sjht-data-annotation

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:50 AM UTC
• Version: 1.0.0

Overview

This is a real data-annotation skill, but its web API and deployment instructions create broad unauthenticated file access and host-configuration risks.

Install only after review. Use it in a contained environment, keep datasets non-sensitive unless you have approved the model provider, avoid the provided Nginx/root deployment flow, do not expose the API publicly, and restrict all reads and writes to a dedicated annotation results directory.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (7)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/annotation-api.py:24

Finding

Unrestricted Filesystem Enumeration and JSONL File Disclosure

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/annotation-api.py:76

Finding

Unauthenticated Arbitrary File Creation and Overwrite

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/annotation-api.py:103

Finding

Externally Exposed Annotation API Has No Authentication and Allows Cross-Origin Requests

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/annotation-api.py:43

Finding

Directory Containment Check Can Be Bypassed by Shared Path Prefixes

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: templates/annotation-viewer.html:194

Finding

DOM-Based Cross-Site Scripting Through Unescaped Filenames and Paths

Content

View full analysis

{ const parts = f.path.split('/'); const dir = parts.slice(0, -1).join('/') || '/'; if (!dirs[dir]) dirs[dir] = []; dirs[dir].push({ ...f, idx: i }); }); Object.keys(dirs).sort().forEach(dir => { dirs[dir].forEach(f => { const item = document.createElement('div'); item.className = 'dir-item' + (f.idx === currentFileIdx ? ' active' : ''); const icon = f.type === 'image' ? '🖼' : f.type === 'video' ? '🎬' : '📄'; item.innerHTML = `${icon}${f.name || f.path.split('/').pop()}`; item.onclick = () => selectFile(f.idx); tree.appendChild(item); }); }); } ``` ```javascript function renderData(file) { const panel = document.getElementById('dataPanel'); const url = CONFIG.apiBase + '?action=file&path=' + encodeURIComponent(file.path); let content = ''; switch (file.type) { case 'image': content = `

📷 Data Preview ${file.name || file.path}

`; break; case 'video': content = `

🎬 Video Preview ${file.name || file.path}

`; break; case 'text': content = `

📄 Text Content ${file.name || file.path}

Loading...

`; break; de ...[truncated 1844 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:217

Finding

Deployment Instructions Require Excessive Root-Level Privileges

Content

View full analysis

/root/annotation-data/ chmod 755 /root # Required, otherwise nginx cannot access it ``` ```bash fuser -k 8888/tcp 2>/dev/null nohup python3 /scripts/annotation-api.py --port 8888 --data-dir > /results/api.log 2>&1 & ``` ```bash # A full restart is required instead of reload systemctl restart nginx ``` The instructions also require editing an existing system Nginx site configuration: ```nginx location ^~ /annotation/ { alias /root/annotation-data/; autoindex on; index viewer.html index.html; charset utf-8; add_header Access-Control-Allow-Origin *; add_header Access-Control-Allow-Methods "GET, POST, OPTIONS"; add_header Access-Control-Allow-Headers "Content-Type"; } location ^~ /annotation-api/ { proxy_pass http://127.0.0.1:8888/; } ``` ### Technical Analysis The declared annotation workflow does not require storing data beneath `/root`, globally changing `/root` permissions, killing arbitrary processes, or running the API with broad host privileges. `chmod 755 /root` changes access to the root user's home directory for all local users and services. Although file-level permissions still apply, this unnecessarily exposes directory traversal and names beneath a sensitive administrative location. `fuser -k 8888/tcp` kills whichever process currently owns the port without confirming that it belongs to this Skill. Editing Nginx and restarting it can also affect unrelated applications hosted on the machine. Most importantly, running the vulnerable API from a root-oriented workflow expands the impact of its arbitrary read and write flaws from an annotation directory to privileged host resources. ...[truncated 937 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:46

Finding

Unpinned Runtime Installation of Third-Party Dependencies

Content

View full analysis

') for p in doc.paragraphs: print(p.text) for table in doc.tables: for row in table.rows: print(' | '.join(cell.text for cell in row.cells)) " # Fallback when python-docx fails: pandoc -t plain # Requires apt install -y pandoc ``` ### Technical Analysis The Skill installs `python-docx` without a pinned version, lockfile, or package hash. The package name itself is not evidence of typosquatting, but the effective code installed during a future run can differ from the version available during this audit. The fallback instruction also suggests system-level installation of `pandoc` without documenting an audited version. Runtime dependency installation makes execution non-reproducible and increases exposure to package-registry or repository compromise. No malicious dependency was identified in the reviewed project; this finding concerns unsafe dependency-management practice. ### Attack Path 1. A user requests processing of a DOCX requirements document. 2. The Skill executes `pip install python-docx`. 3. The package manager downloads the currently selected release and its dependency graph. 4. If the upstream package, account, registry, mirror, or dependency chain has been compromised, attacker-controlled installation code may execute. 5. The installed package subsequently processes user documents under the agent's privileges. ### Impact Assessment A compromised or unexpectedly changed dependency can execute code with the privileges of the account running the Skill. The practical risk depends on registry integrity, environment isolation, selected package version, and host permissions. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior extends beyond a normal annotation assistant into deployment, process management, and potentially arbitrary file writes via the referenced POST save flow. When a skill's real behavior exceeds its stated purpose, users and orchestrators may authorize it under false assumptions, creating a privilege and trust mismatch that can be abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs sending image/text data to external model APIs without an explicit disclosure or consent step. Annotation datasets commonly contain proprietary, personal, or regulated content, so silent third-party transmission can create confidentiality, compliance, and contractual violations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs modifying global nginx configuration and restarting the web server, which affects the entire host rather than just annotation data. Such system-wide changes can break unrelated services, expose files over HTTP, or be repurposed to alter routing/security boundaries on the machine.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

