Security audit
Security checks for vulnerabilities and agentic risk
This skill creates interactive explanations, but untrusted project settings can run code or expose secrets, and its file-access limits are bypassable.
Use only in trusted projects or a sandbox without unrelated credentials. Review user and project configuration before running the CLI; local routing stops normal classifier traffic but does not disable plugins. For private material, check embedded files before sharing and avoid agent-wide hooks until file boundaries, temporary-file handling, and log privacy are improved.
scripts/core/engine.mjsRepository configuration executes plugins before command dispatch
A crafted repository can execute arbitrary code when the user performs an apparently informational or document-checking operation, enabling access to host-readable secrets and modification of user-accessible files.
scripts/routers/systemone.mjsRepository adapter definitions can send host environment secrets to an attacker-selected endpoint
An attacker can receive a populated environment secret, including credentials unrelated to the routing service, and the routed answer content.
scripts/forms/code.mjsCode-file embedding escapes its intended current-directory boundary
Outside-project file contents can be incorporated into HTML, Markdown, or JSON artifacts and disclosed when those artifacts are delivered or shared. Ordinary parent traversal to an unrelated path is rejected; the finding is specifically the prefix and symlink bypasses.
The engine automatically reads .call-pele-answer.json from the working directory and imports its configured plugins without approval or a workspace trust check; importing a JavaScript module executes its top-level code before registration. An attacker-controlled project can therefore execute code with the agent's filesystem, credential, and network permissions when the engine starts. This is particularly dangerous for a rendering skill that may be invoked routinely inside unfamiliar repositories, although the plugin mechanism itself appears legitimate rather than intentionally malicious.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
<s;c++){let l=e.charCodeAt(c);if(l===58)a=!0;else if(l===35){if(a){i=c;break}}else Ye(l)&&(a=!1)}if(i!==-1){let c=e.lastIndexOf(";",s-1);c>i&&(r+=e.slice(o,c),o=c+1)}n=s>=e.length?-1:e.indexOf(t,s+1)}return o===0?e:r+e.slice(o)}function nh(e){return e.includes("#")?th(th(e,"style"),"classDef").replace(WS,t=>{let n=t.substring(1,t.length-1);return(US.test(n)?"fl°°":"fl°")+n+"¶ß"}):e}var rh="7q7q9vfgfgopij5b9999atg87q997q7qfgfgfgfgfgfgfgfgfgfg7q7qg8g8g8fgs7ijijk2k2ijgzlmk27qdwijfgn5k2lmijlmk2ijgzk2ijq8ijijgz7q7q7qd1fg99fgfgdwfgfg7qfgfg6666dw66n5fgfgfgfg99dw7qfgdwk2dwdwdw9a789ag8",sh="7q99d6fgfgopk26m9999atg87q997q7qfgfgfgfgfgfgfgfgfgfg9999g8g8g8gzr3k2k2k2k2ijgzlmk27qfgk2gzn5k2lmijlmk2ijgzk2ijq8ijijgz997q99g8fg99fggzfggzfg99gzgz7q7qfg7qopgzgzgzgzatfg99gzfglmfgfgdwat7satg8";var ah=1.2;function ih(e){let t=new Uint16Array(95);for(let n=0;n<95;n++)t[n]=parseInt(e.substr(n*2,2),36);return t}var GS,YS;function HS(e){return e>=4352&&e<=4447||e>=11904&&e<=42191||e>=44032&&e<=55203||e>=637
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
(e){return(e&1?hh:"")+(e&2?mh:"")+(e&4?gh:"")+(e&32?N1:"")+(e&8?I1:e&16?k1:"")}function Mr(e){let t=7,n=!1;for(let r of e.lines)for(let o of r)o.icon!==void 0||o.text===""||(t&=o.style,n=!0);return n?t:0}function Vn(e,t){return e+(t&1&&!e.includes(' font-weight="')?hh:"")+(t&2&&!e.includes(' font-style="')?mh:"")+(t&4&&!e.includes(' font-family="')?gh:"")}var Ji="about:blank",L1=/^([^\w]*)(javascript|data|vbscript)/im,bh=/&#(\w+)(^\w|;)?/g,yh=/&(newline|tab);/gi,wd=/[\u0000-\u001F\u007F-\u009F -]/gim,$1=/^.+(:|:)/gim,Eh=/(\\|%5[cC])((%(6[eE]|72|74))|[nrt])/g;function Ah(e){try{return decodeURIComponent(e)}catch{return e}}function jn(e){if(!e)return Ji;let t=Ah(e.trim()),n,r=0;do{if(++r>32)return Ji;t=t.replace(wd,"").replace(bh,(c,l)=>String.fromCharCode(l)).replace(yh,"").replace(wd,"").replace(Eh,"").trim(),t=Ah(t),n=t.match(wd)||t.match(bh)||t.match(yh)||t.match(Eh)}while(n&&n.length>0);if(!t)return Ji;if(t[0]==="."||t[0]==="/")return t;let o=t.trimStart(),s=o.match($1);if(!
