Security audit

Earthquake Monitor

Security checks for vulnerabilities and agentic risk

Overview

This earthquake alert skill mostly does what it says, but it makes misleading security and data-source claims that could expose webhook secrets or overstate alert reliability.

Review this skill before installing. Do not store token-bearing webhook URLs in its config unless you are comfortable with plaintext local storage, and treat its earthquake alerts as dependent on a third-party aggregator rather than direct verified government feeds. Network polling and local config writes are expected for this kind of skill, but the documentation should be corrected before sensitive use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: src/config.js:74
Finding: Plaintext Storage and Exposure of Webhook Credentials
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: src/cenc.js:12
Finding: Safety-Critical Earthquake Data Is Trusted from an Undisclosed Third-Party Aggregator
Content: View full analysis
0 && lastUpdate && (Date.now() - lastUpdate) < 60000) { return cachedData; } try { const { stdout } = await execPromise('curl -s --max-time 10 "https://api.wolfx.jp/cenc_eqlist.json"'); const json = JSON.parse(stdout); const data = []; for (let i = 1; i <= 50; i++) { const key = 'No' + i; if (json[key]) data.push(json[key]); } if (data.length > 0) { cachedData = data; lastUpdate = Date.now(); return cachedData; } } catch (e) { console.error('[CENC] Error:', e.message); } return cachedData; } ``` `src/cwa.js`: ```javascript async function getCWAData() { // 30秒缓存 if (cachedWarning && lastUpdate && (Date.now() - lastUpdate) < 30000) { return cachedWarning; } try { const { stdout } = await execPromise('curl -s --max-time 10 "https://api.wolfx.jp/cwa_eew.json"'); // 检查是否返回 HTML（被 Cloudflare 拦截） if (!stdout || stdout.trim().startsWith('<')) { console.log('[CWA] API temporarily unavailable'); return cachedWarning; } const data = JSON.parse(stdout); if (data && data.ID) { cachedWarning = data; lastUpdate = Date.now(); return cachedWarning; } } catch (e) { console.log('[CWA] Error:', e.message); } return cachedWarning; } ``` `src/jma.js`: ```javascript async function getJMAData() { // 1分钟缓存 if (cachedData.length > 0 && lastUpdate && (Date.now() - lastUpdate) < 60000) { return cachedData; } try { const { stdout } = await execPromise('curl -s --max-time 10 "https://api.wolfx.jp/jma_eqlist.json"'); const json = JSON.parse(stdout ...[truncated 2712 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation is internally inconsistent: the changelog says encryption for webhook storage was removed, while the Security section still claims webhook URLs are AES-256-CBC encrypted at rest. This can mislead users into storing sensitive webhook secrets under false assumptions, causing credential exposure if configs are plaintext or otherwise recoverable.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises shell-capable behavior via required binaries like curl but does not declare any explicit tool scope or permissions boundary. This weakens reviewability and can lead users or hosts to grant broader execution/network capabilities than expected, increasing the risk of misuse or unnoticed command execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill exposes a configurable webhook feature but does not prominently warn that earthquake data and alert content will be transmitted to an external endpoint controlled by the user. Without clear disclosure, users may unintentionally send sensitive operational context or tokens to third-party services, especially since webhook URLs themselves often embed secrets.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This config sets the language to "en" explicitly, which can constitute a language/locale policy violation when there is no visible opt-in, alternative choice, or documented justification. In a region-specific context centered on a Chinese location, forcing English may conflict with expected user locale behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill's stated purpose is real-time earthquake monitoring, which justifies network access to fetch feeds, but not spawning shell commands. Using child_process.exec with curl introduces an execution capability broader than necessary for this monitoring function.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The configuration sets language: 'zh' as the default, which imposes a specific language choice before the user has selected a preference. The policy allows locale constraints only when users are given a choice or when the restriction is clearly justified, neither of which is present here.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill's purpose is real-time earthquake monitoring, which justifies outbound network access, but not spawning a shell to run curl. Invoking child_process adds an unnecessary execution capability that is broader than needed for retrieving remote JSON and is not justified by the manifest description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module auto-detects output language solely from the data source and falls back to 'zh' for unknown sources. This can force a specific language/locale on users without offering a choice, which matches the policy's language/locale violation criteria.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill's stated purpose is real-time earthquake monitoring using external data feeds, which justifies network access, but spawning a subprocess to run curl is not an obvious or necessary capability for that purpose. Using child_process expands the skill's effective capability beyond straightforward data retrieval and introduces command-execution behavior unrelated to the manifest's described monitoring role.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · src/cenc.js (reported line 19)May include surrounding context.
js
} try { const { stdout } = await execPromise('curl -s --max-time 10 "https://api.wolfx.jp/jma_eqlist.json"'); const json = JSON.parse(stdout); const data = [];

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · src/cwa.js (reported line 19)May include surrounding context.
js
} try { const { stdout } = await execPromise('curl -s --max-time 10 "https://api.wolfx.jp/jma_eqlist.json"'); const json = JSON.parse(stdout); const data = [];

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · src/jma.js (reported line 19)May include surrounding context.
js
} try { const { stdout } = await execPromise('curl -s --max-time 10 "https://api.wolfx.jp/jma_eqlist.json"'); const json = JSON.parse(stdout); const data = [];

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code hard-codes zh as the fallback language when no user language is configured. This creates a locale policy issue because the skill defaults to a specific language rather than offering a user choice or requiring explicit opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The start(options) section states that the skill performs proactive monitoring with auto-alerts every 60 seconds, which indicates recurring polling and possible downstream notifications. The markdown does not explicitly warn users that enabling this behavior may generate continuous network requests and automated alerts until stopped.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The initialization API documents a default language of 'zh' and the user-facing initialization message presents that language setting as the default behavior. This can violate language/locale policy expectations when a skill selects a specific language without first asking the user or clearly making it opt-in.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency uses a caret range (^8.19.0) rather than an exact pinned version, which makes builds non-reproducible and can cause different installations to resolve to different ws releases over time. In a network-facing skill that relies on WebSocket handling, this increases supply-chain and patch-state uncertainty, though by itself it is not direct code execution.
Content: Scanner excerpt · package.json (reported line 26)May include surrounding context.
json
}, "readme": "SKILL.md", "dependencies": { "ws": "^8.19.0" } }

Unverifiable Dependency: ws has 7 known advisory(ies) (CVE-2016-10518 (Remote Memory Disclosure in ws); CVE-2024-37890 (ws affected by a DoS when handling a request with many HTTP headers); CVE-2026-45736 (ws: Uninitialized memory disclosure) +4 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: The manifest references ws without pinning an exact version, and ws has a history of security advisories including denial-of-service and memory disclosure issues. Because the exact resolved version is not fixed here, it is impossible to verify from this file alone whether deployments will avoid affected releases, which is risky for a real-time earthquake monitoring skill likely to maintain network connections and process remote data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The module persists configuration data to disk via fs.writeFileSync, which affects user/system data, but the only surrounding messaging is an internal error log on failure. There is no confirmation prompt, user-facing notice, or explanatory comment/docstring warning that configuration changes will be written to config.json.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file contains natural-language text in a single language ('距离计算 - Haversine 公式') with no indication that the skill offers a language choice or is intentionally limited to a Chinese-speaking context. The policy requires flagging language or locale constraints when they are forced without user opt-in or clear justification.
Content: No source excerpt is available for this finding.