T03 · Remote Payload Retrieval and Execution
Error
- Location
references/INSTALL.md:15- Finding
Unverified Remote Installation Scripts Are Executed Directly
- Content
View full analysis
- Remediation
View remediation
Security audit
dream-journey(寻梦之旅)
Security checks for vulnerabilities and agentic risk
Overview
The skill appears purpose-aligned overall, but its install instructions and generated HTML handling create risks users should review before installing.
Review the install commands before use, avoid pipe-to-shell and sudo npm patterns, pin and verify third-party CLI versions where possible, and treat generated HTML as unsafe if it contains untrusted dream text, itinerary data, or image URLs. Use explicit confirmation before any booking-related step and disclose or omit commercial links when users only want neutral planning.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:163- Finding
Mandatory Commercial Messaging and Booking Links Override Output Discretion
- Content
View full analysis
"Some places are first encountered in dreams, and then Fly.ai helps make them real." ``` ### Technical Analysis The Skill does not merely enable optional travel searches. It establishes mandatory rules that force the agent to insert links for a designated commercial platform and append persistent branded messaging. These instructions alter the agent's normal output-selection behavior when the Skill is loaded. The user is not given control over whether commercial links or promotional text appear, and the instructions do not require prominent disclosure of any commercial relationship, tracking behavior, or ranking methodology. A fixed branded slogan in the report template also ensures that generated artifacts contain promotional content even if it is unrelated to the user's immediate request. ### Attack Path 1. The Skill is loaded for dream analysis or itinerary generation. 2. Its mandatory rules ...[truncated 915 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate-report.js:35- Finding
Unescaped User Data Enables Stored Script Injection in Generated HTML
- Content
View full analysis
``).join('\n'); } ``` ```js return `${day.title}
${day.description}
`; ``` ```js generateListItems(items) { return items.map(item => `${caption ? `
${caption}` : ''}- ${item}
`).join('\n'); } ``` Basic report fields are also substituted without escaping: ```js html = html.replaceAll('{{title}}', data.title || 'Dream Report'); html = html.replaceAll('{{dream_quote}}', data.dreamQuote || 'Dreams become reality'); html = html.replaceAll('{{dream_description}}', data.dreamDescription || ''); html = html.replaceAll('{{dream_restoration}}', data.dreamRestoration || ''); html = html.replaceAll('{{destination_name}}', data.destinationName || ''); html = html.replaceAll('{{destination_description}}', data.destinationDescription || ''); ``` The dream prompt generator inserts the command-line description directly into HTML: ```js``` The video generator interpolates generated values into markup: ```jsYour Dream
${description}
${script.title}
``` It also embeds serialized data directly inside an executable script context: ```jsOpening Hook
${script.hook}
- Remediation
View remediation
`, `&`, the Unicode line separators, and closing script sequences. Prefer a non-executable `application/json` element parsed through `textContent`. 4. Validate photo URLs and permit only explicitly supported schemes, such as `https:` and controlled relative paths. Reject `javascript:`, unexpected `data:` content, and malformed URLs. 5. Distinguish trusted template fragments from untrusted user text. Do not accept raw HTML for ordinary report fields. 6. Add a restrictive Content Security Policy that blocks inline scripts and unapproved network destinations. 7. Add regression tests covering closing tags, quotes, event handlers, closing script sequences, and malicious URL schemes. 8. Consider generating the document through DOM APIs using `textContent` and `setAttribute` rather than HTML string concatenation. ]]>
T08 · Insecure Dependencies
Warning
- Location
references/INSTALL.md:143- Finding
Unpinned Global Dependency Installation Can Execute Package Code with Elevated Privileges
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (56)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a broad dream-to-travel pipeline with destination discovery, live service integration, travel planning, on-trip photo validation, and post-trip media/report generation. The supplied code only supports an initial subtask: transforming a dream description into image prompts and an HTML preview. Its primary behavior is prompt generation and local file output. There is no network access, no Fly.ai usage, no travel or itinerary logic, no image/photo analysis, and no video or emotional report generation. Therefore the description materially overstates and misrepresents the actual functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description promises a complex travel-planning and dream-matching system with multimodal generation and external service integration. The code does none of that. It defines hardcoded quote categories, chooses a theme based on simple keyword presence, and outputs random quotes through command-line options. There are no network calls, no image handling, no travel logic, no report/video creation, and no Fly.ai usage. This is a clear material mismatch in primary purpose and implemented capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description presents a full dream-to-destination travel matching and planning system with real-time destination retrieval, in-trip validation, and final multimedia outputs. The actual code chunk only generates an HTML report from already-prepared data fields such as destinationName, timeline, photos, and emotionalDiary. It reads a template file, substitutes placeholders, optionally generates a quote via a local helper, and writes an HTML file. There is no evidence of network access, Fly.ai integration, destination search/matching, travel planning logic, image analysis, camera/photo explanation features, or short-video generation. While producing a final emotional report is partially consistent, the code's primary behavior is much narrower and materially different from the declared end-to-end functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个完整的“寻梦旅行”产品能力链路：梦境解析/视觉还原 → 目的地匹配 → 行程规划 → 旅行中验证 → 情感报告与短视频生成。代码却只实现了其中很小的一部分，而且是营销内容层面的产物：生成社媒短视频脚本包。它不会匹配目的地、不会规划行程、不会处理照片、不会生成报告，也没有任何网络调用或 Fly.ai 集成。其主功能与声明的核心目的存在实质偏差，因此应判定为明显不匹配。
