Html Cn Render Fix

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:22 AM UTC
• Version: 1.0.0

Overview

This skill is a focused Chinese text rendering helper with disclosed font and cache steps, though users should review the example's fixed temporary output path and package-install commands before running them.

Install only if you need Chinese text rendering help. Review commands before running them, especially system font installation and cache clearing, and prefer changing the example to save output in a private user directory or a securely created temporary file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: example.py:79

Finding

Predictable Temporary File Path Allows Local File Overwrite

Content

View full analysis

Vulnerability Details

File Location: example.py, lines 79–80
Vulnerability Type: Predictable temporary file and potential symbolic-link overwrite
Risk Level: Medium

python

output_file = '/tmp/cn-font-test.png'
plt.savefig(output_file, dpi=100, bbox_inches='tight', facecolor='white')

Technical Analysis

The script writes an image to a fixed, predictable path in the shared /tmp directory. It neither creates the destination securely nor verifies that the path is a regular file rather than a symbolic link.

On a system where relevant symbolic-link protections are absent, disabled, or inapplicable, another local user can create /tmp/cn-font-test.png as a symbolic link to a file writable by the victim. When plt.savefig() opens the predictable path, it may follow the link and truncate or overwrite the linked file.

The issue is a time-of-check/time-of-use and unsafe temporary-file handling weakness. The earlier font existence check does not protect the output path.

Attack Path

1. A local attacker determines that the script always writes to /tmp/cn-font-test.png.
2. Before the victim runs the script, the attacker creates that path as a symbolic link to a target file that the victim can modify.
3. The victim executes example.py.
4. plt.savefig() opens the predictable output path and may follow the attacker-controlled symbolic link.
5. The target file is overwritten with PNG data, potentially corrupting configuration, application data, or another victim-owned file.

Exploitation depends on local filesystem permissions and operating-system symbolic-link protections. Running the script with elevated privileges would substantially increase the set of files potentially affected.

Impact Assessment

A successful attacker can overwrite or corrupt files writable by the account executing the script. The vulnerability does not independently grant code execution or additional privileges, but ...[truncated 306 chars]

Remediation

View remediation

Remediation Suggestions

Use Python's tempfile module to create an unpredictable file securely with restrictive permissions:

python

import os
import tempfile

fd, output_file = tempfile.mkstemp(prefix='cn-font-test-', suffix='.png')
os.close(fd)

try:
    plt.savefig(
        output_file,
        dpi=100,
        bbox_inches='tight',
        facecolor='white'
    )
    print(f"Image generated successfully: {output_file}")
finally:
    if os.path.exists(output_file):
        os.remove(output_file)

If the generated image must persist, create it inside a private directory owned by the current user and configured with mode 0700. Do not construct temporary filenames from predictable constants or merely check whether a path exists before opening it, as that would remain vulnerable to race conditions.

Run the example as an unprivileged user and keep system package installation separate from script execution. Where supported, retain operating-system protections against unsafe symbolic-link following as defense in depth.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md

A: 确保：
1. 字体文件路径正确
2. 每个文本元素都使用了 `fontproperties=font_prop`
3. 清除了 matplotlib 缓存：`rm -rf ~/.cache/matplotlib`

### Q: emoji 显示为方框怎么办？

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md

A: 确保：
1. 字体文件路径正确
2. 每个文本元素都使用了 `fontproperties=font_prop`
3. 清除了 matplotlib 缓存：`rm -rf ~/.cache/matplotlib`

### Q: emoji 显示为方框怎么办？

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The document is entirely written as a Chinese-only skill description and presents the solution specifically as a Chinese rendering workflow, without indicating that other languages are supported or that users may choose their preferred locale. Under the policy criteria, forcing a specific language without user opt-in can constitute a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The title and description explicitly present the skill as a Chinese-language solution, and the document consistently assumes Chinese output/content without any user opt-in or alternative locale guidance. Under the policy, forcing a specific language is a natural-language policy concern unless the locale restriction is clearly justified or optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file contains natural-language strings and documentation entirely in Chinese and describes itself specifically as a Chinese-output example. Under the policy rule for language/locale, there is no indication that the user can opt into another language or that the locale restriction is explicitly justified as region-specific behavior.

Content

No source excerpt is available for this finding.