Activity Campaign from UI

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:09 AM UTC
• Version: 0.6.0

Overview

The skill is mostly coherent for generating H5 campaign drafts, but its example delivery code teaches an unsafe browser-rendering pattern that could create XSS risk if reused with user or CMS data.

Review generated JavaScript before using this skill's output in any real campaign. In particular, replace innerHTML string rendering with safe DOM construction or textContent for campaign data, rules, prize text, records, and popup content. Also expect the skill to generate image assets and write files under project/<delivery-slug>/ when you explicitly request local output.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: examples/full-delivery-example.md:337

Finding

Unsafe HTML Rendering Enables DOM-Based Cross-Site Scripting in the Full Delivery Example

Content

View full analysis

闯关进度

' + route.tip + '

' + route.steps.map(function (item) { return '

' + '' + item.label + '' + item.note + '' + '

'; }).join('') + '

' + tasks.map(function (task) { return '' + '

' + task.type + '

' + task.title + '

' + task.benefit + '

' + '' + task.ctaText + '' + ''; }).join('') + '

' + '

' + lottery.chanceText + '' + lottery.ctaText + '

'; } function renderCheckpoints(checkpoints) { return checkpoints.map(function (item) { return '' + '' + item.index + '' + '' + item.title + '' + '

' + item.desc + '

' + '' + item.statusText + '' + ''; }).join(''); } function renderBenefitsTab(rewardPool, rules) { return '

奖池展示

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: examples/mode-delivery-example.md:292

Finding

Unsafe HTML Rendering Enables DOM-Based Cross-Site Scripting in the Delivery Mode Example

Content

View full analysis

' + '

' + task.tag + '

' + task.title + '

' + task.desc + '

' + '' + task.ctaText + '' + ''; }).join(''); } function renderPrizePanel(prizePool) { return '

奖池一览

' + prizePool.tip + '

' + '

' + prizePool.items.map(function (item) { return '

' + item.name + '' + item.stock + '

'; }).join('') + '

'; } function renderRulesPanel(rules, records) { return '

活动说明

查看中奖记录

' + '

' + rules.map(function (rule) { return '
1. ' + rule + '
'; }).join('') + '

' + '

' + records.map(function (item) { return '' + item + ''; }).join('') + '

'; } function openPopup(id) { var popup = window.campaignData.popups.filter(function (item) { return item.id === id; })[0]; document.getElementById('popup-root').innerHTML = '

' + '

' + '

' + popup.kicker + '

' + '

' + popup.title + ...[truncated 1865 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

6. Generate a buildable activity mechanic and visual preset when the brief is under-specified
7. Output fixed-stack high-fidelity draft code when requested

## Output rules
Prefer practical output over broad commentary.

When possible, organize the answer using these sections:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README states that if the user asks for any other stack, the skill should still stay on the fixed H5/Web HTML/CSS/JavaScript stack. This is a natural-language policy issue because it unconditionally overrides user choice instead of offering opt-in or clearly framing the constraint as a documented scope limitation the user must accept.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README instructs the skill to automatically create directories and write artifacts under a local project/ path when local output is requested, but it does not require an explicit pre-write confirmation or a clear safety notice to the user at execution time. In an agent environment with filesystem access, this can lead to unexpected local side effects, overwrite risks, and reduced user awareness about persistent file creation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README states that the skill only supports H5/Web with HTML + CSS + JavaScript and will still output that fixed stack even if the user asks for another stack. This is a natural-language constraint that overrides user choice rather than offering an opt-in or clearly framed compatibility limitation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Lines L016-L021 explicitly claim a strong constraint that the skill only supports the fixed stack 'HTML + CSS + JavaScript' and will output according to that stack even if users mention others. Later sections require using Python to generate local files and a .pptx artifact, which directly contradicts the earlier documentation rather than merely adding implementation detail.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the model to default to adult female poster-style imagery and even encourages 'fashionable/sexy' presentation despite the skill's general purpose being campaign-page ideation and frontend draft generation. This introduces unnecessary sexualized-content steering that can bias outputs, create inappropriate results for broad user contexts, and increase the chance of policy-violating or unsafe generations when users did not request such content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README directs automatic filesystem writes and image generation in the local environment, including creating directories and saving assets, without requiring explicit user confirmation at execution time. This is dangerous because it normalizes side-effectful actions from prompt instructions, can surprise users with unintended local modifications, and may be abused to cause unwanted file creation or resource consumption in hosts that expose local execution tools.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill's documented purpose is campaign analysis, proposal generation, architecture, and front-end draft delivery from reference UIs. Requiring a female-led visual default introduces a stylistic and demographic constraint unrelated to that core purpose, and the later instructions intensify this into a mandatory image-generation behavior centered on attractiveness rather than implementation needs.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The skill authorizes autonomous file creation with Python when local execution is available, shifting from content generation to state-changing actions in the host environment. Even though output is intended for a project directory, this increases risk because the model can write artifacts without an additional confirmation checkpoint, which may be unsafe in sensitive or shared workspaces.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md

