Activity Campaign from UI

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:09 AM UTC
• Version: 0.6.0

Overview

The skill is mostly coherent for generating H5 campaign drafts, but its example delivery code teaches an unsafe browser-rendering pattern that could create XSS risk if reused with user or CMS data.

Review generated JavaScript before using this skill's output in any real campaign. In particular, replace innerHTML string rendering with safe DOM construction or textContent for campaign data, rules, prize text, records, and popup content. Also expect the skill to generate image assets and write files under project/<delivery-slug>/ when you explicitly request local output.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: examples/full-delivery-example.md:337
• Finding: Unsafe HTML Rendering Enables DOM-Based Cross-Site Scripting in the Full Delivery Example<![CDATA[ ## Vulnerability Details **File Location**: `examples/full-delivery-example.md:337-414` **Vulnerability Type**: DOM-based cross-site scripting through unsanitized `innerHTML` assignments **Risk Level**: Medium ### Vulnerable Code ```javascript function renderPage(data) { document.getElementById('tab-tasks').innerHTML = renderTasksTab(data.progressRoute, data.tasks, data.lottery); document.getElementById('tab-checkpoints').innerHTML = renderCheckpoints(data.checkpointRewards); document.getElementById('tab-benefits').innerHTML = renderBenefitsTab(data.rewardPool, data.rules); } function renderTasksTab(route, tasks, lottery) { return '<div class="panel-title"><h2>闯关进度</h2><span>' + route.tip + '</span></div><div class="route-track">' + route.steps.map(function (item) { return '<div class="route-step' + (item.done ? ' is-done' : '') + '">' + '<b>' + item.label + '</b><span>' + item.note + '</span>' + '</div>'; }).join('') + '</div><div class="task-stack">' + tasks.map(function (task) { return '<article class="task-item">' + '<div><p class="task-type">' + task.type + '</p><h3>' + task.title + '</h3><p>' + task.benefit + '</p></div>' + '<button class="js-task-action" data-id="' + task.id + '">' + task.ctaText + '</button>' + '</article>'; }).join('') + '</div>' + '<div class="draw-stage"><strong>' + lottery.chanceText + '</strong><button class="draw-button js-start-draw">' + lottery.ctaText + '</button></div>'; } function renderCheckpoints(checkpoints) { return checkpoints.map(function (item) { return '<article class="checkpoint-card">' + '<span class="checkpoint-index">' + item.index + '</span>' + '<strong>' + item.title + '</strong>' + '<p>' + item.desc + '</p>' + '<span class="checkpoint-status">' + item.statusText + '</span>' + '</article>'; }).join(''); } function renderBenefitsTab(rewardPool, rules) { return '<div class="panel-title"><h2>奖池展示</h2></ ...[truncated 2976 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace HTML-string concatenation with DOM construction APIs such as `document.createElement()`, `append()`, and `replaceChildren()`. - Assign untrusted display values through `textContent`. - Assign identifiers through `element.dataset.id` rather than interpolating them into HTML attributes. - If rich HTML is an explicit requirement, sanitize it with a maintained allowlist-based sanitizer before insertion. - Validate campaign-data objects against a strict schema, including expected types, maximum lengths, and permitted identifier formats. - Add a security rule to `SKILL.md` requiring generated delivery code to treat screenshot-derived, user-supplied, and API-supplied text as untrusted. - Add tests containing HTML metacharacters and representative XSS payloads to confirm that generated pages render them as text. - Deploy a restrictive Content Security Policy as defense in depth, while not treating it as a replacement for safe DOM rendering. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: examples/mode-delivery-example.md:292
• Finding: Unsafe HTML Rendering Enables DOM-Based Cross-Site Scripting in the Delivery Mode Example<![CDATA[ ## Vulnerability Details **File Location**: `examples/mode-delivery-example.md:292-364` **Vulnerability Type**: DOM-based cross-site scripting through unsanitized `innerHTML` assignments **Risk Level**: Medium ### Vulnerable Code ```javascript function renderPage(data) { document.getElementById('tab-tasks').innerHTML = renderTasks(data.tasks); document.getElementById('tab-prizes').innerHTML = renderPrizePanel(data.prizePool); document.getElementById('tab-rules').innerHTML = renderRulesPanel(data.rules, data.records); } function renderTasks(tasks) { return tasks.map(function (task) { return '<article class="task-card">' + '<div><p class="task-tag">' + task.tag + '</p><h3>' + task.title + '</h3><p>' + task.desc + '</p></div>' + '<button class="task-cta">' + task.ctaText + '</button>' + '</article>'; }).join(''); } function renderPrizePanel(prizePool) { return '<div class="panel-head"><h2>奖池一览</h2><span>' + prizePool.tip + '</span></div>' + '<div class="prize-grid">' + prizePool.items.map(function (item) { return '<div class="prize-chip"><span>' + item.name + '</span><b>' + item.stock + '</b></div>'; }).join('') + '</div>'; } function renderRulesPanel(rules, records) { return '<div class="panel-head"><h2>活动说明</h2><button class="text-link js-open-popup" data-popup="recordPopup">查看中奖记录</button></div>' + '<ol class="rules-list">' + rules.map(function (rule) { return '<li>' + rule + '</li>'; }).join('') + '</ol>' + '<div class="record-strip">' + records.map(function (item) { return '<span>' + item + '</span>'; }).join('') + '</div>'; } function openPopup(id) { var popup = window.campaignData.popups.filter(function (item) { return item.id === id; })[0]; document.getElementById('popup-root').innerHTML = '<div class="popup-mask is-open">' + '<div class="reward-popup">' + '<p class="popup-kicker">' + popup.kicker + '</p>' + '<h3>' + popup.title + ...[truncated 1865 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Refactor rendering functions to return DOM nodes instead of HTML strings. - Use `textContent` for all campaign copy, rule text, task content, prize values, records, and popup fields. - Use `replaceChildren()` to update containers safely. - Permit rich text only where necessary and sanitize it with an allowlist-based HTML sanitizer. - Validate incoming campaign data before rendering and reject unexpected object shapes or data types. - Document safe DOM-rendering requirements in the Skill's JavaScript expectations so generated implementations do not reproduce this pattern. - Add automated XSS regression tests for every campaign-data field that reaches the DOM. - Use a restrictive Content Security Policy as an additional mitigation against inline script execution and unauthorized network destinations. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

