T08 · Insecure Dependencies
Warning
- Location
SKILL.md:18- Finding
Unpinned Third-Party Package Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
pcloud-components-usage
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward guide for using a React component library, with ordinary supply-chain precautions needed for npm and CDN usage.
Install this only in a React project where you intend to use @pointcloud/pcloud-components. Pin package versions, keep a lockfile, review the npm package before use, and avoid copying the CDN example into production unless you add integrity checks or self-host reviewed assets. Expect much of the component documentation and UI sample text to be in Chinese.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:91- Finding
Third-Party CDN Scripts Loaded Without Subresource Integrity
- Content
View full analysis
``` ### Technical Analysis The UMD usage example loads executable JavaScript and CSS directly from a third-party CDN. Although the URLs contain fixed package versions and use HTTPS, the resources do not include Subresource Integrity hashes. The browser therefore verifies transport security but does not verify that the returned content matches a specific reviewed artifact. If the CDN, registry artifact, package publisher, or associated delivery infrastructure is compromised, modified JavaScript can be returned and executed within the consuming application's origin. No compromise of unpkg or the referenced packages was established during this audit; the finding concerns the absence of integrity enforcement. ### Attack Path 1. An attacker compromises the CDN, a package publication account, an upstream artifact, or another relevant delivery component. 2. The referenced resource is replaced or served with attacker-controlled JavaScript. 3. A user visits an application that incorporated the documented CDN example. 4. The browser downloads the resource without checking a cryptographic integrity hash. 5. The attacker-controlled script executes with the same browser-origin privileges as the application. ### Impact Assessment Successful exploitation could allow arbitrary client-side JavaScript execution in the consuming application's origin. The resulting access may include ...[truncated 332 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (102)
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md �� - ⌨️ 智能输入体验，支持输入过程自动聚焦到下一节 - ✅ 格式校验机制，自动校验和修正输入内容 - 🎨 样式兼容设计，完美匹配 antd input 框样式 - 🔧 表单友好集成，无缝支持表单嵌入和校验 - 🔄 IPv6 标准化输出，自动简化标准格式的 IPv6 地址 ## 基础用法 <code src="./demos/demo1.tsx" title="基础用法" description="通过`value`设置绑定值, type可选值为`IPv4`和`IPv6`"></code> ## 基础样式 <code src="./demos/demo2.tsx" title="三种大小" description="定义了三种尺寸（大、默认、小），完全对照antd的input输入框"></code> ## 分隔符 <code src="./demos/demo3.tsx" title="分隔符" description="通过`delimiter`设置分隔符,支持自定义react元素或者字符串"></code> ## 只读和禁用 <code src="./demos/demo4.tsx" title="只读和禁用" description="`readOnly`设置只读, `disabled`设置禁用,样式完全对标antd"></code> ## 标准化输
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md ## 标准化输出 <code src="./demos/demo5.tsx" title="IPv6标准化处理" description="`normalize`可以控制输出的IPv6地址是否进行简化;首选格式是RFC文档定义的规范全写形式,简化形式是采用了`最长零段压缩`和`前导零省略`的标准进行输出."></code> ## 自动聚焦
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file includes multiple user-facing strings and section content in Chinese, such as placeholder text, form labels, validation messages, and documentation instructions, while the rest of the skill is in English. Because the skill does not offer a language/locale choice or explain that it is intended specifically for Chinese-speaking users, it creates a locale-policy issue under the natural-language policy rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document's navigation and component description are written entirely in Chinese, including UI-facing titles such as
