头脑风暴 · 从想法到设计

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:57 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed brainstorming workflow, but it also directs repository commits and can start an unauthenticated visual companion server that may expose session content if bound beyond localhost.

Install only if you want a structured design-first workflow that may inspect project context, write design specs, and commit them. Use the visual companion on localhost when possible, avoid sensitive content if binding to 0.0.0.0, stop the server when finished, and require explicit approval before any git commit.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/server.cjs:162

Finding

Unauthenticated HTTP and WebSocket Access to the Visual Companion Server

Content

View full analysis

{ const info = JSON.stringify({ type: 'server-started', port: Number(PORT), host: HOST, url_host: URL_HOST, url: 'http://' + URL_HOST + ':' + PORT, screen_dir: CONTENT_DIR, state_dir: STATE_DIR }); console.log(info); fs.writeFileSync(path.join(STATE_DIR, 'server-info'), info + '\n'); }); ``` The launcher explicitly permits binding the service to a non-loopback interface: ```bash BIND_HOST="127.0.0.1" URL_HOST="" while [[ $# -gt 0 ]]; do case "$1" in --host) BIND_HOST="$2" shift 2 ;; --url-host) URL_HOST="$2" shift 2 ;; ``` ```bash env BRAINSTORM_DIR="$SESSION_DIR" BRAINSTORM_HOST="$BIND_HOST" BRAINSTORM_URL_HOST="$URL_HOST" BRAINSTORM_OWNER_PID="$OWNER_PID" node server.cjs ``` ### Technical Analysis The visual companion can be bound to `0.0.0.0` or another network-accessible interface, but neith ...[truncated 2603 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/helper.js:45

Finding

DOM-Based Cross-Site Scripting Through Unsafe Indicator Rendering

Content

View full analysis

{ const indicator = document.getElementById('indicator-text'); if (!indicator) return; const container = target.closest('.options') || target.closest('.cards'); const selected = container ? container.querySelectorAll('.selected') : []; if (selected.length === 0) { indicator.textContent = 'Click an option above, then return to the terminal'; } else if (selected.length === 1) { const label = selected[0].querySelector('h3, .content h3, .card-body h3')?.textContent?.trim() || selected[0].dataset.choice; indicator.innerHTML = '' + label + ' selected — return to terminal to continue'; } else { indicator.innerHTML = '' + selected.length + ' selected — return to terminal to continue'; } }, 0); ``` ### Technical Analysis The selected option label is obtained through `textContent`, but it is then concatenated into an HTML string assigned to `indicator.innerHTML`. Reading through `textContent` does not make the value safe for a later HTML parsing context. For example, a heading may safely display the literal text `` because its source screen encoded the angle brackets as entities. When the user selects the option, `textContent` returns the decoded literal characters. Assigning that value to `innerHTML` causes the browser to parse those characters as active markup, potentially creating an element with an executable event handler. The companion is designed to display dynamically generated screens that may incorporate project text or user-provided content. Therefore, a malicious project artifact or other untrusted value included in a selectable heading can cross the intended text boundary and execute in ...[truncated 1439 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a planning/requirements-analysis skill used before implementation work. The supplied code does not perform intent exploration, requirements gathering, or design analysis. Instead, it implements browser-side interactive UI behavior plus live server communication over WebSockets, including event telemetry and remote-triggered page reload. These are materially different primary behaviors and capabilities from the declared purpose, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is a conceptual planning/requirements exploration tool, but the supplied code chunk is operational infrastructure for starting a local or remote server. Its primary behavior is process and server management, not analyzing user intent or guiding design. While a brainstorm tool might rely on a server internally, this code exposes substantial undeclared capabilities—network service startup, filesystem persistence, and process control—that are materially different from the stated description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about requirement exploration and design planning before implementation, which is a conceptual/interactive planning function. The actual code performs operational system tasks: reading a PID file, sending signals to terminate a process, deleting log/PID files, and removing temporary directories. This is a materially different primary purpose and includes undeclared capabilities involving process control and filesystem deletion. Therefore the description does not accurately represent the code's behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code materially exceeds the stated purpose of a brainstorming/design skill by starting a local HTTP/WebSocket server, serving HTML files, injecting helper JavaScript into rendered pages, watching filesystem content, and capturing user events to disk. This mismatch is dangerous because it creates an undeclared interactive service and telemetry surface that could expose local content, collect user interaction data, or be repurposed for unintended browser-based actions, especially since served HTML is not sanitized and helper code is injected automatically.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill declares that it 'MUST' be used before any creative work, creating an excessively broad trigger that can override operator judgment and force unnecessary workflow execution. Broad mandatory invocation increases the chance that the agent will inspect files, docs, and git history in situations where such access is not needed, expanding exposure and reducing user control.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

## Checklist

You MUST create a task for each of these items and complete them in order:

