T09 · Insecure Skill Coding Practices
Error
- Location
assets/template/index.html:5412- Finding
Guessable Pairing Codes Allow Unauthorized Cloud Data Access and Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
个人工作台搭建器
Security checks for vulnerabilities and agentic risk
Overview
The skill builds the promised workbench, but its optional cloud sync and import paths can expose or corrupt personal data if used as written.
Review before installing or using for real data. Keep cloud sync disabled unless the sync authorization model is fixed, avoid importing untrusted JSON backups, and do not store sensitive financial or personal records in the generated app until output escaping and CloudBase access rules are hardened.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
assets/template/index.html:3543- Finding
Persistent DOM XSS Through Imported and Cloud-Synchronized Data
- Content
View full analysis
{ if (r.id && r.photo) localPhotos.ootdPhotos[r.id] = r.photo; }); (store.wardrobe || []).forEach(w => { if (w.id && w.photo) localPhotos.wardrobePhotos[w.id] = w.photo; }); store = cloudData; if (localPhotos.avatarData && store.settings) { store.settings.avatarData = localPhotos.avatarData; } (store.ootdRecords || []).forEach(r => { if (localPhotos.ootdPhotos[r.id]) r.photo = localPhotos.ootdPhotos[r.id]; }); (store.wardrobe || []).forEach(w => { if (localPhotos.wardrobePhotos[w.id]) w.photo = localPhotos.wardrobePhotos[w.id]; }); } ``` Store fields are then interpolated into `innerHTML` without escaping: ```javascript container.innerHTML = top3.map((t, idx) => { const proj = getProject(t.projectId); const domain = proj ? proj.colorClass : ''; const domainName = proj ? proj.name : ''; const done = t.status === 'done'; const deadlineText = t.deadline ? formatDeadline(t.deadline) : 'No deadline'; return `- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
references/bugs-and-fixes.md:37- Finding
Unpinned Third-Party Packages Are Installed and Executed by Build Instructions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (45)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises an end-user skill that builds a personalized PWA workbench and deploys it to CloudStudio. The actual code chunk is infrastructure code: a CloudBase SDK adapter for WeChat Mini Programs plus stream/polyfill and JWT utility code. Its behavior centers on low-level networking, storage, websocket, captcha, and platform/runtime support. None of the visible code asks user questions, assembles dashboard modules, generates a single-page PWA, or deploys anything to CloudStudio. While SDK code could be a supporting dependency in a larger project, this chunk by itself materially differs from the declared primary purpose and exposes undeclared capabilities such as storage, websocket, and authentication-related processing.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description promises an end-user skill that gathers user requirements and phone model, generates a personalized PWA workbench, and deploys it. The provided code instead consists of generic Tencent CloudBase SDK internals and auth support. It includes request transport, endpoint selection, cache management, adapters for web/WX mini-program, OAuth access token retrieval/refresh, and related utility functions. There is no visible logic for asking 5–7 questions, generating task/calendar/accounting/project modules, building a single-page PWA, or deploying to CloudStudio. While CloudBase infrastructure could be a supporting dependency for such a product, this chunk by itself materially differs from the declared primary purpose and exposes undeclared capabilities around auth/network/storage.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The supplied code chunk does not implement a workbench builder, questionnaire flow, PWA generation, dashboard modules, or CloudStudio deployment. Instead, it is an authentication library (cloudbase-sdk auth component) handling login methods, tokens, sessions, user info, password operations, OTP/email/SMS verification, OAuth redirects, and provider identity management. This is a materially different primary purpose from the declared description, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents an end-user app generator for creating and deploying a personalized PWA workbench/dashboard. The actual code chunk does not generate UI dashboards, ask onboarding questions, create task/schedule/accounting/project modules, or deploy anything to CloudStudio. Instead, it is an authentication SDK focused on login, registration, verification codes, OAuth flows, captcha, credential storage, session handling, and user/profile/device management. These are materially different primary purposes and capabilities, so this is a clear mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The supplied code does not implement a questionnaire-driven PWA workbench generator or CloudStudio deployment flow. Instead, it is infrastructure code for a cloud SDK: initializing sessions, storing/refreshing tokens, making authenticated requests, handling retries, detecting runtime environments, decoding JWTs, encrypting payloads, and providing cache/event/request adapters. These are materially different capabilities from the declared end-user purpose. While such SDK code could be a supporting dependency inside a larger app, this chunk itself is not functionally aligned with the described skill behavior, so the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description promises an end-user feature for creating and deploying a personalized PWA workbench after asking several questions. The code shown does not implement questionnaire logic, UI generation, PWA creation, task/calendar/accounting modules, or CloudStudio deployment flows. Instead, it is infrastructure/library code from CloudBase JS SDK and cryptographic utilities, including RSA operations, request adapters, storage/cache, and database helpers. While such libraries could be supporting dependencies in a larger app, this specific chunk’s actual behavior is materially different from the declared primary purpose and exposes undeclared capabilities such as cryptography and generic network/database support. Therefore this code chunk does not accurately represent the stated skill behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is for an end-user app generator/workbench builder, but the supplied code does not implement questionnaire logic, PWA generation, UI construction, deployment flow, or personalized dashboard assembly. Instead, it is generic infrastructure/library code for CloudBase database access and BSON handling. While such SDK code could be a supporting dependency in a larger project, this chunk’s actual behavior is materially different from the declared primary purpose and exposes undeclared capabilities like database manipulation, query encoding, geospatial operations, and realtime watch support.