组件,数据展示, and the main heading. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language locale violation.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The entire skill documentation, including the title, description, and usage guidance, is presented only in Chinese, with no indication of language choice or locale opt-in. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ### CRUDProps | 参数 | 说明 | 类型 | 默认值 | | ---------------------- | ------------------------------------------------- | -------------------------------------------------------------------------------------------------- | --------------------------------------------- | | className | 自定义类名 | `string` | | | style | 自定义样式 | `React.CSSProperties` | `{}` |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ### CRUDProps | 参数 | 说明 | 类型 | 默认值 | | ---------------------- | ------------------------------------------------- | -------------------------------------------------------------------------------------------------- | --------------------------------------------- | | className | 自定义类名 | `string` | | | style | 自定义样式 | `React.CSSProperties` | `{}` |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 参数 | 说明 | 类型 | 默认值 | | ---------------------- | ------------------------------------------------- | -------------------------------------------------------------------------------------------------- | --------------------------------------------- | | className | 自定义类名 | `string` | | | style | 自定义样式 | `React.CSSProperties` | `{}` | | searchFormProps | 查询表单配置，支持`immediate`属性控制是否立即检索 | [DFormProps](../DForm/index.zh-CN.md/#dformprops) `& { immediate?: boolean }` | - | | tableProps | 表格配置 | [DTableProps](../DTable/index.zh-CN.md#DTableProps) | - |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 参数 | 说明 | 类型 | 默认值 | | ---------------------- | ------------------------------------------------- | -------------------------------------------------------------------------------------------------- | --------------------------------------------- | | className | 自定义类名 | `string` | | | style | 自定义样式 | `React.CSSProperties` | `{}` | | searchFormProps | 查询表单配置，支持`immediate`属性控制是否立即检索 | [DFormProps](../DForm/index.zh-CN.md/#dformprops) `& { immediate?: boolean }` | - | | tableProps | 表格配置 | [DTableProps](../DTable/index.zh-CN.md#DTableProps) | - |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 参数 | 说明 | 类型 | 默认值 | | ---------------------- | ------------------------------------------------- | -------------------------------------------------------------------------------------------------- | --------------------------------------------- | | className | 自定义类名 | `string` | | | style | 自定义样式 | `React.CSSProperties` | `{}` | | searchFormProps | 查询表单配置，支持`immediate`属性控制是否立即检索 | [DFormProps](../DForm/index.zh-CN.md/#dformprops) `& { immediate?: boolean }` | - | | tableProps | 表格配置 | [DTableProps](../DTable/index.zh-CN.md#DTableProps) | - |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 参数 | 说明 | 类型 | 默认值 | | ---------------------- | ------------------------------------------------- | -------------------------------------------------------------------------------------------------- | --------------------------------------------- | | className | 自定义类名 | `string` | | | style | 自定义样式 | `React.CSSProperties` | `{}` | | searchFormProps | 查询表单配置，支持`immediate`属性控制是否立即检索 | [DFormProps](../DForm/index.zh-CN.md/#dformprops) `& { immediate?: boolean }` | - | | tableProps | 表格配置 | [DTableProps](../DTable/index.zh-CN.md#DTableProps) | - |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 参数 | 说明 | 类型 | 默认值 | | ---------------------- | ------------------------------------------------- | -------------------------------------------------------------------------------------------------- | --------------------------------------------- | | className | 自定义类名 | `string` | | | style | 自定义样式 | `React.CSSProperties` | `{}` | | searchFormProps | 查询表单配置，支持`immediate`属性控制是否立即检索 | [DFormProps](../DForm/index.zh-CN.md/#dformprops) `& { immediate?: boolean }` | - | | tableProps | 表格配置 | [DTableProps](../DTable/index.zh-CN.md#DTableProps) | - |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 参数 | 说明 | 类型 | 默认值 | | ---------------------- | ------------------------------------------------- | -------------------------------------------------------------------------------------------------- | --------------------------------------------- | | className | 自定义类名 | `string` | | | style | 自定义样式 | `React.CSSProperties` | `{}` | | searchFormProps | 查询表单配置，支持`immediate`属性控制是否立即检索 | [DFormProps](../DForm/index.zh-CN.md/#dformprops) `& { immediate?: boolean }` | - | | tableProps | 表格配置 | [DTableProps](../DTable/index.zh-CN.md#DTableProps) | - |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ### Twitter 模式属性 | 参数名称 | 说明 | 类型 | 默认值 | | -------- | -------------------- | ------------------------------- | ---------------------------------------------------------------------------------------------------------------- | | width | 单个色块的宽度(px) | `string` | `276px` | | colors | 默认展示的颜色值集合 | `string[]` | `['#FF6900', '#FCB900', '#7BDCB5', '#00D084', '#8ED1FC', '#0693E3', '#ABB8C3', '#EB144C', '#F78DA7', '#9900EF']` |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 参数名称 | 说明 | 类型 | 默认值 | | -------- | -------------------- | ------------------------------- | ---------------------------------------------------------------------------------------------------------------- | | width | 单个色块的宽度(px) | `string` | `276px` | | colors | 默认展示的颜色值集合 | `string[]` | `['#FF6900', '#FCB900', '#7BDCB5', '#00D084', '#8ED1FC', '#0693E3', '#ABB8C3', '#EB144C', '#F78DA7', '#9900EF']` | | triangle | 小三角形位置 | `hide \| top-left \| top-right` | —— |
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
md ### Compact 模式属性 | 参数名称 | 说明 | 类型 | 默认值 | | -------- | -------------------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | colors | 默认展示的颜色值集合 | `string[]` | `['#4D4D4D', '#999999', '#FFFFFF', '#F44E3B', '#FE9200', '#FCDC00', '#DBDF00', '#A4DD00', '#68CCCA', '#73D8FF', '#AEA1FF', '#FDA1FF', '#333333', '#808080', '#cccccc', '#D33115', '#E27300', '#FCC400', '#808900', '#194D33', '#0C797D', '#0062B1', '#653294', '#AB149E']` |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ### Compact 模式属性 | 参数名称 | 说明 | 类型 | 默认值 | | -------- | -------------------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | colors | 默认展示的颜色值集合 | `string[]` | `['#4D4D4D', '#999999', '#FFFFFF', '#F44E3B', '#FE9200', '#FCDC00', '#DBDF00', '#A4DD00', '#68CCCA', '#73D8FF', '#AEA1FF', '#FDA1FF', '#333333', '#808080', '#cccccc', '#D33115', '#E27300', '#FCC400', '#808900', '#194D33', '#0C797D', '#0062B1', '#653294', '#AB149E']` |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ### Circle 模式属性 | 参数名称 | 说明 | 类型 | 默认值 | | ------------- | ------------------ | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | width | 单个色块的宽度(px) | `string` | `252px` | | colors | 单个色块的高度(px) | `string[]` | `["#f44336", "#e91e63", "#9c27b0", "#673ab7", "#3f51b5", "#2196f3", "#03a9f4", "#00bcd4", "#009688", "#4caf50", "#8bc34a", "#cddc39", "#ffeb3b", "#ffc107", "#ff9800", "#ff5722", "#795548", "#607d8b"]` |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 参数名称 | 说明 | 类型 | 默认值 | | ------------- | ------------------ | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | width | 单个色块的宽度(px) | `string` | `252px` | | colors | 