If the user explicitly asks for local files and the host environment supports local execution, the skill should use Python to generate artifacts on disk instead of stopping at a file structure or code-only response.

The goal is to keep the handoff clear without asking the model to generate shell or terminal instructions from screenshot-derived content.

Local delivery root:
- place all final generated files under the current execution environment's `project/` directory

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest and introductory documentation present the skill as generating new campaign proposals, architecture, and H5/Web draft code from UI references. Mandating external image-generation tool invocation, with detailed instructions about subject gender, realism, glamour, and regeneration policy, adds a substantial creative-media generation capability not inherent to converting references into front-end draft deliverables.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The required handoff note is specified only in Chinese (需要把生成好的图片...) and is mandated after delivery, which imposes a specific language on users without opt-in. This is a natural-language locale policy issue because the skill otherwise does not document a justified Chinese-only scope or provide multilingual choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example user input and generated artifact content are written entirely in Chinese, and the file does not indicate that language selection is optional or user-configurable. Because the skill appears to prescribe a specific language/locale behavior without opt-in or justification, this is a natural-language policy violation under the language/locale rule.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to create directories and write local files, and even says not to stop at a summary. In an agent environment with filesystem access, this can cause side effects the user did not clearly consent to, especially if the agent follows the skill automatically rather than requesting confirmation before modifying local state.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The example invocations are all written in Chinese and present the skill interaction as requiring Chinese phrasing, with no indication that users may choose another language. This can violate a language/locale policy when a skill implicitly enforces a specific language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to create directories and write multiple files, including a generated image, to local filesystem paths under project/<delivery-slug>/ without requiring an explicit confirmation step or warning the user about local modifications. In an agent environment with file access, this can cause unintended writes, overwrite existing content if path handling is weak, and normalize silent filesystem side effects from a prompt-only request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The mode trigger is described only by an example user request ('走 proposal mode') and surrounding expectations, but it does not define a strict activation rule or precedence against other modes. In an agent system, ambiguous routing can cause the assistant to enter proposal mode when the user intended a different capability, potentially bypassing safer handling boundaries such as architecture-only or no-execution behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to actually create directories and write a PPTX file locally when the user asks and local execution is available, but it does not require an explicit warning or confirmation about filesystem modification. This can lead to unexpected local side effects, especially in environments where users may not realize that a natural-language request authorizes persistent file creation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file includes required UI text and instructions in Chinese, such as the image alt text, hero copy, asset note, task titles, and popup titles. Because the skill does not indicate that Chinese is optional or that the skill is intended only for a Chinese-language or region-specific context, it imposes a locale choice without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

This markdown file repeatedly mentions README.zh-CN.md, indicating the skill maintains Chinese-language material alongside the default README. In isolation this is not inherently unsafe, but it suggests locale-specific behavior/documentation without any visible statement here that users can choose language or that the locale is optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Line L070 instructs maintainers to verify both README.md and README.zh-CN.md, which embeds a specific locale requirement in the process without any accompanying note that language support is optional or context-specific. Under the policy for natural-language violations, this can be read as enforcing a locale-specific artifact absent documented user choice or justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill is described primarily as producing campaign proposals, architecture, and HTML/CSS/JavaScript drafts for H5/Web delivery. Generating PowerPoint deck files is a separate document-production capability that goes beyond the core fixed-stack front-end and analysis workflow described at the top of the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This JSON manifest file defines popup activation using generic trigger labels like "openRules", "drawSuccess", and "checkpointReached" without describing scope, source event, or exclusion conditions. In a manifest, such broadly named triggers can be ambiguous about exactly when the skill should activate these popups versus when it should not.

Content

No source excerpt is available for this finding.