必须完全 restart 而不是 reload

systemctl restart nginx

验证 HTML、图片、视频、API 都能正常访问

curl -s -o /dev/null -w "%{http_code}" http://localhost/annotation/<项目名>/results/viewer.html # 期望 200 curl -s -o /dev/null -w "%{http_code}" http://localhost/annotation/<项目名>/<视频文件>.mp4 # 期望 200 curl -s "http://localhost/annotation-api/" | python3 -c "import sys,json;print(len(json.load(sys.stdin).get('files',[])))" # 文件数>0

text

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The POST save endpoint accepts a client-supplied file path and writes to it directly, creating parent directories as needed and truncating the destination with open(..., 'w'). This allows a caller to overwrite arbitrary files writable by the service account, which exceeds the stated annotation-saving scope and can corrupt application data, configs, or other local files.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill clearly directs file reads/writes and network access, but it declares no explicit tool scope or permissions boundaries. In an agent environment, this increases the chance the skill is invoked with broader capabilities than users expect, enabling unintended data access or transmission during annotation workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are very broad and overlap with common requests like '数据处理' or 'label', increasing the risk that the skill activates in contexts where users did not intend annotation or data export behavior. In an agent system, over-triggering can lead to unnecessary file access, web deployment steps, or external model calls on sensitive content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest covers data annotation and web-based viewing/editing, but the instructions direct installing packages with pip and apt, invoking pandoc, ffmpeg, fuser, and running background services with nohup. While some document/media processing is related, system package management and service orchestration are not clearly within the declared annotation-tool scope.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The instruction to restate requirement documents, schemas, and label lists back to the user/agent can unnecessarily replicate sensitive business rules or embedded confidential data. In multi-agent or logged environments, echoing such content increases exposure without being essential to safe processing.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

This is a direct external transmission path to a third-party API, carrying image content and prompt text that may include sensitive annotation material. In the context of a data annotation skill, this is especially dangerous because datasets often contain confidential customer data, personal information, or unreleased media.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

bash

# 使用阿里百炼 qwen3.5-plus 分析图片
curl -s https://coding.dashscope.aliyuncs.com/v1/chat/completions \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The deployment flow kills processes, restarts nginx, changes permissions, and launches a background service without an explicit warning or approval checkpoint. These actions modify system state and service availability, so performing them as part of a routine annotation skill creates avoidable operational and security risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Changing /root permissions to 755 weakens a core host security boundary by making the root home traversable to other users/processes, solely to facilitate web serving. This broadens exposure of root-owned paths and signals an unsafe pattern of relaxing system protections instead of using properly permissioned deployment directories.

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

bash

mkdir -p /root/annotation-data/
ln -sf <实际数据目录> /root/annotation-data/<项目名>
chmod 755 /root  # 关键！否则 nginx 无法访问

启动 API 服务

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

Launching the API with nohup in the background creates persistent state beyond the current session and can leave a data-writing service running indefinitely without lifecycle management. If the service is insecure or misconfigured, it expands the attack surface and may continue exposing or modifying annotation data after the task ends.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

bash

fuser -k 8888/tcp 2>/dev/null
nohup python3 <skill路径>/scripts/annotation-api.py --port 8888 --data-dir <数据目录> > <数据目录>/results/api.log 2>&1 &

验证

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all instructions and examples exclusively in Chinese, which can violate a language/locale policy when users are not given an opt-in or alternative language. The file does not indicate that the skill is intentionally region-specific or that Chinese is a documented requirement.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code only enforces DATA_DIR containment for /file, but / accepts arbitrary dir and results parameters and uses them to recursively list files and load annotation data from any readable path. That exposes filesystem structure and contents beyond the intended dataset area, undermining the claimed restriction and enabling local information disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The save operation opens the target file in write mode unconditionally, so any existing file at the chosen path is silently replaced. Combined with the unvalidated client-controlled path, this creates a destructive arbitrary file overwrite primitive rather than a normal annotation export feature.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description defines usage in expansive, ambiguous terms like data processing, dataset generation, and annotation viewing/editing without clear boundaries. This increases the chance the agent routes unrelated requests into a capability that may inspect or transform user content, creating authorization, privacy, and least-privilege concerns.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger is purely keyword-based and very broad, so ordinary conversations about datasets, labels, or data processing could invoke the skill unintentionally. Because this skill can process user data and launch annotation workflows or a web interface, accidental activation can lead to unnecessary data handling, privacy exposure, or confusing tool execution beyond user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document declares lang="zh-CN", and the visible UI text throughout the page is exclusively in Simplified Chinese. This imposes a specific language/locale on all users without any opt-in, selection mechanism, or documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The changelog contains a natural-language instruction, "所有日期格式为 YYYY-MM-DD。", and the surrounding headings/content are in Chinese, which indicates a locale/language constraint. Under the stated policy, forcing a specific language or locale without opt-in or justification is a reportable natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and runtime messages are written only in Chinese, which imposes a language choice on users without opt-in or alternatives. The policy explicitly calls out language or locale constraints as violations when they are forced rather than optional or justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest's user-facing natural-language description and trigger guidance are entirely in Chinese, which may impose a language expectation without explicit user opt-in or a documented region-specific constraint. Under the stated policy, language-specific behavior should either be optional for users or clearly justified.

Content

No source excerpt is available for this finding.