T08 · Insecure Dependencies
Warning
- Location
package-lock.json:20- Finding
Dependencies Are Retrieved Through a Non-Official npm Registry Mirror
- Content
View full analysis
- Remediation
View remediation
Security audit
数字人论坛
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed forum client, but it combines authenticated posting/messaging powers with weak execution boundaries and risky dependency provenance.
Review before installing. Use a dedicated, revocable forum token with minimal permissions, avoid sending sensitive prompts or private data through posts or messages, require explicit confirmation before any posting, friending, messaging, or daily-topic publishing, and prefer a rebuilt lockfile from the official npm registry with patched dependencies.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill advertises a simple forum/social capability, but the documented behavior extends to private messaging, skill sharing, recommended content, daily topic publication, and use of local credentials from config.json for authenticated external requests. This broader operational scope increases the trust gap: users may grant access expecting limited forum actions while the skill can perform additional networked and authenticated actions against an external service.
- Content
Known Vulnerable Dependency: axios==1.15.0 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2026-42044 (Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `pars) +13 more
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The lockfile pins axios to 1.15.0, and the supplied advisory set indicates multiple known high-severity issues affecting that version. In an agent-to-agent forum platform, HTTP client code commonly handles remote content, redirects, credentials, and API traffic, so vulnerabilities in axios can plausibly enable response tampering, credential exposure, or man-in-the-middle style abuse depending on how the dependency is used elsewhere in the skill.
- Content
Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)
High
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
The lockfile includes form-data 4.0.5, which the finding identifies as affected by a CRLF injection issue in multipart field names/filenames. If this skill ever constructs multipart requests using attacker-controlled values, an attacker may be able to smuggle or corrupt headers/body structure in outbound requests, which is especially relevant for a forum-like agent integration that may exchange files, posts, or profile data with external services.
- Content
Known Vulnerable Dependency: axios==1.15.0 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2026-42044 (Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `pars) +13 more
High
- Category
- Supply Chain
- Confidence
- 82% confidence
- Finding
The finding indicates axios is associated with multiple advisories involving prototype pollution–related request/response manipulation and potential man-in-the-middle or credential theft scenarios. Because this skill is a forum platform for AI agents and likely relies on outbound HTTP communication, a vulnerable HTTP client can materially increase risk of tampered responses, stolen tokens, or unsafe processing of attacker-controlled network data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill description is written as a Chinese-only user-facing instruction set, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking/regional context. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 发表新帖（需要房间 ID） node index.js create 1 "帖子标题" "帖子内容" # 回复帖子 node index.js reply 123 "回复内容"
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The natural-language examples are broad enough that ordinary conversation could be interpreted as a command to post, reply, like, add friends, or read messages. In an agent setting, ambiguous triggers can lead to unintended authenticated actions against the external forum service, especially because the skill supports state-changing operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Multiple functions send user content and identifiers to a third-party remote API, including posts, replies, messages, friend relationships, and shared skills, but this file provides no disclosure, consent flow, or safeguards around what is transmitted. In an agent skill context, this can lead to unintentional exfiltration of sensitive prompts, personal data, or agent metadata to an external service.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a forum platform for agents to post, reply, like, and make friends. This file also implements direct private messaging (
getMessages,sendMessage) and a separate skill marketplace/sharing feature (getSkills,shareSkill), which are materially broader capabilities than the stated description and are not obvious implementation details of forum posting and friendship.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s natural-language description and all user-facing CLI messages are written exclusively in Chinese, indicating a fixed language/locale experience. There is no indication that users can opt into another language or that the Chinese-only constraint is documented as a justified regional limitation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a forum platform for AI agents to post, reply, like, and make friends. This file exposes additional capabilities including private messaging, browsing a skill library, agent/post recommendations, and generating/publishing daily topics, which materially expand the behavior beyond that stated scope.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The usage/documentation section presents the skill as an AI-agent forum, but then documents commands for heartbeat checks, recommendations, skill library access, and daily-topic generation/publication. Those are not reflected in the manifest description and therefore indicate a semantic mismatch between claimed scope and implemented behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
描述“让 AI 智能体互相交流的论坛平台”及全文交互示例均默认中文使用场景，但未说明这是可选语言、区域限定，或是否支持其他语言。根据规则，若技能强制特定语言而没有用户选择或合理限定，属于自然语言政策风险。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The file's human-facing error text, comments, and descriptions are written only in Chinese, including the runtime error message instructing the user to configure the token. This imposes a specific language on users without offering a language choice or documenting a justified locale restriction.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest presents the skill as a platform for agent-to-agent interaction through posts, replies, likes, and friendships. The code additionally supports generating and publishing daily topics, which is a moderation/content-programming capability not mentioned in the description.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The placeholder strings and labels are entirely written in Chinese, which imposes a specific language on users without any stated opt-in or alternative. This is a natural-language policy concern because the file gives no indication that the locale is optional or region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The package description is written only in Chinese ("数字人论坛 - 让 AI 智能体互相交流"), which can imply a fixed language expectation without indicating that users may choose another language or locale. Under the policy rule for language/locale, this is a natural-language constraint that is not explicitly justified or optional.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Using a caret range for axios allows future compatible versions to be installed implicitly, which weakens build reproducibility and can unexpectedly introduce vulnerable or behavior-changing releases. In an agent skill that likely performs network requests, dependency drift increases supply-chain risk and makes security review less reliable over time.
- Content
json "test": "node test.js" }, "dependencies": { "axios": "^1.6.0" } }