大藏经学术引用生成器

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:19 AM UTC
• Version: 1.3.0

Overview

The skill is mostly a disclosed citation helper, but its optional locator asks users to provide a full browser session cookie and may read it from a plaintext file in the skill directory.

Review before installing if you might use the optional 中华大藏经定位.py workflow. Prefer FO_COOKIE only for the current shell session, do not store fo_cookie.txt in the skill directory, and avoid sharing or committing the folder after placing any cookie there. The main CBETA citation scripts appear purpose-aligned, but they do make network requests and optional clipboard writes when requested.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: 中华大藏经定位.py:28

Finding

Plaintext Storage of an Authenticated Session Cookie

Content

View full analysis

Vulnerability Details

File Location: 中华大藏经定位.py, lines 28-35 and 145-150
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

python

def 取Cookie():
    env = os.environ.get("FO_COOKIE", "").strip()
    if env:
        return env
    p = os.path.join(os.path.dirname(os.path.abspath(__file__)), "fo_cookie.txt")
    if os.path.exists(p):
        return open(p, encoding="utf-8").read().strip()
    return ""

The script also explicitly recommends the insecure fallback:

python

print("   1) 浏览器 F12 → Application → Cookies → 复制 fo.ancientbooks.cn 的 Cookie 整串；")
print("   2) 设环境变量：  set FO_COOKIE=粘贴的Cookie   （或写入本目录 fo_cookie.txt）")

Technical Analysis

The optional authenticated locator accepts the user's complete fo.ancientbooks.cn session cookie from fo_cookie.txt, a plaintext file stored in the Skill directory. The implementation neither checks nor enforces owner-only file permissions and provides no integration with a protected operating-system credential store.

Session cookies are bearer credentials: possession may be sufficient to act as the authenticated user. Storing one beside source files increases the likelihood that it will be accidentally committed to source control, included in an archive, synchronized to shared storage, captured by a backup, or read by another local account or process.

The reviewed code transmits the cookie only to the declared HTTPS host and contains no evidence of intentional credential exfiltration. The vulnerability is the insecure local storage option, not malicious transmission.

Attack Path

1. A user follows the script's instructions and copies their complete authenticated cookie into fo_cookie.txt.
2. The project directory is committed, archived, synchronized, backed up, shared, or accessed by another local process or user.
3. An attacker obtains the plaintext cookie from the exposed file.
4. The attacke ...[truncated 712 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the project-local fo_cookie.txt fallback and accept the credential only through a process-scoped secret mechanism or operating-system credential store.
2. If file-based input must remain supported:
   • Require an explicit path outside the project directory.
   • Reject files with permissions broader than owner read/write.
   • Document the file as a sensitive bearer credential.
   • Add fo_cookie.txt to source-control and packaging ignore rules.
   • Refuse symbolic links and verify file ownership before reading.
3. Prefer a narrowly scoped API token over a complete browser cookie if the service supports one.
4. Avoid asking users to copy an entire browser cookie string when only a particular session value is required.
5. Ensure credentials never appear in logs, errors, command output, generated reports, or subprocess argument lists.
6. Advise users to revoke the session immediately if the file may have been exposed.
7. Consider disabling the optional authenticated integration by default and requiring explicit user consent before credential use.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill exposes additional operational behaviors beyond its headline description, including clipboard copying, network access to CBETA, and expanded output modes. While not inherently malicious, hidden or insufficiently surfaced side effects reduce informed consent and can lead to accidental data movement or unexpected external requests in otherwise low-risk citation workflows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill exposes additional operational behaviors beyond its headline description, including clipboard copying, network access to CBETA, and expanded output modes. While not inherently malicious, hidden or insufficiently surfaced side effects reduce informed consent and can lead to accidental data movement or unexpected external requests in otherwise low-risk citation workflows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill exposes additional operational behaviors beyond its headline description, including clipboard copying, network access to CBETA, and expanded output modes. While not inherently malicious, hidden or insufficiently surfaced side effects reduce informed consent and can lead to accidental data movement or unexpected external requests in otherwise low-risk citation workflows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

该技能的 stated purpose 是生成大藏经学术引用和出处反查；即使需要联网取数，直接启用子进程执行系统命令也不是这一用途的自然必要能力。引入 subprocess 使技能具备额外的命令执行面，超出了引用生成场景所需的最小能力边界。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill advertises executable scripts, network access, environment-variable input, shell usage, and file output, but does not declare any explicit tool permissions or allowed-tools scope. In agent environments, this increases the chance the model invokes broader capabilities than users expect, enabling unintended network calls, local writes, or access to environment-provided secrets.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger list is broad and ambiguous, covering general requests about citations, sourcing, and academic formatting. Overbroad activation can cause the skill to engage in contexts the user did not intend, increasing the chance of unnecessary network calls, file creation, or misleading auto-selection over safer, simpler behaviors.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction '答案用简体字' imposes a fixed language/script choice. This is a locale/language policy issue because the skill does not present it as an option or ask for user preference before enforcing the output style.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation claims the scripts rely only on official CBETA APIs and local data, yet elsewhere includes an optional script that uses a third-party site with login cookies. This inconsistency can mislead users about external dependencies and trust boundaries, especially where authenticated third-party access and cookie handling are involved.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes a tool for locating CBETA/Taishō passages and generating academic citations. While network access is expected for lookup, spawning an external program via subprocess.run is a broader execution capability that is not necessary to the stated user-facing purpose and increases operational scope beyond straightforward HTTP requests.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · 中华大藏经定位.py (reported line 76)May include surrounding context.

