Security audit

Sea Route Navigation

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and map-focused, but it has a real generated-HTML injection risk and uses unpinned runtime dependencies.

Install only if you are comfortable running Python code that fetches dependencies at runtime. Use trusted port names, avoid labels supplied by other people, choose a non-sensitive output folder, and review or patch the script to HTML-escape route labels before opening or sharing generated maps.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/sea_route.py:20
Finding: Persistent HTML Injection Through Unsanitized Port Names
Content: View full analysis
{args.origin_name}
lon {args.origin_lon}°
lat {args.origin_lat}°", max_width=200, ), icon=folium.Icon(color="green", icon="anchor", prefix="fa"), tooltip=f"起点：{args.origin_name}", ).add_to(m) folium.Marker( [args.dest_lat, args.dest_lon], popup=folium.Popup( f"{args.dest_name}
lon {args.dest_lon}°
lat {args.dest_lat}°", max_width=200, ), icon=folium.Icon(color="red", icon="anchor", prefix="fa"), tooltip=f"终点：{args.dest_name}", ).add_to(m) info_html = f"""
Remediation: View remediation
{origin_name_html}
" f"lon {args.origin_lon}°
lat {args.origin_lat}°", max_width=200, ) ``` 3. Prefer text-only Folium APIs where available rather than constructing raw HTML. 4. Preserve the original unescaped strings only for non-HTML outputs such as JSON. 5. Consider validating display names with a reasonable length limit and rejecting control characters. Validation should supplement, not replace, output encoding. 6. Add tests using names containing characters such as `<`, `>`, `"`, `'`, and script-capable markup, then verify that the generated document contains encoded text rather than executable elements. 7. If rich formatting must be supported, sanitize input with a strict allowlist-based HTML sanitizer and prohibit scripts, event-handler attributes, dangerous URL schemes, and active embedded content. ]]>

T08 · Insecure Dependencies

Warning

Location: scripts/sea_route.py:1
Finding: Unpinned Runtime Dependencies Create a Supply-Chain Execution Risk
Content: View full analysis
=3.9" # dependencies = [ # "searoute>=1.5.0", # "folium>=0.18.0", # ] # /// ``` The documented execution method resolves these dependencies through `uv` when the script is run: ```bash uv run --script /path/to/skills/sea-route/scripts/sea_route.py \ --origin-lon --origin-lat \ --dest-lon --dest-lat \ --origin-name "Port A" --dest-name "Port B" \ --output ./sea_route_map.html ``` ### Technical Analysis Both dependencies use lower-bound constraints rather than exact reviewed versions. The project contains no recorded lockfile, package hashes, or explicit trusted package-index configuration. As a result, the code executed by the skill can change independently of the audited project. A later package release satisfying the version constraint may be selected when `uv` resolves the inline dependencies. Installation and import of a malicious or compromised release could execute code with the same privileges as the skill process. This is a supply-chain weakness rather than evidence that the currently named packages are malicious. The risk arises because runtime behavior is not reproducibly bound to reviewed dependency artifacts. ### Attack Path 1. A dependency publisher account, package-index account, distribution artifact, or configured package source is compromised, or an unsafe future compatible release is published. 2. The malicious release still satisfies `searoute>=1.5.0` or `folium>=0.18.0`. 3. An operator follows the documented `uv run --script` command. 4. `uv` resolves and retrieves the compromised compatible package because no exact version, lockfile, or hash restricts artifact ...[truncated 976 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script hard-codes Chinese text in tooltips and map overlay content such as "起点", "终点", "航线距离", and "预估时间". This imposes a specific language on all users without any opt-in, selection mechanism, or documented region-specific constraint, which matches the locale-policy violation criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly instructs generating and saving an HTML file to disk, but it does not tell the agent to obtain user consent or clearly warn that a filesystem write will occur. While this is expected for a map-generation skill, silent file creation can still surprise users, overwrite existing files, or leave artifacts in sensitive working directories.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill recommends launching the generated HTML file with platform open commands, but it does not require an explicit user confirmation immediately before doing so or warn that this will invoke a local application/browser. Opening files automatically can trigger unintended application launches and creates an unnecessary trust boundary crossing from content generation to execution/opening.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.