` without an immutable version, Subresource Integrity metadata, or an observed restrictive Content Security Policy. A third-party script loaded this way executes in the page's security origin and can access the DOM and origin-scoped `localStorage`. The stored `doit_history` object contains user-submitted problems, current circumstances, options, concerns, and analysis results. Therefore, compromise or unexpected modification of the remote script could expose or alter sensitive decision history. The application only needs generated CSS for presentation. Granting a mutable external script runtime access to sensitive application state exceeds the minimum privilege necessary for styling. ### Attack Path 1. A user submits a decision problem through the web interface. 2. The application saves the problem and analysis result in `localStorage` under `doit_history`. 3. The user later loads `web/index.html` or `web/histo ...[truncated 863 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (82)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述聚焦于“帮助地球人做人生选择”的 AI 判断能力，但提供的代码并没有任何决策、推理、对话或用户选择分析逻辑。相反，它是一个批处理式数据抓取主脚本，通过 subprocess 运行其他脚本，读取 data 目录下的 JSON 文件，汇总统计并写出摘要文件。这属于数据采集和报告生成功能，与声明的主要用途明显不符。虽然代码未表现出额外敏感权限请求，但其核心行为与技能描述存在实质性目的偏差，应判定为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述强调该技能的核心能力是“做人生选择判断”的 AI 决策辅助。但提供的代码块并未实现任何判断、推荐、评分、推理或对用户选项给出结论的逻辑。相反，代码的主要功能是构造/抓取案例样本、聚合去重、添加元数据，并保存为 data/cases/web_cases.json，状态还标注为“pending_analysis（待分析）”。这表明它更像是一个离线数据收集管道，而不是面向终端用户的决策技能。虽然案例主题与‘人生选择’相关，但主用途与声明的技能行为存在实质性偏差，因此应判定为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述强调的是通用‘人生选择/判断’类AI能力，但代码并未实现任何对用户进行人生决策判断、对话推理或建议输出的逻辑。相反，它主要执行城市数据抓取（尽管当前多为示例/静态数据）、数据整合、评分计算和文件保存，服务于城市比较数据准备。其核心用途更接近‘城市数据采集与分析预处理’而非‘人生选择判断技能’。此外，声明未体现会访问外部公开数据源并写入本地JSON这一能力，因此描述与实际行为存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个通用的人生选择/AI 判断技能，但代码并未实现任何判断、推荐、决策逻辑。相反，它实现的是薪资数据采集与整理工具，包含针对招聘网站的抓取框架、统计聚合、批量处理、手动数据录入以及本地保存。这属于 materially different primary purpose，且具备未在描述中体现的数据采集和文件操作能力，因此应判定为明显不匹配。
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow states that cases may be archived and used for knowledge updates, but the skill does not present a proportional privacy notice, consent mechanism, retention policy, or deletion option. Because the skill solicits intimate life-decision details, silent retention could expose highly sensitive personal, financial, and relationship information beyond the user's reasonable expectations.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The case archive includes a named individual with age, career history, salary details, locations, and personal situation, which is personally identifying and highly sensitive. Publishing or retaining such examples without minimization or explicit consent risks privacy harm, profiling, and unintended disclosure of employment and life circumstances.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest says the skill helps users make life choices, implying a judgment/advisory capability. This file instead orchestrates data collection scripts, reads local JSON datasets, and writes a summary report, which is a materially different operational purpose from end-user decision assistance.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file’s stated behavior is to collect and maintain salary datasets from external job platforms, which materially differs from the advertised skill purpose of helping users make life decisions. This kind of capability mismatch is dangerous because it can hide undeclared data-collection behavior from users and reviewers, reducing informed consent and making policy or trust-boundary violations harder to detect.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document substantially expands the skill from a simple life-decision assistant into a full data-harvesting, storage, and backend product architecture. That scope creep creates unnecessary attack surface, legal/privacy exposure, and opportunities for collecting or processing sensitive data far beyond what users would reasonably expect from the stated skill purpose.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The plan explicitly enables recurring scraping from multiple third-party employment platforms, and later references anti-crawling handling as a technical risk. For a decision-support skill, this is excessive capability that can violate platform terms, trigger blocking, and create legal or operational abuse pathways unrelated to the declared function.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code uses plain HTTP to transmit extremely sensitive personal decision-making data to an external IP address, exposing that traffic to interception or tampering by anyone on the network path. Because the payload includes intimate personal and financial information, lack of transport security materially increases the risk of privacy breach and manipulation of AI responses.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file states that the user can '保存历史' as part of the flow, which implies persistence of user-submitted information. Under the markdown criteria for missing user warnings, behaviour that affects user data or privacy should be accompanied by a warning or disclosure, but none is provided here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
