Security audit

房产信息查询

Security checks for vulnerabilities and agentic risk

Overview

This real-estate research skill is mostly purpose-aligned, but it generates persistent interactive HTML from third-party listing data without clear sanitization requirements, creating a meaningful browser-side injection risk.

Install only if you are comfortable with the skill sending real-estate search criteria to external websites and creating local HTML reports. Treat generated reports as untrusted content, especially if they include data or links from listing sites; avoid opening them in a sensitive browser profile until the template adds proper escaping, URL validation, safe chart-data serialization, and either bundled Chart.js or SRI.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: assets/report_template.html:256
Finding: Untrusted Web Data Is Inserted into Executable HTML and JavaScript Contexts Without Sanitization
Content: View full analysis
{{SUMMARY_CARDS}}

🏠 房源列表

全部户型
Remediation: View remediation
`, `&`, U+2028, and U+2029 so serialized values cannot terminate a script element or JavaScript literal. 5. Validate links with a strict URL parser and allow only required schemes, preferably `https:`. Reject `javascript:`, `vbscript:`, unsafe `data:`, and malformed URLs. 6. Validate image URLs separately and avoid generating raw attributes from untrusted strings. 7. If rich HTML is required, sanitize it with a maintained allowlist-based sanitizer. Remove scripts, inline event handlers, dangerous elements, dangerous attributes, and active URL schemes. 8. Add a restrictive Content Security Policy. Prefer external or nonce-protected scripts and prohibit inline event handlers. 9. Update `SKILL.md` to explicitly mandate these controls whenever report placeholders are populated. 10. Add security tests containing payloads for HTML element injection, attribute breakout, script-context breakout, and malicious URL schemes. ]]>

T08 · Insecure Dependencies

Warning

Location: assets/report_template.html:7
Finding: Third-Party Chart.js Code Is Loaded Without Subresource Integrity Verification
Content: View full analysis
``` ### Technical Analysis Every generated report retrieves and executes JavaScript from a third-party CDN when the report is opened. The dependency version is pinned to Chart.js 4.4.0, which reduces accidental version drift, but the script element does not include an `integrity` hash or a `crossorigin` policy. Consequently, the browser verifies transport security through HTTPS but does not verify that the returned bytes match a specific audited artifact. A compromise affecting the CDN, package publication, CDN account, or delivery infrastructure could cause modified JavaScript to execute in every generated report. This is a supply-chain trust issue because the effective executable content is not entirely contained in the audited project. ### Attack Path 1. An attacker compromises the package publication path, CDN infrastructure, CDN cache, or another component capable of changing the response for the referenced URL. 2. The attacker substitutes the expected Chart.js artifact with malicious JavaScript. 3. The skill generates an HTML report containing the external script reference. 4. A user opens the report while connected to the network. 5. The browser downloads the modified script from the CDN. 6. Because no Subresource Integrity hash is present, the browser accepts and executes the altered content. 7. The malicious script accesses or changes report content and can initiate network requests from the browser context. ### Impact Assessment Successful exploitation allows arbitrary JavaScript execution within every affected generated report. The malicious dependency could: - Read all property and analysis data displayed in the report. - Exfiltrate report contents ...[truncated 343 chars]
Remediation: View remediation
``` 3. Obtain the integrity value from a trusted build or calculate it directly from a separately verified release artifact. Do not use an unverified hash copied from the same potentially compromised delivery response. 4. Retain exact version pinning and establish a controlled dependency update and review process. 5. Apply a Content Security Policy that restricts scripts to the bundled artifact or the explicitly approved CDN. 6. Consider generating charts without runtime third-party code when the report can be rendered as static SVG or images. 7. Document the external dependency, its version, source, checksum, and update procedure in the project. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill advertises a very broad set of trigger words such as '找房', '买房', '看房', and '比价', which are common in ordinary conversation and can cause unintended invocation. That increases the chance the agent will launch web searches and produce reports when the user only wanted general discussion, causing unnecessary external disclosure of user-provided housing preferences and locations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description is written as a Chinese-only skill description and all trigger phrases are defined in Chinese, implying the skill expects or enforces a specific language. There is no indication that users may choose another language or that the locale limitation is explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation logic says the skill should run when the user merely 'mentions' broad housing-related topics, without defining exclusion conditions or requiring explicit consent for networked actions. In context, this skill performs third-party searches and fetches detailed pages, so ambiguous activation materially raises privacy and unintended-action risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow instructs the agent to query multiple third-party real-estate and search platforms and fetch detail pages based on user-supplied city, district, school, and housing criteria, but it does not clearly warn the user that these external requests will occur. This can expose sensitive intent and location preferences to outside services without informed consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The HTML document sets lang="zh-CN", and the visible UI text throughout the template is Chinese-only, which indicates a fixed language/locale experience. Under the policy, forcing a specific language without user opt-in or a clearly documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill writes a persistent HTML report to the local filesystem but does not clearly notify the user that a file will be created and retained. While lower severity than network disclosure, local persistence can still leak sensitive housing preferences, budgets, school interests, or URLs to other local users or processes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file contains natural-language guidance only in Chinese, which can amount to a language/locale policy violation when no user opt-in or alternative language option is provided. The file does not state that it is intended exclusively for a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.