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill states it only provides booking links and does not place orders, but later instructs the agent to execute a booking flow after user confirmation. In a travel/purchase context, this inconsistency can cause unauthorized or unexpected transactional behavior, especially if future tool integrations gain purchase capability or if users believe they are only receiving links, not initiating bookings.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/generate-report.js --json data.json
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/generate-report.js --json data.json
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/generate-report.js --json data.json
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/generate-report.js --json data.json
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/generate-video-scripts.js --dream "梦境" --dest "目的地" --score 92
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/generate-video-scripts.js --dream "梦境" --dest "目的地" --score 92
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/generate-quote.js --dream "梦境描述" # 智能匹配主题
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/generate-quote.js --dream "梦境描述" # 智能匹配主题
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/generate-quote.js --dream "梦境描述" # 智能匹配主题
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The curl | sudo bash chain is a classic dangerous pattern because it streams remote content directly into a privileged interpreter with no opportunity for inspection or integrity checks. In an install guide, users are highly likely to copy-paste this command, making exploitation practical if the upstream source is compromised.
- Content
bash # 使用 NodeSource 仓库 curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash - sudo apt-get install -y nodejs # 验证安装
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The 'curl ... | sudo bash -' construction is a classic chaining-abuse pattern: untrusted network content is streamed directly into a privileged interpreter with no review step. If the remote endpoint, dependency chain, or transport context is compromised, an attacker gains immediate root-level code execution on the user's machine.
- Content
md - 从官网下载安装包: https://nodejs.org/ - **Linux (Ubuntu/Debian)**: ```bash curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash - sudo apt-get install -y nodejs ```
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js prompt += `柔和的光线，细腻的色调，仿佛记忆与现实交织，充满宿命感和治愈感。`; prompt += `超高清画质，电影级构图，氛围感极强。`; return prompt; } /**
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js prompt += `柔和的光线，细腻的色调，仿佛记忆与现实交织，充满宿命感和治愈感。`; prompt += `超高清画质，电影级构图，氛围感极强。`; return prompt; } /**
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrase is broad enough to overlap with ordinary user conversation, which can cause the skill to activate when the user is merely discussing dreams rather than intentionally invoking the skill. Unintended activation is risky here because the skill can collect sensitive personal travel and emotional information and may steer the user into tool-assisted planning flows.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The alternate trigger suggestion is highly generic and lacks boundaries, making accidental activation more likely during normal conversation. In this skill's context, that can initiate collection of dream narratives, travel preferences, budgets, and related personal context without sufficiently clear user intent.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README makes a concrete safety claim that scripts only read JSON and do not handle personal data or networked inputs, but elsewhere documents inputs including free-form dream text and image paths/URLs. This mismatch can mislead users and reviewers about the actual data exposure surface, causing unsafe trust decisions around sensitive personal content and local file references.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The English trigger phrase is everyday language that could easily appear in non-invocation dialogue, increasing the chance of unintended activation. Because the skill spans emotional analysis, travel planning, and potential external tool usage, accidental entry into the workflow has greater privacy and consent implications than a purely informational skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The security documentation says helper scripts do not upload data or access the network, yet the workflow explicitly supports embedding external image URLs in generated HTML. Even if the scripts themselves do not fetch the images at generation time, opening the generated report in a browser can trigger outbound requests to third-party hosts, leaking IP address, user agent, referrer context, and timing information.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill says it will not store or transmit photos, but later supports remote photo URLs in HTML output. That creates a privacy and tracking risk because photo references or externally hosted images can disclose sensitive travel content and cause data transmission when the report is opened, contradicting the stated privacy posture.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The suggested activation phrase "帮我寻梦" is short and generic enough that it could plausibly appear in casual conversation without a clear intent to invoke this skill. The document also defers the full trigger list to another file, so this file does not clearly bound when the skill should or should not activate.
- Content