Html Cn Render Fix

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:22 AM UTC
• Version: 1.0.0

Overview

This skill is a focused Chinese text rendering helper with disclosed font and cache steps, though users should review the example's fixed temporary output path and package-install commands before running them.

Install only if you need Chinese text rendering help. Review commands before running them, especially system font installation and cache clearing, and prefer changing the example to save output in a private user directory or a securely created temporary file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: example.py:79
• Finding: Predictable Temporary File Path Allows Local File Overwrite## Vulnerability Details **File Location**: `example.py`, lines 79–80 **Vulnerability Type**: Predictable temporary file and potential symbolic-link overwrite **Risk Level**: Medium ```python output_file = '/tmp/cn-font-test.png' plt.savefig(output_file, dpi=100, bbox_inches='tight', facecolor='white') ``` ### Technical Analysis The script writes an image to a fixed, predictable path in the shared `/tmp` directory. It neither creates the destination securely nor verifies that the path is a regular file rather than a symbolic link. On a system where relevant symbolic-link protections are absent, disabled, or inapplicable, another local user can create `/tmp/cn-font-test.png` as a symbolic link to a file writable by the victim. When `plt.savefig()` opens the predictable path, it may follow the link and truncate or overwrite the linked file. The issue is a time-of-check/time-of-use and unsafe temporary-file handling weakness. The earlier font existence check does not protect the output path. ### Attack Path 1. A local attacker determines that the script always writes to `/tmp/cn-font-test.png`. 2. Before the victim runs the script, the attacker creates that path as a symbolic link to a target file that the victim can modify. 3. The victim executes `example.py`. 4. `plt.savefig()` opens the predictable output path and may follow the attacker-controlled symbolic link. 5. The target file is overwritten with PNG data, potentially corrupting configuration, application data, or another victim-owned file. Exploitation depends on local filesystem permissions and operating-system symbolic-link protections. Running the script with elevated privileges would substantially increase the set of files potentially affected. ### Impact Assessment A successful attacker can overwrite or corrupt files writable by the account executing the script. The vulnerability does not independently grant code execution or additional privileges, but ...[truncated 306 chars]
• Remediation: ## Remediation Suggestions Use Python's `tempfile` module to create an unpredictable file securely with restrictive permissions: ```python import os import tempfile fd, output_file = tempfile.mkstemp(prefix='cn-font-test-', suffix='.png') os.close(fd) try: plt.savefig( output_file, dpi=100, bbox_inches='tight', facecolor='white' ) print(f"Image generated successfully: {output_file}") finally: if os.path.exists(output_file): os.remove(output_file) ``` If the generated image must persist, create it inside a private directory owned by the current user and configured with mode `0700`. Do not construct temporary filenames from predictable constants or merely check whether a path exists before opening it, as that would remain vulnerable to race conditions. Run the example as an unprivileged user and keep system package installation separate from script execution. Where supported, retain operating-system protections against unsafe symbolic-link following as defense in depth.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

A: 确保：
1. 字体文件路径正确
2. 每个文本元素都使用了 `fontproperties=font_prop`
3. 清除了 matplotlib 缓存：`rm -rf ~/.cache/matplotlib`

### Q: emoji 显示为方框怎么办？

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

A: 确保：
1. 字体文件路径正确
2. 每个文本元素都使用了 `fontproperties=font_prop`
3. 清除了 matplotlib 缓存：`rm -rf ~/.cache/matplotlib`

### Q: emoji 显示为方框怎么办？

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: The document is entirely written as a Chinese-only skill description and presents the solution specifically as a Chinese rendering workflow, without indicating that other languages are supported or that users may choose their preferred locale. Under the policy criteria, forcing a specific language without user opt-in can constitute a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The title and description explicitly present the skill as a Chinese-language solution, and the document consistently assumes Chinese output/content without any user opt-in or alternative locale guidance. Under the policy, forcing a specific language is a natural-language policy concern unless the locale restriction is clearly justified or optional.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This code file contains natural-language strings and documentation entirely in Chinese and describes itself specifically as a Chinese-output example. Under the policy rule for language/locale, there is no indication that the user can opt into another language or that the locale restriction is explicitly justified as region-specific behavior.