Security audit

Catfee AgentFlow工作流

Security checks for vulnerabilities and agentic risk

Overview

This skill is a workflow integration, but it can automatically send requirement data and uploaded files to a hard-coded plaintext HTTP service with weak user control.

Review before installing. Use this only for workflows where sending project, requirement, task, and attachment data to the configured AgentFlow server is intended. Do not use it for confidential documents unless the endpoint is changed to authenticated HTTPS, uploads are destination-validated, and the agent asks for confirmation before syncing, deleting, or uploading files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/agentflow.py:24
Finding: Workflow Data and Session Identifiers Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/agentflow.py:253
Finding: Unrestricted Server-Controlled Upload URL Can Exfiltrate Local Files
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:188
Finding: Mandatory Automatic Synchronization Can Disclose Requirement Documents Without Explicit Consent
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (32)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.
md
使用 `scripts/agentflow.py` 调用工具（已封装好 SSE/POST 逻辑）：

Static analysis

No suspicious patterns detected.