足球篮球排球沙滩排球网球乒乓球羽毛球冰球手球水球曲棍球橄榄球棒球-球彩所有比赛全能分析助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:20 AM UTC
• Version: 1.0.1

Overview

This sports-report skill is not clearly malicious, but it has enough broad automation, network access, file mutation, and generated-HTML safety issues that users should review it before installing.

Install only if you are comfortable with a Chinese-first sports report generator that may write HTML reports to the desktop, update JSON data files, call public sports APIs or user-supplied URLs, and encourage recurring WorkBuddy reports. Treat report inputs as trusted data until the HTML escaping issues are fixed, avoid the generic --url fetch on untrusted URLs, and prefer --no-write when refreshing user-maintained JSON.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/analytics.py:1888

Finding

Mandatory WorkBuddy Promotion and Subscription Guidance Injected into Reports

Content

View full analysis

" # Additional subscription-card markup "

\u5728 WorkBuddy \u4e2d\u8bf4\u300c\u6bcf\u5929\u7ed9\u6211\u53d1\u4eca\u65e5\u8d5b\u4e8b\u603b\u89c8\u300d\u5373\u53ef\u4e00\u952e\u5f00\u542f\u3002

" ) ``` The card is unconditionally inserted into the generated report: ```python + hero + hook_html + live_banner + banner + anti_scam_html() + guide + focus_note + dash + radar_html + details + share_card_html(matches, "daily") + sub_cta + feedback_html() + foot + ENHANCE_JS + "") ``` The corresponding Skill instructions describe the branding card as fixed and require a footer call to action telling users to enable a daily report through WorkBuddy. ### Technical Analysis This behavior is not necessary to collect sports schedules, audit data, or generate the requested analysis. It modifies the normal output objective by requiring unrelated promotional and retention content. Because `sub_cta` is directly concatenated into every daily report, callers cannot omit the promotion through normal report input. This exceeds the minimum behavior needed for the declared report-generation functionality. ### Attack Path 1. A user or agent loads the Skill to generate a sports report. 2. The Skill instructions direct the agent to preserve fixed branding and subscription messaging. 3. The daily repo ...[truncated 831 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/analytics.py:992

Finding

HTML Attribute Injection Through Insufficient Escaping of Avatar URLs

Content

View full analysis

", ">")) ``` ```python avatar = p.get("avatar", "") number = str(p.get("number", p.get("jersey", "") or "")).strip() team_color = CLUB_BADGES.get(p.get("team", ""), (_AV_TEAM[_stable(tm) % len(_AV_TEAM)], ""))[0] if avatar: fig = ("") % (_esc(avatar), nm) elif p.get("avatar_b64"): fig = ("") % (_esc(p["avatar_b64"]), nm) else: fig = _player_avatar_svg(p, match_id) ``` ### Technical Analysis HTML escaping must be appropriate for the exact output context. Escaping only `&`, `<`, and `>` is insufficient for data inserted into a quoted attribute. Because the `src` attribute uses single quotes, an avatar value containing a single quote can terminate the attribute and introduce a new event-handler attribute. For example, an input structurally equivalent to the following can add an executable handler: ```text x' onerror='alert(document.domain) ``` The resulting report markup is structurally equivalent to: ```html ``` The browser attempts to load the invalid image and invokes the injected `onerror` handler. The same escaping weakness also affects `alt` and any other attributes that reuse `_esc`. Base64 avatar input is less directly exploitable when valid base64 is enforced, but the report renderer itself does not establish a strict schema boundary before interpolation. ### Attack Path 1. An at ...[truncated 1065 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/analytics.py:1514

