ccf-events

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:02 AM UTC
• Version: 1.1.421

Overview

The skill mainly supports CCF event lookups, but it also adds persistent scheduled reminders and a Puppeteer helper with unsafe local configuration and verification behavior.

Review this skill before installing if you only want simple CCF lookups. Avoid enabling cron reminders unless you explicitly want recurring background activity, do not run --config in a project with an existing .env without backing it up, and avoid copy-pasting generated Puppeteer verification commands from untrusted project directories.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ensure_puppeteer.js:206

Finding

Shell Command Injection Through an Unescaped Browser Path

Content

View full analysis

{ try { const browser = await puppeteer.launch({ executablePath: '${normalizedBrowserPath}', args: ['--no-sandbox', '--disable-setuid-sandbox'] }); const page = await browser.newPage(); console.log('[TEST] 正在访问 CCF 官网...'); await page.goto('https://ccf.org.cn', { timeout: 30000 }); const title = await page.title(); console.log('[SUCCESS] 验证通过！页面标题:', title); await browser.close(); process.exit(0); } catch (err) { console.error('[ERROR] 验证失败:', err.message); process.exit(1); } })();"`); return true; } ``` ### Technical Analysis The script reads `PUPPETEER_EXECUTABLE_PATH` from a project-controlled `.env` file and only verifies that the specified path exists. It does not validate the characters in the path or escape the value for the shell context into which it is inserted. The path is embedded inside a double-quoted shell argument. Shell substitutions such as `$(command)` and backtick substitutions can therefore be evaluated by a POSIX-compatible shell when a user copies and executes the displayed verification command. ...[truncated 1696 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ensure_puppeteer.js:236

Finding

Chromium Sandbox Disabled in the Recommended Verification Command

Content

View full analysis

{ try { const browser = await puppeteer.launch({ executablePath: '${normalizedBrowserPath}', args: ['--no-sandbox', '--disable-setuid-sandbox'] }); const page = await browser.newPage(); console.log('[TEST] 正在访问 CCF 官网...'); await page.goto('https://ccf.org.cn', { timeout: 30000 }); const title = await page.title(); console.log('[SUCCESS] 验证通过！页面标题:', title); await browser.close(); process.exit(0); } catch (err) { console.error('[ERROR] 验证失败:', err.message); process.exit(1); } })();"`); ``` ### Technical Analysis The recommended verification command launches Chrome or Chromium with both `--no-sandbox` and `--disable-setuid-sandbox`. These options disable major browser isolation controls designed to contain compromised renderer processes and reduce the effect of browser vulnerabilities. The command then loads remote content from `https://ccf.org.cn`. HTTPS protects transport integrity under normal certificate assumptions, but it does not eliminate risk from a compromised website, malicious third-party content, browser vulnerabilities, DNS or trust-store compromise, or future changes to the destination. Disabling the sandbox is sometimes required in narrowly constrained container environments, but it should not be the default recommendation for ordinary user workstations. ### Attack Path 1. The user runs the script with `--verify`. 2. The user copies and executes the suggested verification command. 3. Puppeteer launches the browser with its sandbox protections disabled. 4. The browser loads remote website content. 5. Malicious or compromised content exploits a browser or renderer vulnerability. 6. Because browser sandboxing is disabled, the exploit has fewer containment b ...[truncated 674 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: package.json:27

Finding

Puppeteer Dependency Is Not Reproducibly Pinned

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 756)May include surrounding context.

md

- **本地安装**：使用 `scripts/ensure_puppeteer.js` 脚本进行环境检测，安装命令由用户手动执行，确保仅安装到当前项目目录，不修改全局 Node/npm 环境

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 760)May include surrounding context.

md

- **本地安装**：使用 `scripts/ensure_puppeteer.js` 脚本进行环境检测，安装命令由用户手动执行，确保仅安装到当前项目目录，不修改全局 Node/npm 环境

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ensure_puppeteer.js (reported line 207)May include surrounding context.

js

let browserPath = null;
  
  // 先检查环境变量文件
  const envFile = path.join(process.cwd(), '.env');
  if (fs.existsSync(envFile)) {
    try {
      const envContent = fs.readFileSync(envFile, 'utf-8');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ensure_puppeteer.js (reported line 388)May include surrounding context.

js

let browserPath = null;
  
  // 先检查环境变量文件
  const envFile = path.join(process.cwd(), '.env');
  if (fs.existsSync(envFile)) {
    try {
      const envContent = fs.readFileSync(envFile, 'utf-8');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ensure_puppeteer.js (reported line 242)May include surrounding context.

js

log('未找到浏览器，请安装 Chrome/Chromium 或设置 PUPPETEER_EXECUTABLE_PATH', 'warning');
  console.log('\n配置方法：');
  console.log('  1. 创建 .env 文件，添加：');
  console.log('     PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser');
  console.log('  2. 或安装 Chromium：');
  if (process.platform === 'win32') {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ensure_puppeteer.js (reported line 287)May include surrounding context.

js

log('未找到浏览器，请安装 Chrome/Chromium 或设置 PUPPETEER_EXECUTABLE_PATH', 'warning');
  console.log('\n配置方法：');
  console.log('  1. 创建 .env 文件，添加：');
  console.log('     PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser');
  console.log('  2. 或安装 Chromium：');
  if (process.platform === 'win32') {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ensure_puppeteer.js (reported line 399)May include surrounding context.

js

log('未找到浏览器，请安装 Chrome/Chromium 或设置 PUPPETEER_EXECUTABLE_PATH', 'warning');
  console.log('\n配置方法：');
  console.log('  1. 创建 .env 文件，添加：');
  console.log('     PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser');
  console.log('  2. 或安装 Chromium：');
  if (process.platform === 'win32') {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The script writes to .env unconditionally in the current working directory, which can overwrite existing application configuration. While this is not credential theft, .env files often contain secrets, so blind overwrite can destroy or alter security-sensitive settings and break application behavior.