These lines explicitly plan to integrate LocalStorage to save history, which can retain potentially sensitive user inputs on the user's device. The markdown does not warn users about this storage behaviour, retention scope, or how to remove stored data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is written entirely in Chinese and prescribes fixed Chinese-language output structures without offering any user language preference or fallback. This can mislead or exclude users who cannot understand the advice, risk notices, or data-handling behavior, which is especially problematic for a decision-making skill that may influence important life, career, or investment choices.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The workflow states that outputs are reviewed, archived, turned into cases, and used for knowledge updates, but the skill description does not clearly warn users that their prompts, decisions, and outcomes may be retained for later use. In a life-decision assistant, users may disclose sensitive personal, financial, relationship, or health-adjacent information, so silent retention creates a meaningful privacy and consent risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The section on continuous optimization says each decision will be followed by user-result feedback, review, accuracy analysis, strategy optimization, and knowledge-base updates, yet there is no corresponding user-facing warning or consent mechanism. This makes the skill more dangerous because it is explicitly designed to collect longitudinal post-decision outcome data, increasing privacy exposure and the sensitivity of the retained dataset over time.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This skill is explicitly designed to give direct recommendations on high-stakes life decisions including careers, relationships, and investments, yet the description lacks prominent safety warnings, scope limits, or escalation guidance. Even though the template later says the judgment is 'for reference only,' the overall framing ('you just do it') encourages over-reliance and could lead users to treat speculative AI output as authoritative advice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented API collects and transmits sensitive personal data such as relationship status, finances, family situation, preferences, and emotional concerns without any privacy notice, data minimization guidance, retention policy, or consent language. In this skill's context, users are likely to submit deeply personal and high-stakes information, increasing the risk of privacy harm, profiling, or misuse if the data is logged, retained, or exposed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The design shows collection and persistence of highly sensitive personal decision data in the profile and saved-question features, but the product copy and flows shown here do not present any privacy notice, consent, audience/scope warning, retention policy, or controls over sharing. Because the app handles career, relationship, investment, and life-choice data, users may disclose intimate facts and later face privacy harm, profiling, or unintended exposure if the data is stored, reused, or surfaced in cases.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The API design sends detailed personal context, preferences, concerns, and decision options to backend services and an external AI integration, yet the document provides no user disclosure, consent flow, minimization strategy, or boundary on third-party processing. In this product context, prompts may contain sensitive financial, employment, family, or relationship details, so silent transmission to servers and AI providers materially increases the risk of privacy violations, unauthorized secondary use, and regulatory noncompliance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The plan explicitly includes collecting background information, recording execution feedback, storing results, and building reusable case histories, but it provides no user-facing notice, consent flow, retention policy, or limits on secondary use. Because the product targets sensitive life domains like career, relationships, and investments, the accumulated data can reveal intimate personal information and create meaningful privacy, compliance, and trust risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The architecture sends user questions to an external AI provider and also plans external data/API usage, yet the document does not warn users that their inputs may leave the system or be processed by third parties. Since prompts may contain highly personal decision-making context, undisclosed third-party transmission can expose sensitive information, create regulatory issues, and increase downstream data-handling risk outside the operator's direct control.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document states that user history will be saved, but provides no notice about what data is retained, how long it is kept, where it is stored, or who can access it. In a decision-support skill handling potentially sensitive personal questions, silent retention can expose private user inputs and create privacy, compliance, and trust risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The usage instructions recommend running automated crawling scripts without warning that they will initiate network requests and collect external data. This can lead operators to unknowingly perform web scraping, trigger policy or legal issues, or import untrusted data into the system without understanding the source and associated risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The guide includes a token-based login example without any warning about secure credential handling. Users may paste long-lived tokens directly into shell history, shared terminals, logs, or screenshots, which can lead to account compromise and unauthorized publishing or modification of skills.
- Content
Static analysis
No suspicious patterns detected.