T09 · Insecure Skill Coding Practices
Error
- Location
test.html:282- Finding
Undisclosed Transmission of Sensitive Personal Data to an External Plaintext Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
do-it - 滚滚判断技能
Security checks for vulnerabilities and agentic risk
Overview
This life-decision skill has useful, purpose-related pieces, but it also sends or stores sensitive personal decision data in under-disclosed and unsafe ways.
Review before installing or using with real personal information. Do not use the packaged test.html with sensitive data, do not expose the API server on an untrusted network, and clear browser history/localStorage after testing. The publisher should remove the hardcoded HTTP IP endpoint, use HTTPS/same-origin APIs, add consent and retention controls, and strengthen high-stakes advice warnings.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
web/index.html:238- Finding
DOM-Based Cross-Site Scripting Through an Unsanitized Problem Title
- Content
View full analysis
🌪️ 滚滚的判断你的问题
${problem}
`; } // 渲染结果 function renderResult(html) { document.getElementById('result-content').innerHTML = html; } ``` The vulnerable mock result is reached when the API call fails: ```javascript } catch (error) { console.error('请求失败:', error); alert('API 服务未启动，使用模拟结果~\n\n启动方法：python scripts/api_server.py'); // 降级到模拟结果 showResult(generateMockResult()); } ``` ### Technical Analysis The value of `problem-title` is attacker-controlled. It is inserted directly into an HTML template without contextual encoding or sanitization. The resulting string is subsequently rendered through `innerHTML`. Consequently, HTML elements and event-handler attributes supplied in the title are interpreted by the browser. For example, a title containing an image element with an `onerror` handler can execute arbitrary JavaScript when the fallback result is rendered. The fallback path is practically reachable because it is automatically selected whenever the documented local API is unavailable or returns an error. If the application later renders server-produced HTML using ...[truncated 1164 chars]✅ 推荐选择
基于数据分析，滚滚推荐你选择 方案 B
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
web/index.html:334- Finding
Sensitive Personal Decision History Persisted Indefinitely in Browser Local Storage
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/api_server.py:277- Finding
Unauthenticated Development API Binds to All Network Interfaces
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (90)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述强调的是一个提供人生选择判断的 AI 技能，但提供的代码并未体现任何决策、推理、对话或人生选择建议逻辑。相反，它是一个面向数据管道的运维/采集脚本，负责调用 crawl_city_data.py 和 crawl_cases.py、读取 data 目录中的 JSON 文件、汇总统计并输出 DATA-SUMMARY.json。这属于与声明主目的显著不同的行为，且包含未在描述中体现的文件读写和子进程执行能力。因此应判定为描述与实际行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述强调的是“帮助地球人做人生选择的 AI 判断技能”，意味着核心能力应是分析、判断或给出决策建议。但提供的代码并不执行任何决策判断、推理或用户交互逻辑，而是一个离线数据抓取/样例汇总脚本：收集职业/生活抉择案例，聚合去重，添加元数据，并保存为 JSON，状态还标注为“pending_analysis（待分析）”。这说明该代码处于为后续分析准备数据的阶段，其主要目的与声明的用户面向判断技能明显不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述强调的是通用的人生选择判断能力，像是一个提供决策建议的 AI 技能；但代码并没有实现对用户人生选择进行分析、对话或判断，而是一个面向特定城市的离线数据抓取/生成脚本。其核心功能是采集或模拟城市指标数据、计算评分并保存结果，属于数据工程/城市比较数据准备，而非直接的人生决策技能。虽然这些城市数据未来可能被用于辅助人生选择，但当前代码的实际主用途与声明存在明显偏差。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个用于‘人生选择判断’的 AI 决策类技能，但代码并没有实现任何判断、推荐、对话分析或人生选择相关逻辑。相反，代码的核心功能是薪资数据采集、统计聚合和本地数据存储，属于招聘/薪资数据管道工具。其主要目的、能力范围和资源访问方式（访问招聘网站、读写本地数据文件）都与声明明显不一致，因此属于高置信度的描述与行为不匹配。
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill markets itself for investing, relationships, and major life decisions but does not place an upfront, prominent warning at the point where those scenarios are introduced. Because the surrounding messaging repeatedly says 'you just do it' and shifts judgment to the agent, the absence of early high-stakes safeguards materially increases the risk of harmful overreliance.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest says the skill helps humans make life decisions through AI judgment, but this file implements salary crawling, aggregation, and manual salary dataset entry for finance roles across cities. That is a materially different operational purpose centered on labor-market data collection rather than decision/judgment assistance.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is presented as a life-decision aid, but the document defines a broad data collection and analytics platform spanning salary, city, industry, and ongoing automation. This creates a material capability gap between user expectations and actual backend behavior, increasing the risk of undisclosed data gathering, external connectivity, and expanded attack surface.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The plan includes persistent storage of case records containing user_profile, recommendations, reasoning, outcomes, and satisfaction data, but this is not transparently disclosed in the skill description. For a life-decision tool, these records may contain sensitive personal and behavioral data, so hidden retention materially increases privacy and misuse risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document explicitly describes saving user history and recording each judgment, but provides no privacy notice, retention limits, consent flow, or guidance on handling potentially sensitive personal decision data. Because this skill is positioned as collecting personal life-choice inputs, stored history could include intimate, financial, career, or location-related information, creating privacy and compliance risk if implemented as described.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The roadmap mentions integrating a real AI API but does not warn that user-submitted questions may be transmitted to an external provider. In this skill's context, users may submit highly personal decision-making details, so undisclosed transmission to third-party AI services can expose sensitive data and create legal, trust, and privacy issues.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documented workflow expands beyond a narrow decision-aid into operational planning, risk handling, delivery review, and lifecycle management. This increases the chance that users treat the skill as an authoritative agent for high-stakes actions, creating scope creep and enabling collection or retention of more sensitive information than the description suggests.