Content

Scanner excerpt · scripts/ensure_puppeteer.js (reported line 317)May include surrounding context.

js

return false;
  }
  
  const envPath = path.join(process.cwd(), '.env');
  const envContent = `# Puppeteer 配置
PUPPETEER_EXECUTABLE_PATH=${systemBrowser}
PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description is entirely Chinese and the skill instructions prescribe Chinese output labels and templates throughout, without offering the user a language choice. This can violate language/locale policy because it assumes a fixed locale rather than allowing user preference or opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest enables automatic triggering without a tightly scoped activation policy. In combination with multiple broad trigger patterns and external-fetch behavior, this raises the risk that the skill runs unexpectedly and performs network lookups when the user did not clearly intend to use this capability.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger regex contains broad everyday phrases such as asking what events or meetings exist, which can cause the skill to activate in contexts not specifically intended for CCF. Over-broad activation is dangerous because it can unexpectedly route user queries into a skill that performs external requests and applies rigid output behavior, leading to unintended data transmission and confusing task hijacking.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

bash

# 基础查询（无需用户输入）
curl -s -X POST "https://conf.ccf.org.cn/conf/v2/index/meeting/list.do" \
  -H "Content-Type: application/json" \
  -d '{"pageNo":1,"pageSize":50,"signupTimeState":"0","sortType":"0"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

bash

# POST 请求，获取左侧筛选栏的分类统计
curl -s -X POST "https://dl.ccf.org.cn/facetedStatistics.do" \
  -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)" \
  -d "classen=-1" \
  --data-urlencode "searchText=大模型" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

后端API： POST /video/getVideoList（程序调用）

bash

curl -s -X POST "https://dl.ccf.org.cn/video/getVideoList" \
  -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)" \
  -d "pageNum=1" \
  -d "pageSize=16" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

后端API： POST /ppt/getPPTList（程序调用）

bash

curl -s -X POST "https://dl.ccf.org.cn/ppt/getPPTList" \
  -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)" \
  -d "pageNum=1" \
  -d "pageSize=16" \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The Puppeteer/browser-automation guidance introduces a capability broader than necessary for a simple event lookup skill. Browser automation can fetch dynamic pages, interact with sites, and potentially expand the skill's operational reach, which increases attack surface and may enable risky behavior if invoked on untrusted pages or with installation steps.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill adds cron-based scheduled task creation and management that goes beyond its stated purpose of on-demand CCF information lookup. Because the skill is auto-triggered and supports persistent background actions, it could create recurring network activity and repeated user notifications without a narrowly scoped, explicit consent flow, increasing the risk of unintended persistence and abuse.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The header claims the script is effectively a read-only checker that only performs filesystem checks and outputs guidance, but the implementation can write a .env file via the --config path. This mismatch can mislead users and automation into granting the script more trust than warranted, increasing the chance of unintended local file modification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file’s descriptive comments and all displayed prompts/instructions are written in Chinese, which imposes a specific language on users. Under the policy, a fixed language/locale is only acceptable when the skill offers a choice or clearly documents a justified regional constraint, neither of which appears here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The comments state that explicit user authorization is required before installation-related actions, but the --config code path writes a .env file without prompting. Even though this is a local-only change, bypassing the stated consent model can cause unexpected configuration changes in the current project.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/ensure_puppeteer.js (reported line 252)May include surrounding context.

js

} else {
    const distro = detectLinuxDistro();
    if (distro === 'rhel') {
      console.log('     sudo yum install -y chromium');
    } else if (distro === 'debian') {
      console.log('     sudo apt-get install -y chromium-browser');
    } else {

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/ensure_puppeteer.js (reported line 254)May include surrounding context.

js

} else {
    const distro = detectLinuxDistro();
    if (distro === 'rhel') {
      console.log('     sudo yum install -y chromium');
    } else if (distro === 'debian') {
      console.log('     sudo apt-get install -y chromium-browser');
    } else {

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/ensure_puppeteer.js (reported line 421)May include surrounding context.

js

} else {
    const distro = detectLinuxDistro();
    if (distro === 'rhel') {
      console.log('     sudo yum install -y chromium');
    } else if (distro === 'debian') {
      console.log('     sudo apt-get install -y chromium-browser');
    } else {

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/ensure_puppeteer.js (reported line 423)May include surrounding context.

js

} else {
    const distro = detectLinuxDistro();
    if (distro === 'rhel') {
      console.log('     sudo yum install -y chromium');
    } else if (distro === 'debian') {
      console.log('     sudo apt-get install -y chromium-browser');
    } else {

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The cron examples and preference template default scheduled execution to Asia/Shanghai, which imposes a locale-specific setting unless the user overrides it. While a timezone can be appropriate for a region-specific skill, the file does not clearly justify or require explicit user consent for that locale default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.