python

cmd += ["-H", "Cookie: " + cookie]
            if data is not None:
                cmd += ["-X", "POST", "-d", json.dumps(data, ensure_ascii=False)]
            return subprocess.run(cmd, capture_output=True, text=True,
                                  timeout=30).stdout
    except Exception as e:
        last = str(e)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · 按经文查出处.py (reported line 232)May include surrounding context.

python

if 参数.复制 and 首脚注:
        try:
            import subprocess
            subprocess.run(["clip"], input=首脚注.encode("utf-16"), check=True)
            print("已复制第一笔「完整脚注」到剪贴板。")
        except Exception as e:
            print("【提示】复制失败（%s），请手动选中复制。" % e, file=sys.stderr)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · 更新藏经数据.py (reported line 68)May include surrounding context.

python

return urllib.request.urlopen(请求, timeout=30).read().decode("utf-8", "ignore")
    except Exception:
        try:
            结果 = subprocess.run(
                ["curl", "-sL", "-m", "30", "-A", "Mozilla/5.0", 网址],
                capture_output=True,
            )

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

技能描述强调的是根据 CBETA 编号或经文生成学术脚注与出处定位，并未说明该技能还包含抓取 CBETA 官网并重建底层藏经出版社数据表的维护能力。代码中的主程序实际执行远程抓取、解析网页并覆盖写入本地 JSON 数据，这属于独立的数据更新行为，而不是直接的引用生成实现细节。

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · 生成引用.py (reported line 141)May include surrounding context.

python

末错 = e
        # 通道二：curl
        try:
            结果 = subprocess.run(["curl", "-sL", "-m", "25", "-H",
                                   "Referer: https://cbetaonline.dila.edu.tw", 网址],
                                  capture_output=True)
            文本 = 结果.stdout.decode("utf-8", "ignore").strip()

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest describes a tool for generating CBETA academic citations and reverse lookup by scripture text, which reasonably implies parsing input and querying CBETA data sources. However, the code also invokes external executables via subprocess.run: it falls back to curl for HTTP access, auto-runs another local script to generate missing data, and later uses clip to access the system clipboard. These host-level execution capabilities go beyond the core citation-formatting purpose and are not declared in the manifest.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · 生成引用.py (reported line 161)May include surrounding context.

python

路径 = os.path.join(数据目录, "藏经出版社.json")
    if not os.path.exists(路径):
        print("【提示】缺少 藏经出版社.json，正在生成…", file=sys.stderr)
        subprocess.run([sys.executable, os.path.join(数据目录, "更新藏经数据.py")])
    with open(路径, encoding="utf-8") as f:
        return json.load(f)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The help text states that the default behavior is to output Simplified Chinese unless the user explicitly passes --繁 to preserve the original script. This imposes a language/locale/script preference by default rather than offering a neutral or opt-in choice, which matches the policy category for forced language or locale behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · 生成引用.py (reported line 564)May include surrounding context.

python

print("核对：%s" % 结果["核对网址"])
        if 参数.复制:
            try:
                subprocess.run(["clip"], input=复制文本.encode("utf-16"), check=True)
                print("（已复制两行到剪贴板）", file=sys.stderr)
            except Exception as e:
                print("【提示】复制失败（%s），请手动选中复制。" % e, file=sys.stderr)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · 生成引用.py (reported line 592)May include surrounding context.

python

if 参数.复制:
        try:
            subprocess.run(["clip"], input=核心条目.encode("utf-16"),
                           check=True)
            print("已复制「文献条目」到剪贴板。")
        except Exception as e:

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The CLI help for --详细 says '默认两行之外，附核对网址', implying verification URLs are optional and only added when the flag is used. In actual execution, the default non---全格式 branch always prints 核对网址/核对网址卷级, regardless of whether 参数.详细 is set, so the inline documentation contradicts the behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This JSON manifest-like file uses Chinese-only field names and values throughout, with no accompanying indication that the skill supports other languages or that the Chinese locale is an intentional region-specific constraint. Under the policy for natural-language violations, a file that appears to enforce a single language without opt-in or justification can be flagged.

Content

No source excerpt is available for this finding.