springboot-standardizer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:03 AM UTC
• Version: 1.0.0

Overview

This skill is not overtly malicious, but it needs Review because it can overwrite project files and generates a Redis configuration pattern that can be dangerous in real applications.

Install only if you intend to use a Chinese-language SpringBoot/MyBatis scaffolding aid. Run it in a clean output directory or version-controlled workspace, review every generated file before use, and replace the Redis Object/Jackson default-typing template with a safer typed serializer approach before deploying generated code.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_structure.py:252
• Finding: Unsafe Jackson Polymorphic Deserialization in Redis Templates<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_structure.py:252-277`; duplicated in `references/redis-config.md:28-53` **Vulnerability Type**: Unsafe polymorphic deserialization **Risk Level**: High ### Vulnerable Code ```java import com.fasterxml.jackson.annotation.JsonTypeInfo; import com.fasterxml.jackson.databind.ObjectMapper; import com.fasterxml.jackson.databind.jsontype.impl.LaissezFaireSubTypeValidator; import org.springframework.data.redis.serializer.Jackson2JsonRedisSerializer; @Bean public RedisTemplate<String, Object> redisTemplate(RedisConnectionFactory connectionFactory) { RedisTemplate<String, Object> template = new RedisTemplate<>(); template.setConnectionFactory(connectionFactory); Jackson2JsonRedisSerializer<Object> serializer = new Jackson2JsonRedisSerializer<>(Object.class); ObjectMapper mapper = new ObjectMapper(); mapper.activateDefaultTyping( LaissezFaireSubTypeValidator.instance, ObjectMapper.DefaultTyping.NON_FINAL, JsonTypeInfo.As.PROPERTY ); serializer.setObjectMapper(mapper); StringRedisSerializer stringSerializer = new StringRedisSerializer(); template.setKeySerializer(stringSerializer); template.setHashKeySerializer(stringSerializer); template.setValueSerializer(serializer); template.setHashValueSerializer(serializer); template.afterPropertiesSet(); return template; } ``` ### Technical Analysis The generated Redis configuration enables Jackson default typing for all non-final classes and uses `LaissezFaireSubTypeValidator`, which does not impose a meaningful restriction on polymorphic subtypes. Serialized values may consequently include type metadata instructing Jackson which application or dependency class to instantiate. When an application reads an attacker-controlled Redis value through this `RedisTemplate`, Jackson may instantiate a class selected by the attacker. If the generated application's classpath co ...[truncated 2071 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `activateDefaultTyping` and `LaissezFaireSubTypeValidator`. 2. Serialize explicitly declared DTO types instead of arbitrary `Object` values. 3. Configure separate, strongly typed Redis serializers for each cache or value category. 4. If polymorphism is unavoidable, use `BasicPolymorphicTypeValidator` with a narrow allowlist of specific packages or classes: ```java BasicPolymorphicTypeValidator validator = BasicPolymorphicTypeValidator.builder() .allowIfSubType("com.example.project.dto.") .build(); ObjectMapper mapper = new ObjectMapper(); mapper.activateDefaultTyping( validator, ObjectMapper.DefaultTyping.NON_FINAL, JsonTypeInfo.As.PROPERTY ); ``` 5. Do not allow framework, JDK, third-party, or general application implementation classes through the validator. 6. Restrict Redis network access, require authentication and transport encryption where supported, and ensure unrelated services do not share writable Redis namespaces. 7. Replace the unsafe example in `references/redis-config.md` so developers do not reintroduce the issue manually. 8. Add tests that reject serialized values containing unauthorized type identifiers. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_structure.py:464
• Finding: Insufficient Path Validation and Unconditional File Overwrite in Project Generator<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_structure.py:464-491`, with user input accepted at `scripts/generate_structure.py:522-526` **Vulnerability Type**: Path manipulation and unsafe file overwrite **Risk Level**: Medium ### Vulnerable Code ```python def create_directories(base_path, package_name): """创建标准目录结构""" package_path = package_name.replace('.', '/') for dir_template in STANDARD_DIRS: dir_path = dir_template.format(package_path=package_path) full_path = os.path.join(base_path, dir_path) os.makedirs(full_path, exist_ok=True) print(f"创建目录: {full_path}") def create_files(base_path, package_name, project_name, group_id, artifact_id, db_name): """创建标准文件""" package_path = package_name.replace('.', '/') for file_template, content in FILE_TEMPLATES.items(): file_path = file_template.format(package_path=package_path) full_path = os.path.join(base_path, file_path) os.makedirs(os.path.dirname(full_path), exist_ok=True) filled_content = content.format( package_name=package_name, package_path=package_path, project_name=project_name, group_id=group_id, artifact_id=artifact_id, db_name=db_name ) with open(full_path, 'w', encoding='utf-8') as f: f.write(filled_content) ``` ```python if args[i] == '--package' and i + 1 < len(args): package_name = args[i + 1] i += 2 ``` ### Technical Analysis The generator accepts the package name and output path from command-line arguments without validating their syntax or checking the canonical destination of generated files. The package value is transformed using a simple character replacement and then embedded into filesystem paths. Generated destinations are not resolved and checked against the intended output directory before directory creation or file writing. In addition, files are opened wit ...[truncated 1900 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict package names to valid Java package syntax: ```python import re PACKAGE_PATTERN = re.compile( r'^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$' ) if not PACKAGE_PATTERN.fullmatch(package_name): raise ValueError("Invalid Java package name") ``` 2. Resolve the output root and every generated destination, then enforce containment: ```python base = Path(base_path).resolve() destination = (base / file_path).resolve() if destination != base and base not in destination.parents: raise ValueError("Generated path escapes the output directory") ``` 3. Reject destinations whose parent path contains symbolic links, or create output in a new trusted directory not writable by untrusted users. 4. Do not overwrite existing files by default. Open files with exclusive creation mode (`'x'`) and require an explicit `--force` option for replacement. 5. When `--force` is used, display the files to be replaced and create backups where practical. 6. Validate the output directory against the caller's approved workspace before creating any files. 7. Add tests covering invalid package names, symbolic-link destinations, existing files, and containment enforcement. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The file presents the skill as able to analyze existing non-standard projects and standardize them, but the described workflow mostly points to scanning, reporting, and using templates. Overstating automation in a code-modifying context is dangerous because users may rely on the skill to safely transform real repositories when it may only produce partial scaffolds or generic guidance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The file presents the skill as able to analyze existing non-standard projects and standardize them, but the described workflow mostly points to scanning, reporting, and using templates. Overstating automation in a code-modifying context is dangerous because users may rely on the skill to safely transform real repositories when it may only produce partial scaffolds or generic guidance.

