Social Media Monitor

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:33 AM UTC
• Version: 1.0.0

Overview

This skill is a local CSV-based social media monitoring tool with disclosed local file writes, but users should review its dependency source and naming mismatch before installing.

Install only if you are comfortable with a Chinese-language, local-file monitoring tool that stores keywords, alert settings, and reports inside its skill directory. Prefer installing with the committed lockfile, consider regenerating it from the official npm registry, and review dependency updates before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: package-lock.json:20
• Finding: Dependencies Are Locked to a Third-Party npm Registry Mirror## Vulnerability Details **File Location**: `package-lock.json:20-32` **Vulnerability Type**: Third-party dependency supply-chain exposure **Risk Level**: Medium The committed lockfile resolves packages through `registry.npmmirror.com` rather than the official npm registry: ```json "node_modules/@hono/node-server": { "version": "1.19.11", "resolved": "https://registry.npmmirror.com/@hono/node-server/-/node-server-1.19.11.tgz", "integrity": "sha512-dr8/3zEaB+p0D2n/IUrlPF1HZm586qgJNXK1a9fhg/PzdtkK7Ksd5l312tJX2yBuALqDYBlG20QEbayqPyxn+g==", "license": "MIT", "engines": { "node": ">=18.14.1" }, "peerDependencies": { "hono": "^4" } }, "node_modules/@modelcontextprotocol/sdk": { "version": "1.27.1", "resolved": "https://registry.npmmirror.com/@modelcontextprotocol/sdk/-/sdk-1.27.1.tgz", ``` The same third-party registry is used throughout the lockfile for direct and transitive dependencies. The installation instructions in `README.md:9-15` and `SKILL.md:82-88` direct users to run `npm install`, which processes these URLs. ### Technical Analysis A package lock normally provides deterministic versions and cryptographic integrity hashes. The included SHA-512 integrity values substantially limit the ability of a compromised mirror to silently substitute package contents. Nevertheless, using a third-party mirror introduces an additional supply-chain trust boundary and exposes installation availability and package provenance to that operator. Malicious package substitution would generally also require modification or bypass of the lockfile integrity metadata; compromise of the mirror alone should cause an integrity failure rather than silent execution. Risk remains if an attacker can alter both the mirror content and lockfile, influence installation so integrity checking is bypassed, or exploit weaknesses in mirror synchronization and package provenance. ### Attack Path 1. A user follow ...[truncated 1326 chars]
• Remediation: ## Remediation Suggestions 1. Configure npm to use the official registry: ```bash npm config set registry https://registry.npmjs.org/ ``` 2. Remove and regenerate the lockfile using the trusted registry: ```bash rm -rf node_modules package-lock.json npm install ``` 3. Verify that all resulting `resolved` fields use `https://registry.npmjs.org/`. 4. Commit the regenerated lockfile and use `npm ci` in automated and production installations to enforce exact locked versions and integrity hashes. 5. Pin security-sensitive direct dependencies to reviewed versions rather than broad compatible ranges where operationally practical. 6. Add dependency review and vulnerability scanning to the release process, including inspection for unexpected lifecycle scripts. 7. If the mirror is intentionally required, document the trust decision, restrict it through organizational controls, and independently verify package hashes and provenance against the official npm registry.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: fast-uri 3.1.0 is associated with multiple URI parsing issues including host confusion and malformed IPv6 handling, which can enable SSRF or security policy bypass when the application trusts parsed URLs for outbound requests or allowlists. For a social-media monitoring skill, URL ingestion from external content is plausible, making this dependency more concerning if any fetched links, webhooks, or remote resources are processed.