1. **Explore project context** — check files, docs, recent commits
2. **Offer visual companion** (if topic will involve visual questions) — this is its own message, not combined with a clarifying question. See the Visual Companion section below.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The checklist instructs the agent to write a design doc and commit it, but the skill description does not prominently warn that using the skill may perform git commits. Automatic commits can create unintended repository changes, leak sensitive design content into history, and violate user expectations about when persistent changes occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This section reiterates that the validated design should be committed to git, reinforcing persistent side effects without an explicit approval gate. Repeated automatic commit instructions make accidental repository modification more likely and can normalize unsafe assumptions about consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script establishes a live WebSocket connection, buffers and transmits events, and accepts server-driven commands to reload the page. For a skill described as brainstorming support, this behavior exceeds the stated purpose and creates an unnecessary command-and-control and telemetry channel that could be abused if the server or connection is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Queued events are automatically transmitted to the server when the socket opens, with no visible disclosure or consent mechanism in this file. Even if the data seems limited, silent behavioral telemetry can expose user choices and workflow details, and the risk is higher because the feature is not aligned with the skill's declared brainstorming purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The client blindly honors a WebSocket message with type 'reload' and immediately refreshes the page. That gives the remote endpoint control over client behavior, enabling disruption, forced state resets, and a foothold for broader abuse despite not being justified by a brainstorming-only workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The click handler captures textContent, dataset.choice, element IDs, and timestamps, then sends them to the server without any visible warning. This can leak user input context or sensitive labels embedded in the UI, making it a privacy and telemetry issue that is especially unjustified for a brainstorming skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The code probes and monitors an owner process using process.kill(pid, 0) to determine whether another process is alive. That capability is unrelated to exploring user intent or requirements and reflects process-management behavior that the manifest does not justify.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/start-server.sh (reported line 67)May include surrounding context.

sh

FOREGROUND="true"
fi

# Windows/Git Bash reaps nohup background processes. Auto-foreground when detected.
if [[ "$FOREGROUND" != "true" && "$FORCE_BACKGROUND" != "true" ]]; then
  case "${OSTYPE:-}" in
    msys*|cygwin*|mingw*) FOREGROUND="true" ;;

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/start-server.sh (reported line 119)May include surrounding context.

sh

FOREGROUND="true"
fi

# Windows/Git Bash reaps nohup background processes. Auto-foreground when detected.
if [[ "$FOREGROUND" != "true" && "$FORCE_BACKGROUND" != "true" ]]; then
  case "${OSTYPE:-}" in
    msys*|cygwin*|mingw*) FOREGROUND="true" ;;

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The use of disown removes the spawned server from the shell job table, making it less likely to be terminated with the invoking shell and harder for the caller to manage. In an agent skill, this persistence behavior can leave services running unintentionally, increasing attack surface and complicating containment or forensic visibility.

Content

Scanner excerpt · scripts/start-server.sh (reported line 118)May include surrounding context.

sh

fi

# Start server, capturing output to log file
# Use nohup to survive shell exit; disown to remove from job table
nohup env BRAINSTORM_DIR="$SESSION_DIR" BRAINSTORM_HOST="$BIND_HOST" BRAINSTORM_URL_HOST="$URL_HOST" BRAINSTORM_OWNER_PID="$OWNER_PID" node server.cjs > "$LOG_FILE" 2>&1 &
SERVER_PID=$!
disown "$SERVER_PID" 2>/dev/null

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The use of disown removes the spawned server from the shell job table, making it less likely to be terminated with the invoking shell and harder for the caller to manage. In an agent skill, this persistence behavior can leave services running unintentionally, increasing attack surface and complicating containment or forensic visibility.

Content

Scanner excerpt · scripts/start-server.sh (reported line 118)May include surrounding context.

sh

fi

# Start server, capturing output to log file
# Use nohup to survive shell exit; disown to remove from job table
nohup env BRAINSTORM_DIR="$SESSION_DIR" BRAINSTORM_HOST="$BIND_HOST" BRAINSTORM_URL_HOST="$URL_HOST" BRAINSTORM_OWNER_PID="$OWNER_PID" node server.cjs > "$LOG_FILE" 2>&1 &
SERVER_PID=$!
disown "$SERVER_PID" 2>/dev/null

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/start-server.sh (reported line 121)May include surrounding context.

sh

# Use nohup to survive shell exit; disown to remove from job table
nohup env BRAINSTORM_DIR="$SESSION_DIR" BRAINSTORM_HOST="$BIND_HOST" BRAINSTORM_URL_HOST="$URL_HOST" BRAINSTORM_OWNER_PID="$OWNER_PID" node server.cjs > "$LOG_FILE" 2>&1 &
SERVER_PID=$!
disown "$SERVER_PID" 2>/dev/null
echo "$SERVER_PID" > "$PID_FILE"

# Wait for server-started message (check log file)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide explicitly instructs users to bind the server to 0.0.0.0 when localhost is unreachable, which exposes the service on all network interfaces. Because the skill does not pair this with a clear warning about network exposure, access restrictions, or safe-use conditions, users may unintentionally make brainstorming content and interaction state reachable from other hosts on the network.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.