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The design includes archiving cases, review, and knowledge-base updates without clearly justifying why a life-choice judgment skill needs persistent retention. That creates privacy and data-governance risk because users may disclose sensitive personal, financial, relationship, or career details that are then stored or reused beyond their expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes archiving decision cases into a knowledge base but does not warn users up front. This is dangerous because the skill is positioned for intimate life decisions, where undisclosed retention can capture highly sensitive personal context and violate user expectations around confidentiality.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The output contract requires step-by-step execution plans, risk handling, and post-decision follow-up, which goes beyond simple recommendation. In a life-choice context, this can drive undue reliance and nudge users into acting on consequential guidance without adequate safety disclaimers or professional escalation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The workflow says user feedback will be used for review and knowledge-base updates without a privacy warning or consent mechanism. Feedback on outcomes of career, relationship, health, or financial decisions can contain especially sensitive data, so silent reuse materially increases privacy risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The messaging encourages users to hand judgment over to the system and then 'just do it,' which can foster over-reliance on a definitive answer in high-stakes situations. In contexts like career, relationships, investing, or potentially health/legal-adjacent decisions, that framing can cause harmful actions without sufficient acknowledgment of model limitations or uncertainty.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly targets high-stakes domains such as career, relationships, and investment decisions, yet only provides a weak '仅供参考' disclaimer later in the prompt template rather than a clear upfront warning about limitations, uncertainty, and the need for qualified human advice. Because the skill is designed to give direct, confident recommendations ('你只管 do it'), users may over-rely on it for consequential life choices, increasing risk of financial, emotional, or other serious harm.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The API example encourages users to submit highly sensitive personal data, including relationship details, finances, age, family status, and location-linked life circumstances, but provides no privacy notice, minimization guidance, retention policy, or consent warning. This creates a real privacy and safety risk because users may disclose intimate information without understanding that it is transmitted to and processed by a backend analysis service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The design explicitly includes saving user questions, adoption status, and personal case history in the profile/case features, but the product flow shown to users does not provide any clear privacy notice, consent step, retention policy, or warning before publishing/saving sensitive life-decision data. Because the app targets highly personal topics such as career, relationships, investments, and life choices, storing this data without prominent disclosure increases the risk of privacy harm, accidental oversharing, and unsafe secondary use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The API design sends detailed personal context, preferences, concerns, and decision scenarios to backend services and an external AI integration, yet the design does not mention informing users that their data may be processed externally. In this context, users may disclose intimate financial, relationship, employment, or location details, so undisclosed transmission to third-party AI services creates meaningful privacy and compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The product plan explicitly includes collecting user background information, recording execution feedback, storing results, and building reusable case data, but it does not mention any user-facing privacy notice, consent flow, retention limits, or anonymization. Because this skill is intended to support sensitive life decisions such as career, relationships, and investments, the collected data is likely highly personal, making undisclosed reuse materially risky.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The plan states that user questions will be sent to an external AI provider ('OpenClaw API') and also references data APIs, but there is no warning that user-provided content or related system data may be transmitted to third parties. Since users may submit intimate personal details to obtain recommendations, silent third-party sharing creates a meaningful privacy and data-governance risk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest frames the skill as helping users make life choices, which implies an analysis/advice function. This summary documents separate automated crawler scripts for salary, city, and case data collection, which is a materially broader operational scope than the manifest description alone suggests.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The stated purpose is an AI judgment skill for helping with life decisions, but this file describes additional product capabilities: an HTTP API, browser-based UI, user feedback, and history recording. Those are broader service/application behaviors, not merely an obvious implementation detail of a minimal decision helper as described in the manifest.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The summary states that user history is saved, but provides no warning about data retention, privacy implications, consent, or handling of potentially sensitive personal decision data. In a life-choice/judgment skill, stored prompts and feedback may contain intimate personal, financial, or employment information, increasing the likelihood of privacy harm if retained insecurely or without user awareness.
- Content
Static analysis
No suspicious patterns detected.