古人诗词大师

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:48 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent Chinese classical-poetry assistant, but its HTML graph generator can overwrite arbitrary writable paths and loads remote JavaScript when reports are opened.

Review before installing. The poetry features themselves are ordinary, but only use the graph-generation workflow with a trusted, dedicated .html output path, avoid passing user-controlled paths, and be aware that the generated report loads JavaScript from the internet when opened. A safer version would restrict output to a report directory, avoid overwriting files by default, and bundle or integrity-pin D3.js.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/kg_builder.py:151

Finding

Generated Reports Execute Mutable Remote JavaScript

Content

View full analysis

``` ### Technical Analysis The generated knowledge-graph report loads D3.js from a remote CDN whenever the HTML file is opened. Although HTTPS protects the connection in ordinary circumstances, the dependency is not bundled locally and the script element does not specify a Subresource Integrity hash. Consequently, the code that ultimately executes is not fixed at Skill review time. Compromise of the CDN, its publishing infrastructure, DNS resolution, or another trusted delivery component could cause arbitrary JavaScript to execute inside the generated report. This is best classified as `T03: Remote Payload Retrieval and Execution` because an external URL supplies executable code after the Skill package has been reviewed. ### Attack Path 1. A user or Agent invokes `scripts/kg_builder.py` and generates the knowledge-graph HTML report. 2. The user opens the generated report in a browser while network access is available. 3. The browser requests `https://d3js.org/d3.v7.min.js`. 4. An attacker who has compromised the upstream distribution channel returns modified JavaScript. 5. The browser executes that JavaScript in the generated report's context. 6. The malicious script can inspect or alter report content and perform network requests with the privileges available to browser JavaScript. ### Impact Assessment Successful exploitation provides arbitrary JavaScript execution in the browser context of the generated report. The attacker could: - Read and modify knowledge-graph data displayed by the report. - Falsify report content or user-interface elements. - Redirect the user or display deceptive prompts. - Send accessible report data to an external service. - Access other reso ...[truncated 291 chars]

Remediation

View remediation

``` 4. Define a restrictive Content Security Policy that permits scripts only from approved locations and prohibits inline or dynamically evaluated code where feasible. 5. Document that generated reports require an external dependency if the report cannot be made fully self-contained. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/kg_builder.py:301

Finding

Unrestricted Output Path Allows Overwriting Arbitrary Writable Files

Content

View full analysis

1 else "poetry_knowledge_graph.html" ``` The caller-controlled value is subsequently passed to the vulnerable write operation: ```python generate_html(graph, output_file) ``` ### Technical Analysis The script accepts the destination path directly from the first command-line argument and opens that path in truncating write mode. It does not: - Restrict output to a dedicated report directory. - Require an HTML extension. - Reject absolute paths or parent-directory traversal. - Detect symbolic links. - Check whether the destination already exists. - Require explicit confirmation before overwriting an existing file. Python's `"w"` mode creates a missing file or truncates an existing file. Therefore, anyone able to influence the script argument can replace any file writable by the account running the Skill. A symbolic-link destination could also redirect the write to another writable target. ### Attack Path 1. An attacker influences the output path supplied to the knowledge-graph workflow. 2. The Agent invokes the documented builder command with that path as the first argument. 3. `main()` assigns the unvalidated argument to `output_file`. 4. `generate_html()` passes the path directly to `open(..., "w")`. 5. Python follows the path and truncates the destination if it already exists. 6. The target is replaced with generated HTML under the privileges of the Agent process. For example, an absolute path or traversal path could target a writable configuration, document, source, or shell initialization file. A pre-created ...[truncated 751 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied code implements only a limited subset of the declared functionality: basic structural analysis of a poem's form and rhyme. It does not include poet data for 17 core poets, no creation/generation capability, no poet relationship graph, no HTML visualization, no allusion database, no style comparison, and no substantive appreciation engine. Even within analysis, the code lacks the advertised 平仄/格律规范 checking beyond simple line-length classification and rhyme grouping. Therefore the description materially overstates and misrepresents the actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to read from local reference files and generate HTML outputs, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates a governance gap: an orchestrator may permit broader filesystem access than intended, increasing the risk of unintended file reads or writes if the skill is activated in the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list contains broad, common terms such as '诗人', '写诗', and '知识图谱', which can cause the skill to activate for loosely related user requests. Because this skill can read files, invoke analysis scripts, and write HTML output, overbroad activation increases the chance of unnecessary tool usage or unintended file generation in benign conversations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The activation examples mix broad creation and analysis requests without clear gating conditions or confirmation steps. In a tool-enabled environment, ambiguous routing can lead the agent to perform file-backed lookup, script execution, or HTML generation when a simpler direct answer would suffice, expanding attack surface and increasing the chance of unintended actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring states that the tool analyzes '体裁识别、押韵检测、平仄分析、字数统计', suggesting tonal-pattern analysis is implemented. In reality, the code only computes line splitting, form detection, character counts, and rhyme grouping; there is no logic for平仄/tones anywhere in the file, so the described capability does not match actual behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code declares the tool purpose entirely in Chinese and returns analysis labels such as form and rhyme quality in Chinese only. That hard-codes a specific language/locale behavior without offering the user any choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file presents all instructions and reference content exclusively in Chinese, with no user opt-in or alternative language option. Under the stated policy, forcing a specific language without user choice is a natural-language locale policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This JSON dataset uses Chinese-language values throughout, such as names, descriptions, and labels, with no accompanying indication that Chinese is an intentional user-selected locale. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code sets the document language to zh-CN and renders all visible UI text in Chinese, which enforces a specific language experience. The policy requires either user opt-in/choice or a clearly documented justification for locale constraints, and neither is present in this file.

Content

No source excerpt is available for this finding.