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents an end-user skill that asks several questions and generates/deploys a personalized PWA dashboard. The actual supplied code does not implement questionnaire logic, UI generation, PWA creation, deployment, CloudStudio interaction, task/calendar/accounting/project modules, or trigger handling. Instead, it is infrastructure/library code from a BSON/cloudbase SDK focused on serializing and deserializing BSON/EJSON data types and binary buffers. While such a library could be a supporting dependency in a larger project, this chunk itself does not reflect the declared primary purpose and exposes materially different functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is for an end-user app generator/workbench builder that interviews the user and creates/deploys a personalized PWA. The actual code shown does not implement questionnaire flow, PWA generation, UI/dashboard creation, or CloudStudio deployment. Instead, it is infrastructure/library code from the CloudBase SDK that provides generic database access, query construction, aggregation, transactions, and serialization. These are materially different capabilities and indicate the code chunk does not match the declared primary purpose.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cp assets/template/index.html → {workspace}/deploy/index.html
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cp assets/template/index.html → {workspace}/deploy/index.html
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cp assets/template/index.html → {workspace}/deploy/index.html
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cp assets/template/index.html → {workspace}/deploy/index.html
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cp assets/template/index.html → {workspace}/deploy/index.html
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cp assets/template/index.html → {workspace}/deploy/index.html
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cp assets/template/index.html → {workspace}/deploy/index.html
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cp assets/template/cloudbase-sdk.js → {workspace}/deploy/cloudbase-sdk.js
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
js }, 107: function(e2) { e2.exports = require_jwt_decode_cjs(); }, 30: function(e2) { e2.exports = JSON.parse('{"name":"@cloudbase/app","version":"2.31.0","description":"cloudbase javascript sdk core","main":"dist/cjs/index.js","module":"dist/esm/index.js","exports":{".":{"node":{"import":"./dist/esm/index.node.js","require":"./dist/cjs/index.node.js"},"import":"./dist/esm/index.js","require":"./dist/cjs/index.js","default":"./dist/cjs/index.js"},"./package.json":"./package.json"},"scripts":{"tsc":"rm -rf dist/ && tsc -p tsconfig.esm.json && tsc -p tsconfig.json","lint":"eslint --fix \\"./src/**/*.ts\\"","build":"npm run lint && npm run tsc && npm run build:mp","build:mp":"webpack --config ./webpack/webpack.miniprogram.js","precommit":"npm run lint"},"publishConfig":{"access":"public"},"repository":{"type":"git","url":"https://github.com/TencentCloudBase/cloudbase-js-sdk"},"keywords":["cloudbase","tcb","javascript","web","sdk","serverless"],"author":"","license":"Apache-2.0","dependencies":{"@cloudbase/adapter-interface":"^0.7.1","@cloudbase/adapter-wx_mp":"^1.3.1","@cloudbase/types":"2.31.0","@cloudbase/utilities":"2.31.0"},"peerDependencies":{"@cloudbase/signature-nodejs":">=1.0.0","jsonwebtoken":">=8.0.0","ws":"^8.18.0"},"peerDependenciesMeta":{"@cloudbase/signature-nodejs":{"optional":true},"jsonwebtoken":{"optional":true},"ws":{"optional":true}},"gitHead":"859557576897d4778857c12fb8d7fe8ca1f3a052","private":true}'); } }, t = {}, n = (function n2(r) { var o = t[r]; if (void 0 !== o) return o.exports;
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <div class="app"> <!-- ========== TOAST ========== --> <div class="toast" id="toast"></div> <!-- ========== MAIN CONTENT ========== -->
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <div class="app"> <!-- ========== TOAST ========== --> <div class="toast" id="toast"></div> <!-- ========== MAIN CONTENT ========== -->
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <button class="install-banner-close" onclick="dismissInstallBanner()">✕</button> </div> <!-- 2. AI 今日简报 --> <div class="ai-card"> <div class="ai-card-header"> <div class="ai-card-title">✨ 今日简报</div>
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The migration guide states that all data is stored only in the local browser, while the code also supports cloud synchronization and remote storage via CloudBase. This is a materially misleading privacy statement that can cause users to make unsafe assumptions about where their personal data resides and how it is shared.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <button class="domain-tab" onclick="switchDomainTab(this,'teaching-tasks')">✅ 任务 (${activeTasks.length})</button> </div> <!-- 备课看板 --> <div class="domain-panel" id="teaching-lessons"> <div class="domain-stats-row"> <div class="domain-stat-badge">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </div> </div> <!-- 快速上传今日穿搭 --> <div class="ootd-upload-zone" id="ootdUploadZone"> <input type="file" id="ootdPhotoInput" accept="image/*" style="display:none;" onchange="uploadOOTDPhoto(event)"> <div class="upload-icon">📷</div>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html ` : `<div class="empty-state"><div class="empty-state-title">还没有穿搭记录</div><div class="empty-state-desc">上传你的第一张OOTD吧！</div></div>`} </div> <!-- 我的衣橱 --> <div class="domain-panel" id="ootd-wardrobe" style="display:none;"> <!-- 分类标签 --> <div class="wardrobe-categories" id="wardrobeCats">