T03 · Remote Payload Retrieval and Execution
Warning
- Location
assets/globe.html:186- Finding
Unpinned Third-Party JavaScript Allows Remote Payload Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
aws-SkyRoute
Security checks for vulnerabilities and agentic risk
Overview
The skill is a static traffic-globe demo, but opening it automatically runs mutable third-party JavaScript from a CDN and its live-looking metrics are simulated.
Review this before installing or hosting. It is reasonable as a visual demo, but vendor or pin the globe.gl script and add integrity checks before using it in an internal dashboard or on an origin with sensitive sessions. Treat all displayed traffic and metrics as simulated until you wire in a real data source, and expect parts of the UI to be Chinese-localized.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The feature list explicitly states "Country name mapping (CC → Chinese name)", which imposes a specific language/locale in the skill's output. The file does not offer user opt-in, alternative locales, or a documented regional justification, so this is a natural-language locale policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This file declares
lang="zh", and the UI text and time formatting are consistently hard-coded to Chinese (zh-CN). The policy for natural-language violations applies to all file types, and forcing a specific language/locale without user opt-in is explicitly in scope.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest describes a globe visualization of real-time user connections flowing to AWS regions with operational metrics and alerts. In code, the regions, CloudFront edges, request counts, hit rates, latency, and related telemetry are hard-coded and then animated via random simulation logic, so the skill behaves as a demo/simulator rather than a real traffic monitor.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The example mapping uses Chinese display names (
'美国','英国') as the apparent default localization, but the README does not mention that the skill is Chinese-localized or give users an option to choose another language. This can violate language/locale policy when a skill implicitly forces a specific language without opt-in.- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The stated purpose emphasizes global traffic flowing to AWS regions, suggesting region-aware destination visualization. The code defines only one ALB target and one S3 target, both in a single geographic area, and sends all simulated arcs to one of those two endpoints, which is narrower than the manifest's description.
- Content