我的大明朝廷

• Outcome: Review
• Latest audit: May 28, 2026 · 1:25 PM UTC
• Version: 1.0.2

Overview

The skill mostly matches its task-management and ComfyUI-execution purpose, but it needs review because external execution and local persistence are under-scoped and one download path can write files outside the intended task folder.

Install only after review. Use a trusted ComfyUI endpoint, do not run the scheduler unattended until task approval and filename containment are fixed, replace the bundled sexualized workflow prompt with neutral defaults, and treat the active_tasks and logs directories as sensitive local data that may need retention limits and access controls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

output_path = self.task_dir / filename
                            if use_curl:
                                curl_cmd = ["curl", "-s", "-o", str(output_path), image_url]
                                subprocess.run(curl_cmd, timeout=30)
                            else:
                                img_resp = requests.get(image_url, timeout=30)
                                img_resp.raise_for_status()

• Confidence: 82% confidence
• Finding: The code downloads a server-supplied filename to self.task_dir / filename without sanitizing the filename. If the remote ComfyUI server or its response is compromised, a filename containing path traversal sequences could cause files to be written outside the intended task directory, turning this subprocess-assisted download into an arbitrary file write primitive.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The workflow contains a hardcoded prompt describing a 'very sexy' approximately 20-year-old woman and directing the model to showcase her body. Embedding sexualized young-person content generation as a default capability, without any documented legitimate safety-bounded purpose, increases the risk of producing exploitative or policy-violating outputs and normalizes misuse directly in the shipped skill.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The sixth coordination step is intended to invoke 礼部, but the implementation calls 吏部 again. This creates a logic flaw where an expected review/check is silently skipped, so downstream decisions may proceed without the intended validation and with misleading logs showing that 礼部 ran.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide includes an example that transmits full patrol reports to an external service, but it does not warn users that reports may contain sensitive operational and security data. In this skill's context, patrol reports and alerts can include system status, failures, and security events, so copying this example could unintentionally exfiltrate sensitive information to third parties.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation explicitly promotes persistent task archives, token ledgers, execution statistics, and audit logs stored on the filesystem, but does not warn users that operational data will be retained locally. In a skill context, this can lead to unintentional storage of prompts, task metadata, usage records, or other sensitive information, increasing privacy and data-handling risk if users assume the skill is ephemeral.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill advertises real-time monitoring, anomaly detection, complete operation tracing, and historical audit queries without disclosing the privacy implications of such monitoring. Even if intended for observability, these features can capture user behavior and detailed operational history, which becomes risky when the scope of collection, retention, and access controls are not explained.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The code scans all task directories and automatically executes eligible tasks on an external agent, while also mutating task and execution records, without an explicit authorization or confirmation gate in this path. In a skill that can trigger external compute and spend resources, this increases the risk of unintended task execution, unauthorized resource consumption, and state changes triggered by merely placing or modifying task files in the watched directory.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill persistently stores execution history, parameters, prompt content, output file paths, and downloaded artifacts to disk under task directories with no consent, minimization, or protection controls shown. In this context, prompts and generated images may contain sensitive user data, so silent local retention increases privacy and data-exposure risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 添加外部监控回调
def external_monitor_callback(report):
    """发送巡查报告到外部监控系统"""
    response = requests.post(
        "https://external-monitor.com/api/reports",
        json=report,
        timeout=10

• Confidence: 97% confidence
• Finding: This duplicate finding points to the same outbound transmission behavior: a patrol report is posted to a remote endpoint without any indication of data classification, consent, or restrictions. In a monitoring/security skill, exported reports may expose internal system structure, active alerts, or other sensitive details that increase reconnaissance value for an attacker or third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 添加外部监控回调
def external_monitor_callback(report):
    """发送巡查报告到外部监控系统"""
    response = requests.post(
        "https://external-monitor.com/api/reports",
        json=report,
        timeout=10

• Confidence: 97% confidence
• Finding: This duplicate finding points to the same outbound transmission behavior: a patrol report is posted to a remote endpoint without any indication of data classification, consent, or restrictions. In a monitoring/security skill, exported reports may expose internal system structure, active alerts, or other sensitive details that increase reconnaissance value for an attacker or third party.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
python-dotenv>=1.0.0

• Confidence: 97% confidence
• Finding: The dependency is specified with a lower bound only, which allows future unreviewed versions to be installed and makes builds non-reproducible. This increases supply-chain risk and can also unintentionally permit installation of versions affected by known advisories depending on resolver behavior and environment state.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
python-dotenv>=1.0.0

• Confidence: 96% confidence
• Finding: Using an unpinned version for python-dotenv makes installations non-deterministic and exposes the project to supply-chain and regression risk from future releases. Although this package is typically lower risk than network-facing libraries, the version policy still weakens security assurance.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The file permits installation of requests without constraining it to a version range that excludes known vulnerable releases, and multiple advisories exist for this package including credential leakage and TLS/session verification issues. In a skill environment, requests is commonly used for outbound HTTP, so a vulnerable version could expose secrets or weaken transport security if the runtime resolves to an affected release.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: The dependency allows installation of python-dotenv versions that may include an advisory involving symlink-following during set_key, which can lead to arbitrary file overwrite in specific usage patterns. This is less broadly exploitable than the requests issue because exploitation depends on the code calling vulnerable functionality on attacker-influenced paths, but the unsafe version allowance is still a real risk.

Static analysis

No suspicious patterns detected.