6. Generate a buildable activity mechanic and visual preset when the brief is under-specified
7. Output fixed-stack high-fidelity draft code when requested

## Output rules
Prefer practical output over broad commentary.

When possible, organize the answer using these sections:

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The README states that if the user asks for any other stack, the skill should still stay on the fixed H5/Web HTML/CSS/JavaScript stack. This is a natural-language policy issue because it unconditionally overrides user choice instead of offering opt-in or clearly framing the constraint as a documented scope limitation the user must accept.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README instructs the skill to automatically create directories and write artifacts under a local project/ path when local output is requested, but it does not require an explicit pre-write confirmation or a clear safety notice to the user at execution time. In an agent environment with filesystem access, this can lead to unexpected local side effects, overwrite risks, and reduced user awareness about persistent file creation.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The README states that the skill only supports H5/Web with `HTML + CSS + JavaScript` and will still output that fixed stack even if the user asks for another stack. This is a natural-language constraint that overrides user choice rather than offering an opt-in or clearly framed compatibility limitation.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: Lines L016-L021 explicitly claim a strong constraint that the skill only supports the fixed stack 'HTML + CSS + JavaScript' and will output according to that stack even if users mention others. Later sections require using Python to generate local files and a .pptx artifact, which directly contradicts the earlier documentation rather than merely adding implementation detail.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the model to default to adult female poster-style imagery and even encourages 'fashionable/sexy' presentation despite the skill's general purpose being campaign-page ideation and frontend draft generation. This introduces unnecessary sexualized-content steering that can bias outputs, create inappropriate results for broad user contexts, and increase the chance of policy-violating or unsafe generations when users did not request such content.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README directs automatic filesystem writes and image generation in the local environment, including creating directories and saving assets, without requiring explicit user confirmation at execution time. This is dangerous because it normalizes side-effectful actions from prompt instructions, can surprise users with unintended local modifications, and may be abused to cause unwanted file creation or resource consumption in hosts that expose local execution tools.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill's documented purpose is campaign analysis, proposal generation, architecture, and front-end draft delivery from reference UIs. Requiring a female-led visual default introduces a stylistic and demographic constraint unrelated to that core purpose, and the later instructions intensify this into a mandatory image-generation behavior centered on attractiveness rather than implementation needs.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

If the user explicitly asks for local files and the host environment supports local execution, the skill should use Python to generate artifacts on disk instead of stopping at a file structure or code-only response.

