T08 · Insecure Dependencies
Warning
- Location
scripts/build_installer.js:104- Finding
Unpinned Dependencies Are Downloaded and Executed During the Build
- Content
View full analysis
- Remediation
View remediation
Security audit
desktop-pet
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed desktop-pet generator and Electron packaging template, with supply-chain caution because builds download npm packages to create installers.
Install only if you are comfortable with a skill that sends images to ImageGen and builds a local Electron app. Before building or sharing installers, pin dependencies, add a lockfile, prefer npm ci, review the template, and run the build in a disposable least-privilege environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
assets/desktop-pet-template/main.js:25- Finding
Electron Renderer Runs with Node.js Integration and Context Isolation Disabled
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises an end-to-end system that converts real photos into installable interactive desktop pet apps, including image segmentation, stylization, animation generation, and packaging. The supplied code does none of that. It is only an Electron app shell/template that opens a transparent always-on-top window, listens for renderer IPC events like click/hover/idle, switches between hardcoded action labels, and exposes a tray menu. While this does align with a small subset of the declared interaction logic and desktop-pet runtime behavior, the primary advertised functionality—photo conversion, asset generation, and installer/app output—is absent. Therefore the description materially overstates and misrepresents what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description promises a full creation pipeline that converts user photos into a packaged desktop pet application, including image processing, stylization, animation generation, and installer output. This code does not perform any of those tasks. Instead, it only controls runtime UI behavior of a desktop pet by changing the displayed asset based on clicks, hover, idle timeout, and IPC events. While interaction logic is one small part of the declared product, the primary purpose and most major capabilities described are absent from this code chunk, so this is a material mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The supplied code chunk does not implement the declared end-to-end photo-to-desktop-pet pipeline. Instead, it assumes the pet assets already exist with specific filenames, then packages them into an Electron app and builds installers. While producing installable desktop pet applications is consistent with part of the description, the major advertised capabilities—photo analysis, cutout/background removal, stylization, multi-action generation, and interaction configuration—are absent from this code. Therefore the description materially overstates what this code chunk actually does.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `package.json` — 项目配置与 electron-builder 构建规则（Windows: NSIS .exe，Mac: .dmg）
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger logic is overly broad because it activates on loosely defined phrases with 'including but not limited to' semantics and no exclusions. That can cause the skill to run in unintended contexts, increasing the chance of unsolicited file processing, unexpected workflow transitions, or accidental initiation of later build/package steps.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill proposes auto-detecting the OS, installing dependencies from the network, and building executable installers without an explicit trust boundary or user confirmation. In a skill that culminates in .exe/.dmg production, this is dangerous because it normalizes silent supply-chain exposure and executable generation, which could lead users to run unreviewed binaries or authorize risky build actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The user-facing tray menu strings are hard-coded in Chinese, which imposes a specific language on all users. The file does not provide any opt-in, localization fallback, or documentation that this skill is intentionally limited to a Chinese-speaking context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
文件标题、概述和后续操作说明全部以中文给出，且未说明是否支持其他语言，也未提供用户语言偏好选择。根据自然语言策略要求，若技能隐含强制单一语言而无用户选择，可能构成语言/locale 政策问题。
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The Electron dependency is specified with a caret range (^28.0.0), which permits automatic installation of newer minor and patch versions rather than a single audited release. In a desktop app template that produces distributable executables, this weakens build reproducibility and makes it harder to verify whether the shipped package includes a vulnerable or reviewed Electron version.
- Content
json "build:mac": "electron-builder --mac" }, "devDependencies": { "electron": "^28.0.0", "electron-builder": "^24.9.1" }, "build": {
Unverifiable Dependency: electron has 16 known advisory(ies) (CVE-2020-15174 (Unpreventable top-level navigation); CVE-2026-34776 (Electron: Out-of-bounds read in second-instance IPC on macOS and Linux); CVE-2022-21718 (Renderers can obtain access to random bluetooth device without permission in Ele) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
Electron has a history of security advisories, and because the manifest uses a version range instead of an exact pinned release, it is not possible to verify from this file alone whether the resolved package is patched or still affected by known issues. This matters more in this skill because the output is a desktop executable (.exe/.dmg), so any vulnerable Electron runtime would be redistributed to end users.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
electron-builder is also declared with a caret range (^24.9.1), so different builds may resolve to different releases over time. Because this tool controls packaging of Windows and macOS installers, unpinned versions can introduce supply-chain risk, inconsistent artifacts, or newly introduced insecure defaults without an explicit review.
- Content
json }, "devDependencies": { "electron": "^28.0.0", "electron-builder": "^24.9.1" }, "build": { "appId": "com.workbuddy.desktoppet",
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON config includes user-facing action names only in Chinese (for example on L05, L12, L19, L26, and L33), which can indicate a language-specific behavior without user opt-in. The policy for this audit flags natural-language locale constraints when a skill forces a specific language and does not present a choice or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document sets the root language to "zh", which is a natural-language locale decision affecting how the skill presents itself. In this file there is no indication of user opt-in or a documented reason that the skill must be Chinese-only, so it may violate language/locale policy expectations.
- Content