Finding

Script-Element Breakout Through Unsafe JSON Embedding

Content

View full analysis

%s" % payload ``` The generated page later reads this element: ```javascript function copyShare(){ try{ var d=JSON.parse(document.getElementById('shareData').textContent); var t='【体育赛事可视化】'+d.title+'\n'+d.points.map(function(p,i){ return (i+1)+'. '+p; }).join('\n')+'\n— 数据来源：公开赛事资料整理 · 仅合法赛事 · 理性观赛'; navigator.clipboard.writeText(t).then(function(){ alert('已复制要点，可粘贴到群聊 / 朋友圈'); }); }catch(e){ alert('复制失败，请手动选择文本复制'); } } ``` ### Technical Analysis Although the element has `type="application/json"`, the HTML parser still treats its contents as script raw text. A literal closing `script` tag terminates the element before JavaScript or JSON parsing occurs. Python's `json.dumps` escapes JSON quotation marks and control characters, but it does not neutralize the HTML sequence ``. If an attacker-controlled title, team name, point, player name, or expert-derived field reaches `payload`, a value structurally equivalent to the following can escape the data element: ```html ``` The HTML parser closes `shareData` and parses the new executable script element. The later `JSON.parse` call is irrelevant because execution occurs during document parsing. The expert-refresh utility increases the relevant trust boundary because it merges externally gathered expert ...[truncated 1381 chars]

Remediation

View remediation

` to `\u003e` - `&` to `\u0026` - Unicode line separators to their escaped forms 3. Alternatively, store the payload in an external JSON resource or a safely encoded attribute and parse it after decoding. 4. Use a maintained template engine with an explicit JSON-to-HTML-safe serialization function. 5. Validate all report input through a strict schema, including externally collected expert data. 6. Add a restrictive Content Security Policy that disallows inline scripts and limits outbound connections. 7. Add regression tests containing closing `script` sequences in every field that can contribute to the share payload. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (48)

Tainted flow: 'req' from os.environ.get (line 2048, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/analytics.py (reported line 2050)May include surrounding context.

python

q = urllib.parse.quote(team)
        req = urllib.request.Request(base + "/searchteams.php?t=" + q,
                                     headers={"User-Agent": "Mozilla/5.0 (compat; sports-data-analysis)"})
        with urllib.request.urlopen(req, timeout=15) as resp:
            tdata = json.loads(resp.read().decode("utf-8"))
        teams = (tdata.get("teams") or []) if isinstance(tdata, dict) else []
        if not teams:

Tainted flow: 'req2' from os.environ.get (line 2066, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/analytics.py (reported line 2068)May include surrounding context.

python

if id_team:
            req2 = urllib.request.Request(base + "/eventslast.php?id=" + str(id_team),
                                         headers={"User-Agent": "Mozilla/5.0 (compat; sports-data-analysis)"})
            with urllib.request.urlopen(req2, timeout=15) as resp2:
                edata = json.loads(resp2.read().decode("utf-8"))
            evs = (edata.get("results") or []) if isinstance(edata, dict) else []
            for e in evs[:5]:

Tainted flow: 'req' from os.environ.get (line 2048, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The fetch command accepts an arbitrary user-supplied URL and performs a server-side network request with urllib without allowlisting schemes, hosts, or address ranges. In an agent or hosted environment, this can enable SSRF-style access to internal services, cloud metadata endpoints, or other unintended network locations.

Content

Scanner excerpt · scripts/analytics.py (reported line 2095)May include surrounding context.