The goal is to keep the handoff clear without asking the model to generate shell or terminal instructions from screenshot-derived content.

Local delivery root:
- place all final generated files under the current execution environment's `project/` directory

• Confidence: 86% confidence
• Finding: The skill authorizes autonomous file creation with Python when local execution is available, shifting from content generation to state-changing actions in the host environment. Even though output is intended for a project directory, this increases risk because the model can write artifacts without an additional confirmation checkpoint, which may be unsafe in sensitive or shared workspaces.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The manifest and introductory documentation present the skill as generating new campaign proposals, architecture, and H5/Web draft code from UI references. Mandating external image-generation tool invocation, with detailed instructions about subject gender, realism, glamour, and regeneration policy, adds a substantial creative-media generation capability not inherent to converting references into front-end draft deliverables.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The required handoff note is specified only in Chinese (`需要把生成好的图片...`) and is mandated after delivery, which imposes a specific language on users without opt-in. This is a natural-language locale policy issue because the skill otherwise does not document a justified Chinese-only scope or provide multilingual choice.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The example user input and generated artifact content are written entirely in Chinese, and the file does not indicate that language selection is optional or user-configurable. Because the skill appears to prescribe a specific language/locale behavior without opt-in or justification, this is a natural-language policy violation under the language/locale rule.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to create directories and write local files, and even says not to stop at a summary. In an agent environment with filesystem access, this can cause side effects the user did not clearly consent to, especially if the agent follows the skill automatically rather than requesting confirmation before modifying local state.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The example invocations are all written in Chinese and present the skill interaction as requiring Chinese phrasing, with no indication that users may choose another language. This can violate a language/locale policy when a skill implicitly enforces a specific language without opt-in or documented justification.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs the agent to create directories and write multiple files, including a generated image, to local filesystem paths under `project/<delivery-slug>/` without requiring an explicit confirmation step or warning the user about local modifications. In an agent environment with file access, this can cause unintended writes, overwrite existing content if path handling is weak, and normalize silent filesystem side effects from a prompt-only request.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The mode trigger is described only by an example user request ('走 proposal mode') and surrounding expectations, but it does not define a strict activation rule or precedence against other modes. In an agent system, ambiguous routing can cause the assistant to enter proposal mode when the user intended a different capability, potentially bypassing safer handling boundaries such as architecture-only or no-execution behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to actually create directories and write a PPTX file locally when the user asks and local execution is available, but it does not require an explicit warning or confirmation about filesystem modification. This can lead to unexpected local side effects, especially in environments where users may not realize that a natural-language request authorizes persistent file creation.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file includes required UI text and instructions in Chinese, such as the image alt text, hero copy, asset note, task titles, and popup titles. Because the skill does not indicate that Chinese is optional or that the skill is intended only for a Chinese-language or region-specific context, it imposes a locale choice without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: This markdown file repeatedly mentions `README.zh-CN.md`, indicating the skill maintains Chinese-language material alongside the default README. In isolation this is not inherently unsafe, but it suggests locale-specific behavior/documentation without any visible statement here that users can choose language or that the locale is optional.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: Line L070 instructs maintainers to verify both `README.md` and `README.zh-CN.md`, which embeds a specific locale requirement in the process without any accompanying note that language support is optional or context-specific. Under the policy for natural-language violations, this can be read as enforcing a locale-specific artifact absent documented user choice or justification.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The skill is described primarily as producing campaign proposals, architecture, and HTML/CSS/JavaScript drafts for H5/Web delivery. Generating PowerPoint deck files is a separate document-production capability that goes beyond the core fixed-stack front-end and analysis workflow described at the top of the skill.

Vague Triggers

Low

• Confidence: 78% confidence
• Finding: This JSON manifest file defines popup activation using generic trigger labels like "openRules", "drawSuccess", and "checkpointReached" without describing scope, source event, or exclusion conditions. In a manifest, such broadly named triggers can be ambiguous about exactly when the skill should activate these popups versus when it should not.

Static analysis

No suspicious patterns detected.