数字人论坛

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:48 PM UTC
• Version: 3.0.3

Overview

The skill is a disclosed forum client, but it combines authenticated posting/messaging powers with weak execution boundaries and risky dependency provenance.

Review before installing. Use a dedicated, revocable forum token with minimal permissions, avoid sending sensitive prompts or private data through posts or messages, require explicit confirmation before any posting, friending, messaging, or daily-topic publishing, and prefer a rebuilt lockfile from the official npm registry with patched dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: package-lock.json:20
• Finding: Dependencies Are Retrieved Through a Non-Official npm Registry Mirror<![CDATA[ ## Vulnerability Details **File Location**: `package-lock.json:20-30` **Vulnerability Type**: Dependency supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```json "node_modules/axios": { "version": "1.15.0", "resolved": "https://registry.npmmirror.com/axios/-/axios-1.15.0.tgz", "integrity": "sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q==", "license": "MIT", "dependencies": { "follow-redirects": "^1.15.11", "form-data": "^4.0.5", "proxy-from-env": "^2.1.0" } } ``` The same non-official registry is used for the other locked transitive dependencies, including the entry at `package-lock.json:14-19`: ```json "node_modules/asynckit": { "version": "0.4.0", "resolved": "https://registry.npmmirror.com/asynckit/-/asynckit-0.4.0.tgz", "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==", "license": "MIT" } ``` ### Technical Analysis The lockfile resolves Axios and its transitive dependency chain through `registry.npmmirror.com` instead of the official npm registry. The documentation instructs users to run `npm install`, causing npm to consume these locked download URLs. The SHA-512 integrity fields provide meaningful protection against artifacts being modified without a corresponding lockfile change. Nevertheless, using an additional registry operator expands the dependency trust boundary and introduces availability, provenance, and supply-chain risks. If a future project update changes both a mirror-hosted artifact and its recorded integrity value, or if users regenerate the lockfile against that mirror without independent provenance checks, malicious package code could enter the installation. No evidence was found that the currently locked packages are malicious, and no package lifecycle scripts are declared in the reviewed project. This finding therefore concerns unsafe dependency provenance rather ...[truncated 1380 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Configure npm to use the official registry: ```bash npm config set registry https://registry.npmjs.org/ ``` 2. Remove installed dependencies and regenerate the lockfile from the official registry: ```bash rm -rf node_modules package-lock.json npm install --package-lock-only npm ci ``` 3. Review the regenerated lockfile and verify that dependency `resolved` fields use `https://registry.npmjs.org/`. 4. Continue retaining cryptographic integrity hashes and commit the reviewed lockfile to version control. 5. Prefer exact dependency versions instead of a broad range such as `"axios": "^1.6.0"` to make dependency updates deliberate and reviewable. 6. In automated or security-sensitive deployments, use: ```bash npm ci --ignore-scripts ``` This prevents dependency lifecycle scripts from running when the project does not require them. 7. Add dependency provenance and vulnerability checks to CI, such as `npm audit`, lockfile-diff review, and an allowlist for approved package registries. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill advertises a simple forum/social capability, but the documented behavior extends to private messaging, skill sharing, recommended content, daily topic publication, and use of local credentials from config.json for authenticated external requests. This broader operational scope increases the trust gap: users may grant access expecting limited forum actions while the skill can perform additional networked and authenticated actions against an external service.

Known Vulnerable Dependency: axios==1.15.0 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2026-42044 (Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `pars) +13 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The lockfile pins axios to 1.15.0, and the supplied advisory set indicates multiple known high-severity issues affecting that version. In an agent-to-agent forum platform, HTTP client code commonly handles remote content, redirects, credentials, and API traffic, so vulnerabilities in axios can plausibly enable response tampering, credential exposure, or man-in-the-middle style abuse depending on how the dependency is used elsewhere in the skill.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The lockfile includes form-data 4.0.5, which the finding identifies as affected by a CRLF injection issue in multipart field names/filenames. If this skill ever constructs multipart requests using attacker-controlled values, an attacker may be able to smuggle or corrupt headers/body structure in outbound requests, which is especially relevant for a forum-like agent integration that may exchange files, posts, or profile data with external services.

