Security audit

form-builder

Security checks for vulnerabilities and agentic risk

Overview

The skill is a form builder, but it publishes PostgreSQL credentials and describes writing new records to a RoadFlow database without clear safeguards.

Review carefully before installing. Do not use this package with the published database credentials; treat that password as compromised and rotate it. Use only dedicated least-privilege credentials from a secret manager or environment variables, and require a dry-run plus explicit confirmation before any rf_form database writes.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:78
Finding: Plaintext PostgreSQL Administrator Credentials Exposed in Skill Documentation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/html_form_generator.js:55
Finding: HTML Injection and Cross-Site Scripting in Generated Forms
Content: View full analysis
`${opt}`).join(''); ``` Radio-option values and labels are handled in the same way: ```javascript fieldHtml = field.options.map((opt, idx) => `
${opt}
` ).join(''); ``` Input properties are also interpolated directly into attribute contexts: ```javascript fieldHtml = ``; ``` The form title, container class, and field labels are inserted into the final document without contextual encoding: ```javascript let html = `\n\n\n \n \n ${formTitle || '表单'}\n \n \n \n .need ...[truncated 3437 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill embeds live PostgreSQL connection details, including host, port, username, and password, directly in documentation. Hardcoded credentials expose unauthorized access to the roadflow database and can enable data theft, tampering, or destructive writes, especially because the skill explicitly supports reading and saving forms to persistent storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Publishing database credentials and internal connection details without any security boundary or warning materially increases the likelihood of compromise. Because the same section identifies the specific target database and the skill’s ability to modify rf_form records, an attacker or misused agent has everything needed to connect and alter sensitive application data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill describes a workflow that queries existing database records, copies form definitions, modifies them, and saves new records without any approval, confirmation, or warning about persistent side effects. In an agent setting, this can lead to unauthorized or accidental writes to production data, cloning of sensitive form contents, and integrity issues in the rf_form table.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The markdown states that filled form data may be stored in sessionStorage/localStorage, which can retain user-entered information on the client device. There is no warning about privacy implications, sensitive data handling, or advising when not to use browser storage.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The help text states --framework Bootstrap|Tailwind, implying users can choose between two output frameworks. However, all generation paths call generateBootstrapForm and there is no Tailwind-specific renderer or framework selection logic anywhere in the file, so the documentation materially overstates the implemented behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s descriptive text and generated validation messages are written in Chinese, and the phone validation is also tailored to a China-specific locale. Because the skill does not offer any user opt-in or language/locale selection, it enforces a specific language/locale by default, which matches the natural-language policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The manifest includes author-identifying text entirely in Chinese characters, which is a natural-language locale signal in a user-facing metadata field. Because there is no indication elsewhere in the file that language choice is optional or user-selectable, this can conflict with the policy against forcing a specific language or locale without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The generated document always uses <html lang="en"> even though the tool’s surrounding help text and comments are in Chinese and there is no option for users to choose or override the locale. This is a natural-language locale policy issue because it forces a specific language setting without opt-in or documented justification.
Content: No source excerpt is available for this finding.