The skill requests shell execution, environment-variable access, local file reads, and third-party network routing without declaring a tool scope. These capabilities have legitimate rendering uses, but unrestricted execution could expose files or send confidential answer content to external classifiers, particularly because the default router uses remote services. The privacy warning and local-only option reduce risk but are advisory rather than enforced boundaries; actual exposure depends on the host's permission controls.
The manifest describes content routing and Markdown-to-HTML rendering, for which CLI phase statistics are a reasonable implementation detail. However, this command also reads agent-wide event logs, retains tool command strings without restricting them to this skill (L28–L36), and prints the slowest commands or includes them in JSON output (L68–L76). Profiling and displaying unrelated agent activity is not justified by the stated rendering purpose.
The startsWith(root) check tests a string prefix, not directory containment: for cwd /work/project, src ../project-secrets/token resolves outside cwd but passes the check. Symlinks inside cwd can also point outside it because resolve() does not resolve symlinks, allowing readable external files to be copied into generated output. This is particularly relevant for a skill that consumes generated Markdown and embeds source files in shareable HTML or Markdown; HTML escaping prevents markup injection here but does not prevent disclosure of credentials or other private files.
When registered as an agent hook, this script persistently records tool activity, including up to 160 characters of commands, file paths, URLs, or search patterns, even when unrelated to answer formatting; the pe field labels matching activity but does not restrict collection. These values can contain credentials, private paths, or sensitive query content, creating an additional local disclosure surface without explicit restrictive file permissions or retention controls. The timing/debugging purpose appears legitimate, and no network exfiltration is shown, but agent-wide collection exceeds the formatting skill's stated scope.
The validation-error branch runs before the checkOnly guard, so invalid stdin submitted to the documented write-free check command is persisted to disk. Drafts may contain confidential answer content, and these temporary files have no cleanup and rely on default filesystem permissions, potentially exposing them to other local users depending on the environment. Saving a recovery copy is understandable for rendering failures, but doing so during lint-only checks violates the caller's no-write expectation.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// Built-in adapters. Users add their own in config: { "adapters": [{ "name": "my-proxy", "kind": "native",
// "url": "https://…/v1/systemone", "keyEnv": ["MY_KEY"] }] }
export const BUILTIN_ADAPTERS = [
nativeAdapter({ name: 'typesafe', url: 'https://api.typesafe.ai/v1/systemone', keyEnv: ['TYPESAFE_API_KEY'], describe: 'TypeSafe 直连 System One（需 TYPESAFE_API_KEY）' }),
nativeAdapter({ name: 'classifier-systemone', url: 'https://classifier.dev/v1/systemone', keyEnv: ['CLASSIFIER_API_KEY', 'CLASSIFY_API_KEY'], anonymousKey: 'unused', keyedConcurrency: 4, describe: 'classifier.dev 转发的 System One（无 key 用 IP 免费额度，4 并发）' }),
shimAdapter({ name: 'classifier', url: 'https://classifier.dev/v1/classify', keyEnv: ['CLASSIFIER_API_KEY', 'CLASSIFY_API_KEY'], describe: 'classifier.dev 批量分类，按问题批量模拟 System One（无 key 可用）' }),
];
The HTML renderer hardcodes Chinese accessibility labels, and the Markdown renderer always generates Chinese step headings. These outputs do not follow a user-selected language, and the file provides no locale option or documented justification for this restriction.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
Detected: suspicious.env_credential_access