Noodle Create Writing

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:34 AM UTC
• Version: 1.0.0

Overview

This article-generation skill is coherent overall, but it needs Review because normal user input can reach unsafe shell execution and the generated posts can include unsupported giveaway claims.

Review this skill before installing. It should be fixed to call Tavily with an argument-array API instead of shell command strings, pin or verify the Tavily dependency and npm packages, make raw-data saving opt-in, and remove giveaway or health-effect claims unless explicitly authorized and reviewed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/search-content.js:149

Finding

Shell Command Injection Through User-Controlled Search Queries

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/search-content.js:149

Finding

Execution of an Unpinned External Skill Outside the Audited Project

Content

View full analysis

Remediation

View remediation

other

Error

• Location: scripts/format-article.js:389

Finding

Unconditional Fabricated Giveaway and Promotional Content in Generated Posts

Content

View full analysis

`${opt}. ${optionTexts[i]}`).join('\n'); return `🍜 投票：${question}\n\n${pollOptions}\n\n👉 转发+评论，抽3位送美食代金券！`; } ``` The formatter also contains hardcoded engagement prompts: ```js const ctas = [ '关注我，解锁更多美食攻略！👇', '点赞收藏，下次不迷路！❤️', '评论区告诉我你想看哪个城市的美食攻略！💬', '转发给爱吃面的朋友！👯‍♀️', '下期想看什么美食？留言告诉我！📝' ]; ``` ### Technical Analysis Every Weibo article produced through `formatWeiboArticle()` invokes `generateWeiboInteraction()`. That function unconditionally appends a claim that three users who repost and comment will receive food vouchers. The project has no campaign configuration, sponsor authorization, eligibility rules, prize inventory, fulfillment mechanism, or verification that a giveaway actually exists. The claim is therefore generated independently of the user's request and independently of any evidence that the promotion can be honored. Other formatters similarly add hardcoded requests to follow, like, save, comment, or privately message the publisher. Those engagement prompts are less severe than the giveaway claim, but they demonstrate that promotional language is automaticall ...[truncated 1497 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (29)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

### `scripts/search-content.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

### `scripts/format-article.js`

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/format-article.js (reported line 326)May include surrounding context.

js

'转发给朋友，一起打卡美食！👯‍♀️'
  ];
  
  return prompts[Math.floor(Math.random() * prompts.length)];
}

/**

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code builds a shell command string and interpolates user-influenced query text into it before passing it to execSync. Because the query is wrapped only in double quotes and not safely escaped for the shell, an attacker can inject shell metacharacters such as command substitution to execute arbitrary commands on the host running the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly describes automatic web searching and saving generated output to local files, but it does not disclose that user-provided topics/keywords may be transmitted to an external service (Tavily) or that content will be written to disk. This can create privacy, compliance, and data handling risks if users supply sensitive prompts or run the skill in environments where local writes are restricted or monitored.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The keyword list includes explicit therapeutic or medical-effect claims such as '补肾', '壮阳', '清热解毒', '止咳', '助眠', '抗衰老', '增强免疫力', and '控制血糖'. In a content-generation skill, these terms can cause the model to produce health advice or disease-related claims without evidence, disclaimers, or user opt-in, creating regulatory, trust, and safety risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The package description is entirely in Chinese and describes the skill as generating platform content in that locale, but there is no indication of user opt-in, language selection, or a documented region-specific justification in this file. This creates a natural-language locale policy concern because the skill appears tailored to a single language by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This JavaScript skill generates all user-facing content, comments, headings, and call-to-action strings in Chinese only, including titles, hashtags, and article bodies. The file does not offer any language selection or opt-in mechanism, which matches the policy category for forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The generic formatter emits authoritative-sounding source-count and relevance-score text even though this module only formats data and does not verify how those metrics were produced. If upstream data is missing, untrusted, or incorrect, the module still presents it as factual support, which can facilitate deceptive or unverifiable content generation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The formatter injects a giveaway claim ('抽3位送美食代金券') that is not derived from input data and may represent a fabricated promotion. This can mislead users, create compliance/legal issues, and cause the agent to publish commitments the operator cannot honor.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file's description, CLI option text, and runtime messages are all written in Chinese, with no indication that users can select another language. This creates a natural-language locale constraint that is not presented as optional or justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script writes raw search results and extracted data to disk by default, which can persist third-party content, metadata, and potentially sensitive information derived from searches. In a content-generation skill that automatically fetches external sources, silent retention increases privacy and data-handling risk, especially on shared systems or when operators do not realize debug-style artifacts are being saved.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes a skill for searching, summarizing, and generating social-media articles, which makes web access expected. However, importing child_process and later invoking a shell command introduces code-execution capability that is broader than the stated purpose and not obviously required for article generation itself.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code builds a shell command from the topic-derived query and executes it via execSync, causing user-provided content to be sent to the external Tavily search skill. While there is internal logging on failure, there is no user-facing disclosure, confirmation, or comment warning that search terms will be transmitted externally via subprocess execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest description and the rest of the skill documentation consistently assume Chinese-language use cases and Chinese social platforms, but they do not state that this is an optional locale choice. Under the language/locale policy, forcing or implicitly requiring a specific language without opt-in can be a policy concern unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The entire skill content is presented only in Chinese, with no indication that the user can choose another language or that the locale restriction is intentional. Under the policy, a fixed language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file presents all instructions and descriptive content exclusively in Chinese. Under the policy scope provided, forcing a specific language without offering the user a language or locale choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

