Security audit
Security checks for vulnerabilities and agentic risk
The skill is meant to automate Mali app-building requests, but it can submit user prompts through an authenticated browser without confirmation and contains unsafe AppleScript/JavaScript injection paths.
Install only if you intentionally want this skill to open and control Chrome, use your logged-in Mali session, and submit requirements to the platform. Avoid putting secrets, credentials, personal data, or sensitive internal plans in prompts until the launchers add a confirmation step, safe data serialization, stricter URL/button validation, and narrower trigger phrases.
scripts/launch-mali-builder.py:46AppleScript and JavaScript Injection Through Unsafely Interpolated User Requirements in the Python Launcher
scripts/launch-mali-builder.sh:37AppleScript and JavaScript Injection Through Unsafely Interpolated User Requirements in the Bash Launcher
scripts/launch-mali-builder.py:104Automatic Clicking of Unverified Browser Controls
The declared purpose describes an end-user automation skill that interacts with the Mali low-code platform via Chrome to build applications from user requirements. However, the supplied code chunk does not perform browser automation or application building at all. Its primary function is deployment/installation: validating files, interacting with ducc-cli, generating a skill configuration, and packaging files for upload. This is a materially different purpose from the declared behavior, so it should be flagged as a mismatch.
The README explicitly states that the skill will automatically open Chrome, navigate to an internal site, fill the user's request, and click send, but it does not provide a clear warning that these are externally visible side effects. This is dangerous because the skill can transmit sensitive prompts or trigger actions on a live internal platform immediately after activation, especially when combined with broad trigger terms.
The documented trigger list includes broad phrases such as '创建应用' and '管理系统' that can match ordinary user requests and cause the skill to activate unexpectedly. In this skill's context, unintended activation is more dangerous because activation leads to external browser navigation, automatic form filling, and submission behavior, which can cause side effects without clear user intent.
The skill includes concrete shell and browser/network automation behaviors but declares no explicit tool scope or permissions boundary. This is dangerous because an agent may execute browser-launching or command-opening actions without clear policy constraints, increasing the chance of unintended command execution or data submission.
The trigger phrases are broad enough to match generic requests like building apps, dashboards, forms, or management systems, which can cause the skill to activate when the user did not specifically intend browser automation and submission to Mali. In this context, unintended invocation is risky because the skill can immediately open Chrome and transmit user-provided content to an internal platform.
The skill describes automatically filling a website form with user content and triggering submission, but does not require an explicit warning or confirmation before sending data. This is dangerous because prompts may contain confidential internal requirements, credentials, personal data, or regulated information that would be exfiltrated to a browser session or remote service with a single automatic action.
The activation condition says the skill should trigger when a request is 'suitable' for low-code implementation, which is subjective and leaves too much room for autonomous interpretation. Because the skill performs external browser automation and form submission, ambiguous activation increases the risk of sending sensitive business requirements or personal data without sufficiently explicit user consent.
The script's user-facing title, prompts, status messages, and installation instructions are presented in Chinese throughout, beginning with the header comments and continuing across the interactive flow. For a general installation utility, this imposes a specific language/locale on users without opt-in or justification, which matches the language-policy violation criteria.
The script automatically opens an internal low-code platform, injects the user-provided requirement into the page, and clicks the submit button without explicit confirmation. This can unintentionally transmit sensitive business data, credentials, internal project details, or regulated information to an external or semi-external service, especially because the skill is designed to trigger automation from natural-language requests.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
'''
try:
subprocess.run(['osascript', '-e', applescript], check=True)
print_colored("✅ Chrome 已启动，需求已自动填充！", Colors.GREEN)
return True
except subprocess.CalledProcessError as e:
Most comments, status messages, usage text, and examples are presented only in Chinese, which effectively forces a specific language for interaction. The file does not provide an opt-in language choice or state that the skill is intentionally limited to a Chinese-speaking or region-specific audience.
On macOS, the script automatically opens a browser, injects the full user-supplied requirement into the target site, and clicks a submit button without any explicit confirmation step. This can cause unintended disclosure of sensitive internal data or accidental submission to the wrong UI element if the page structure changes, especially because the selector logic falls back to clicking the last button on the page.
The README presents all user-facing instructions and examples in Chinese, which effectively imposes a single language on users without stating that the skill is Chinese-only or region-specific. Under the stated policy, forcing a language without user opt-in can be a natural-language policy issue.
The manifest description and examples are entirely in Chinese and the skill is framed around Chinese trigger phrases without indicating that users may interact in another language. This can amount to a language policy issue when no opt-in or alternative locale behavior is documented.
The docstring, usage text, and runtime messages are all presented in Chinese, with no indication that users can select another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language or locale policy when skills are expected to avoid forcing a specific language without user opt-in.