Known Vulnerable Dependency: hono==4.12.8 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: hono 4.12.8 has many listed advisories spanning cookie handling, routing, and related framework behaviors. Because @modelcontextprotocol/sdk depends on Hono and this skill likely operates as a networked service, framework-level flaws can materially affect request handling, auth boundaries, and response security even if the application code itself appears simple.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: ip-address 10.1.0 is flagged for address parsing inconsistencies and an XSS issue in HTML-emitting methods. This is most dangerous when IP parsing is used for trust decisions such as allowlists/rate limiting, or when generated HTML from the library is rendered; here it is transitive through express-rate-limit, so the practical risk depends on whether those specific features are exercised.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: path-to-regexp 8.3.0 is reported vulnerable to ReDoS/DoS via crafted route patterns or matching behavior. In a web-facing skill using Express or similar routing, this can allow attackers to consume CPU with pathological requests if vulnerable matching paths are reachable.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The file metadata and comments identify the server as a different tool ('linguistic-landscape-analyzer') than the declared social-media monitor skill. This mismatch undermines transparency and trust, making it harder for users and reviewers to understand what code is actually running, which can conceal risky behavior or cause unsafe consent decisions.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The title and core description are written in Chinese, and the README continues entirely in Chinese without indicating that the skill is China-specific or offering an alternative language. This can violate a language/locale policy when users are not given an opt-in or choice of language.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: The natural-language values "AI 工具" and "科技" indicate this file is constrained to Chinese terms, but there is no accompanying indication that the user chose this language or that the locale restriction is intentionally region-specific. Under the policy, forcing a specific language or locale without opt-in or clear justification is a reportable issue.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The server header and tool descriptions are written to position the skill as a Chinese-language MCP server, and several tools return only Chinese-language status/error text. The file does not provide a general user opt-in or language-selection mechanism for these natural-language interactions, which can violate language/locale choice policy.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The weekly report tool writes a Markdown file to disk automatically without explicit user warning or confirmation. Silent file creation is risky in agent environments because it introduces persistent side effects, may overwrite expectations about tool behavior, and can be abused to fill storage or leave sensitive analysis artifacts behind.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill performs persistent local state mutations by writing keyword and configuration JSON files, which goes beyond purely read-only monitoring/analysis behavior suggested by the skill description. In an agent setting, undeclared disk writes can surprise users, create lasting side effects, and be chained with repeated tool calls to manipulate future outputs or operational behavior.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The add_keyword tool persists user-supplied data into a JSON file without warning or consent. This creates durable state that affects later monitoring results, enabling accidental or malicious poisoning of the monitoring set and causing cross-session behavior changes that the user may not expect.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The threshold-setting tool writes configuration changes to disk silently, altering future alerting behavior across sessions. Persistent configuration mutation without confirmation can disable or desensitize alerts, causing users to miss negative-sentiment signals or trust manipulated monitoring outcomes.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The manifest description is written entirely in Chinese, and the rest of the skill documentation likewise assumes Chinese without offering an opt-in or alternative locale. This can violate the language/locale policy criterion because the skill appears to force a specific language for user-facing instructions.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: The parameter documentation sets `language` defaults to `zh` for analysis functions, but the README does not clearly present this as a user-selectable locale preference or justify it as a region-specific tool constraint. This may be interpreted as forcing a locale-specific default without explicit user opt-in.

Known Vulnerable Dependency: @hono/node-server==1.19.11 — 2 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The lockfile pins @hono/node-server 1.19.11, and the listed advisories affect static file serving behavior through path normalization and slash-handling edge cases. In an MCP/server-style skill, this becomes relevant if the package exposes HTTP endpoints or serves local assets, because middleware bypass or Windows path traversal could weaken access controls or disclose files.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low

• Category: Supply Chain
• Confidence: 82% confidence
• Finding: body-parser 2.2.2 is flagged for a denial-of-service issue involving invalid limit handling. This is a real dependency risk, but in this lockfile-only context it is likely only exploitable if the skill exposes HTTP request parsing paths that accept attacker-controlled bodies.

Known Vulnerable Dependency: qs==6.15.0 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: qs 6.15.0 is associated with denial-of-service and parser edge-case issues affecting query string handling. This is a genuine dependency concern, but the observed impact is generally limited to availability degradation when the service parses attacker-controlled query strings or serializes malformed inputs.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The package description is written entirely in Chinese, which indicates the skill is intended for a specific language audience, but this file provides no user opt-in, language choice, or documented justification for the locale restriction. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "小爪 🦞",
  "license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.27.1",
    "keyword-extractor": "^0.0.28",
    "sentiment": "^5.0.2",
    "zod": "^4.3.6"

• Confidence: 90% confidence
• Finding: Using a caret range for @modelcontextprotocol/sdk allows automatic installation of newer compatible versions, which can unexpectedly introduce vulnerable or malicious code through the software supply chain. In an MCP skill, this dependency is security-relevant because it may affect server behavior and tool exposure, so uncontrolled upgrades increase risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.27.1",
    "keyword-extractor": "^0.0.28",
    "sentiment": "^5.0.2",
    "zod": "^4.3.6"
  }

• Confidence: 88% confidence
• Finding: Using a caret range for keyword-extractor permits silent dependency drift across installs, which creates a supply-chain attack surface if an upstream release is compromised or contains a security defect. Although this library is not obviously high privilege from this file alone, unpinned third-party code still weakens build reproducibility and trust.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "@modelcontextprotocol/sdk": "^1.27.1",
    "keyword-extractor": "^0.0.28",
    "sentiment": "^5.0.2",
    "zod": "^4.3.6"
  }
}

• Confidence: 88% confidence
• Finding: Using a caret range for sentiment allows unreviewed upstream changes to be pulled in during installation, increasing exposure to supply-chain compromise or regressions. In a text-processing skill, that could alter analysis logic or introduce vulnerable transitive code without explicit operator approval.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"@modelcontextprotocol/sdk": "^1.27.1",
    "keyword-extractor": "^0.0.28",
    "sentiment": "^5.0.2",
    "zod": "^4.3.6"
  }
}

• Confidence: 89% confidence
• Finding: Using a caret range for zod allows future package versions to be installed automatically, which can introduce security bugs or malicious changes into validation logic. Since validation libraries often sit on trust boundaries, supply-chain drift here is more concerning than a purely cosmetic dependency.

Static analysis

No suspicious patterns detected.