单个色块的高度(px) | `string[]` | `["#f44336", "#e91e63", "#9c27b0", "#673ab7", "#3f51b5", "#2196f3", "#03a9f4", "#00bcd4", "#009688", "#4caf50", "#8bc34a", "#cddc39", "#ffeb3b", "#ffc107", "#ff9800", "#ff5722", "#795548", "#607d8b"]` | | circleSize | 圆圈大小 | `number` | 28 | | circleSpacing | 圆圈之间的间隔(px) | `number` | 14 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | ------------- | ------------------ | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | width | 单个色块的宽度(px) | `string` | `252px` | | colors | 单个色块的高度(px) | `string[]` | `["#f44336", "#e91e63", "#9c27b0", "#673ab7", "#3f51b5", "#2196f3", "#03a9f4", "#00bcd4", "#009688", "#4caf50", "#8bc34a", "#cddc39", "#ffeb3b", "#ffc107", "#ff9800", "#ff5722", "#795548", "#607d8b"]` | | circleSize | 圆圈大小 | `number` | 28 | | circleSpacing | 圆圈之间的间隔(px) | `number` | 14 | ### Block 模式属性
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | ------------- | ------------------ | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | width | 单个色块的宽度(px) | `string` | `252px` | | colors | 单个色块的高度(px) | `string[]` | `["#f44336", "#e91e63", "#9c27b0", "#673ab7", "#3f51b5", "#2196f3", "#03a9f4", "#00bcd4", "#009688", "#4caf50", "#8bc34a", "#cddc39", "#ffeb3b", "#ffc107", "#ff9800", "#ff5722", "#795548", "#607d8b"]` | | circleSize | 圆圈大小 | `number` | 28 | | circleSpacing | 圆圈之间的间隔(px) | `number` | 14 | ### Block 模式属性
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ## API | 参数 | 说明 | 类型 | 默认值 | 版本 | | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- | ------ | ---- | | options | antd 的 options 属性，可以是一个 options 数组，或一个返回等价 options 数组的 promise | `(value?,option?,options) => Promise<option[]>` | - | | | loadData | antd 的 loadData 属性，动态加载子级列表数据，默认使用 options 所提供的方法，如果传入 null，则表示不进行动态加载,该方法要求返回一个 options 数组或与其等价的 Promise | `(value?,option?,options) => Promise<option[]>` | - | |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 参数 | 说明 | 类型 | 默认值 | 版本 | | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- | ------ | ---- | | options | antd 的 options 属性，可以是一个 options 数组，或一个返回等价 options 数组的 promise | `(value?,option?,options) => Promise<option[]>` | - | | | loadData | antd 的 loadData 属性，动态加载子级列表数据，默认使用 options 所提供的方法，如果传入 null，则表示不进行动态加载,该方法要求返回一个 options 数组或与其等价的 Promise | `(value?,option?,options) => Promise<option[]>` | - | | | onLoadData | 等同 antd 的 loadData 属性,用于监听 antd loadData 事件 | `(value?,option?,options) => void` | - | | | loading | 是否显示加载中（传入数字表示延迟加载,单位毫秒，0 等同于 false） | `boolean \| number` | 600 | |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 参数 | 说明 | 类型 | 默认值 | 版本 | | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- | ------ | ---- | | options | antd 的 options 属性，可以是一个 options 数组，或一个返回等价 options 数组的 promise | `(value?,option?,options) => Promise<option[]>` | - | | | loadData | antd 的 loadData 属性，动态加载子级列表数据，默认使用 options 所提供的方法，如果传入 null，则表示不进行动态加载,该方法要求返回一个 options 数组或与其等价的 Promise | `(value?,option?,options) => Promise<option[]>` | - | | | onLoadData | 等同 antd 的 loadData 属性,用于监听 antd loadData 事件 | `(value?,option?,options) => void` | - | | | loading | 是否显示加载中（传入数字表示延迟加载,单位毫秒，0 等同于 false） | `boolean \| number` | 600 | |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- | ------ | ---- | | options | antd 的 options 属性，可以是一个 options 数组，或一个返回等价 options 数组的 promise | `(value?,option?,options) => Promise<option[]>` | - | | | loadData | antd 的 loadData 属性，动态加载子级列表数据，默认使用 options 所提供的方法，如果传入 null，则表示不进行动态加载,该方法要求返回一个 options 数组或与其等价的 Promise | `(value?,option?,options) => Promise<option[]>` | - | | | onLoadData | 等同 antd 的 loadData 属性,用于监听 antd loadData 事件 | `(value?,option?,options) => void` | - | | | loading | 是否显示加载中（传入数字表示延迟加载,单位毫秒，0 等同于 false） | `boolean \| number` | 600 | | 其他属性同 antd Cascader 组件，详见：https://4x-ant-design.antgroup.com/components/cascader-cn/#API