Known Vulnerable Dependency: axios==1.15.0 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2026-42044 (Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `pars) +13 more

High

• Category: Supply Chain
• Confidence: 82% confidence
• Finding: The finding indicates axios is associated with multiple advisories involving prototype pollution–related request/response manipulation and potential man-in-the-middle or credential theft scenarios. Because this skill is a forum platform for AI agents and likely relies on outbound HTTP communication, a vulnerable HTTP client can materially increase risk of tampered responses, stolen tokens, or unsafe processing of attacker-controlled network data.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The skill description is written as a Chinese-only user-facing instruction set, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking/regional context. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 发表新帖（需要房间 ID）
node index.js create 1 "帖子标题" "帖子内容"

# 回复帖子
node index.js reply 123 "回复内容"

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The natural-language examples are broad enough that ordinary conversation could be interpreted as a command to post, reply, like, add friends, or read messages. In an agent setting, ambiguous triggers can lead to unintended authenticated actions against the external forum service, especially because the skill supports state-changing operations.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: Multiple functions send user content and identifiers to a third-party remote API, including posts, replies, messages, friend relationships, and shared skills, but this file provides no disclosure, consent flow, or safeguards around what is transmitted. In an agent skill context, this can lead to unintentional exfiltration of sensitive prompts, personal data, or agent metadata to an external service.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The manifest describes a forum platform for agents to post, reply, like, and make friends. This file also implements direct private messaging (`getMessages`, `sendMessage`) and a separate skill marketplace/sharing feature (`getSkills`, `shareSkill`), which are materially broader capabilities than the stated description and are not obvious implementation details of forum posting and friendship.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s natural-language description and all user-facing CLI messages are written exclusively in Chinese, indicating a fixed language/locale experience. There is no indication that users can opt into another language or that the Chinese-only constraint is documented as a justified regional limitation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes a forum platform for AI agents to post, reply, like, and make friends. This file exposes additional capabilities including private messaging, browsing a skill library, agent/post recommendations, and generating/publishing daily topics, which materially expand the behavior beyond that stated scope.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The usage/documentation section presents the skill as an AI-agent forum, but then documents commands for heartbeat checks, recommendations, skill library access, and daily-topic generation/publication. Those are not reflected in the manifest description and therefore indicate a semantic mismatch between claimed scope and implemented behavior.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: 描述“让 AI 智能体互相交流的论坛平台”及全文交互示例均默认中文使用场景，但未说明这是可选语言、区域限定，或是否支持其他语言。根据规则，若技能强制特定语言而没有用户选择或合理限定，属于自然语言政策风险。

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The file's human-facing error text, comments, and descriptions are written only in Chinese, including the runtime error message instructing the user to configure the token. This imposes a specific language on users without offering a language choice or documenting a justified locale restriction.

Description-Behavior Mismatch

Low

• Confidence: 85% confidence
• Finding: The manifest presents the skill as a platform for agent-to-agent interaction through posts, replies, likes, and friendships. The code additionally supports generating and publishing daily topics, which is a moderation/content-programming capability not mentioned in the description.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The placeholder strings and labels are entirely written in Chinese, which imposes a specific language on users without any stated opt-in or alternative. This is a natural-language policy concern because the file gives no indication that the locale is optional or region-specific.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The package description is written only in Chinese ("数字人论坛 - 让 AI 智能体互相交流"), which can imply a fixed language expectation without indicating that users may choose another language or locale. Under the policy rule for language/locale, this is a natural-language constraint that is not explicitly justified or optional.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"test": "node test.js"
  },
  "dependencies": {
    "axios": "^1.6.0"
  }
}

• Confidence: 90% confidence
• Finding: Using a caret range for axios allows future compatible versions to be installed implicitly, which weakens build reproducibility and can unexpectedly introduce vulnerable or behavior-changing releases. In an agent skill that likely performs network requests, dependency drift increases supply-chain risk and makes security review less reliable over time.

Static analysis

No suspicious patterns detected.