Credential Access

High

• Category: Privilege Escalation

Content

Thumbs.db

### Environment ###
.env
.env.local
''',
}

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

### Environment ###
.env
.env.local
''',
}

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs use of local scripts that analyze project paths and generate output structures, implying file read/write behavior, but it declares no explicit tool scope or permissions. In an agent environment, missing scope boundaries can cause the skill to be invoked with broader filesystem access than users expect, increasing the risk of unintended reads or writes to sensitive project files.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are broad enough to match ordinary refactoring or project-organization requests outside the narrow SpringBoot/MyBatis standardization use case. Overbroad activation can cause the wrong skill to run in unrelated contexts, potentially leading to inappropriate file operations, misleading advice, or template generation against projects the skill does not understand.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The description discusses restructuring projects and generating templates that may affect repository contents, but it does not warn users about possible file modifications or recommend reviewing changes before applying them. In a development workflow, this omission increases the chance of unreviewed writes, accidental overwrites, or propagation of incorrect boilerplate into important environments.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This markdown file presents all headings, explanations, and examples in Chinese, which can amount to a language policy violation if users are not explicitly given a language or locale choice. The file does not state that it is intended only for a Chinese-speaking audience or region-specific use case.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This Python file contains natural-language descriptions and CLI messages exclusively in Chinese, which effectively forces a specific language on users. The policy allows fixed locale behavior only when it is clearly documented and justified or when users can opt in, neither of which is present here.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The script prints usage, error, progress, and completion messages only in Chinese, imposing a single language for interaction. There is no mechanism for locale selection and no clear justification that this tool is restricted to a Chinese-language context.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This Python file contains natural-language strings entirely in Chinese, including the module description and all CLI help/output messages. Because the file is not documented as a China-specific or Chinese-only tool, this is a locale-policy issue under the rule for forced language without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The natural-language description, usage scenarios, and trigger phrases are all specified only in Chinese, with no indication that users may choose another language. Under the stated policy, a language-specific constraint should either be optional or explicitly justified as region-specific.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This markdown file presents all instructions and examples exclusively in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: This markdown file contains instructional content only in Chinese, starting with the title and continuing throughout the document. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or a documented region-specific justification is in scope.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: This markdown file presents all instructions and examples exclusively in Chinese, and it does not mention that the skill is China-specific or offer an alternative language. Under the natural-language policy rule, forcing a specific language without user opt-in can be a policy concern.

Static analysis

No suspicious patterns detected.