Using caret ranges for runtime dependencies means builds may resolve to different package versions over time, which weakens supply-chain reproducibility and can unexpectedly introduce vulnerable or malicious releases. In a skill that performs web fetching and content generation, dependency compromise could affect network access, scraped content handling, or output generation.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json

"author": "飞云儿",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0",
    "marked": "^12.0.0",
    "yargs": "^17.7.0"

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Axios has multiple known advisories, and because the manifest uses a non-exact version, it is impossible to verify from this file alone whether the resolved package is affected. This matters more in this skill context because axios is likely used for outbound requests to search or fetch content, so vulnerable HTTP client behavior could enable SSRF, credential leakage, or response tampering depending on the affected version.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The cheerio dependency is specified with a caret range, allowing unreviewed minor/patch updates at install time. This creates supply-chain uncertainty and can expose the skill to newly introduced vulnerable code paths in HTML parsing or scraping logic.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0",
    "marked": "^12.0.0",
    "yargs": "^17.7.0"
  },

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The marked package is not pinned to an exact version, so installations may pull different releases over time. Because marked processes text/markdown-like content, an unexpected vulnerable release could enable denial of service or unsafe parsing behavior in downstream usage.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json

"dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0",
    "marked": "^12.0.0",
    "yargs": "^17.7.0"
  },
  "devDependencies": {

Unverifiable Dependency: marked has 13 known advisory(ies) (CVE-2021-21306 (Regular Expression Denial of Service (REDoS) in Marked); CVE-2022-21681 (Inefficient Regular Expression Complexity in marked); CVE-2026-41680 (Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Toke) +10 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

Marked has a history of advisories including denial-of-service issues, and the non-pinned manifest prevents verification that an installed version is safe. In a content-generation skill that may process externally sourced text or markdown, a vulnerable parser version can increase risk of resource exhaustion or unsafe rendering behavior.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

An unpinned yargs dependency reduces build determinism and increases exposure to supply-chain issues, even if the direct impact is usually limited to CLI parsing behavior. While lower risk than network-facing libraries, it still permits unnoticed version drift.

Content

Scanner excerpt · package.json (reported line 29)May include surrounding context.

json

"axios": "^1.6.0",
    "cheerio": "^1.0.0",
    "marked": "^12.0.0",
    "yargs": "^17.7.0"
  },
  "devDependencies": {
    "@types/node": "^20.0.0"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 32)May include surrounding context.

json

"yargs": "^17.7.0"
  },
  "devDependencies": {
    "@types/node": "^20.0.0"
  },
  "engines": {
    "node": ">=18.0.0"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This JavaScript file uses Chinese for module documentation and console output, including user-visible messages, but provides no indication that the skill is region-specific or that users can opt into another language. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/search-content.js:162