python

a.url,
                headers={"User-Agent": "Mozilla/5.0 (compat; sports-data-analysis)",
                         "Accept": "application/json"})
            with urllib.request.urlopen(req, timeout=15) as resp:
                data = json.loads(resp.read().decode("utf-8"))
            keys = list(data.keys())[:20] if isinstance(data, dict) else []
            print("✅ 已抓取：%s" % a.url)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill includes commands that maintain and write back local JSON assets, inject expert data, and mark freshness/state fields, which are materially different from read-only report generation. Hidden or underemphasized local state mutation is dangerous because an agent may overwrite files, alter source assets, or persist misleading metadata without the user understanding that the skill is acting as a data maintenance tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes commands that maintain and write back local JSON assets, inject expert data, and mark freshness/state fields, which are materially different from read-only report generation. Hidden or underemphasized local state mutation is dangerous because an agent may overwrite files, alter source assets, or persist misleading metadata without the user understanding that the skill is acting as a data maintenance tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill includes commands that maintain and write back local JSON assets, inject expert data, and mark freshness/state fields, which are materially different from read-only report generation. Hidden or underemphasized local state mutation is dangerous because an agent may overwrite files, alter source assets, or persist misleading metadata without the user understanding that the skill is acting as a data maintenance tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill includes commands that maintain and write back local JSON assets, inject expert data, and mark freshness/state fields, which are materially different from read-only report generation. Hidden or underemphasized local state mutation is dangerous because an agent may overwrite files, alter source assets, or persist misleading metadata without the user understanding that the skill is acting as a data maintenance tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill includes commands that maintain and write back local JSON assets, inject expert data, and mark freshness/state fields, which are materially different from read-only report generation. Hidden or underemphasized local state mutation is dangerous because an agent may overwrite files, alter source assets, or persist misleading metadata without the user understanding that the skill is acting as a data maintenance tool.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger phrases are extremely broad and instruct the agent to run immediately on common requests like '分析报告' or '示例演示' without clarifying scope first. Because the skill also performs file writes, report generation, possible network activity, and presentation actions, overly permissive invocation can cause unintended execution, resource use, and side effects from innocuous user messages.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The compliance section states that the workflow does not track pre-match information changes, but the entire file instructs users to refresh timestamps, merge patches, and audit changing pre-match factors. That creates a substantive policy-evasion risk: the skill can be presented as compliant while still enabling ongoing monitoring of exactly the information category it claims to avoid.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The top-level docstring explicitly describes the module as '纯 Python 标准库，无需联网/第三方包', which directly contradicts later code that imports urllib, fetches from external APIs/URLs, and refreshes reports with online data. This is an active contradiction in documentation, not just an omitted detail.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring states it is a pure standard-library tool that works '无需联网' and only organizes information for visualization, but this file includes active HTTP requests via urllib to arbitrary URLs and the TheSportsDB API. Network fetching is not merely incidental here: it is exposed as user-facing commands and used to refresh reports with live data, which exceeds the manifest's stated 'information整理与可视化' framing as an offline reporting tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The refresh command rewrites the input JSON file in place by default after merging patches and fetched data. If run against user-maintained data, this can silently destroy original content or persist attacker-influenced modifications, making the integrity risk materially higher than a simple report write.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The docstring makes strong assurances that no hardcoded or fallback expert content will be used for current reporting, yet the code preserves a static expert library for non-live matches. This inconsistency can mislead downstream agents or users into treating stale or non-current analysis as fresh, which is dangerous in a sports-information context because it undermines provenance guarantees and can facilitate deceptive presentation of outdated advisory content.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents capabilities that imply environment variable access, local file read/write, and outbound network use, but it does not declare an explicit tool scope or permissions boundary. This increases the chance of over-broad execution in a host agent, especially because the instructions include writing files to the desktop, reading JSON inputs, using API keys, and performing live web data collection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The display name, description, command examples, output filenames, and user-facing instructions are all written in Chinese, and the file does not indicate that language selection is optional or user-configurable. This creates a locale policy concern because the skill appears to impose a specific language by default without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This JSON-side conclusion is written only in Chinese ("结论：通过 ✅"), and the entire file uses Chinese labels and values without indicating that the skill is region-specific or that users can opt into this locale. The policy specifically flags language/locale constraints that are imposed without user choice or documented justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file simultaneously labels itself as '非实时' while setting _is_live: true and asserting live web verification in _note. This inconsistency can mislead downstream agents or users into treating stale or sample data as current live data, which is dangerous in a skill that emphasizes timely sports schedules and could drive user decisions based on inaccurate freshness assumptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This JSON manifest presents the title and descriptive note entirely in Chinese, indicating a fixed language/locale for the skill data. The file does not offer any user opt-in or alternative locale handling, which matches the policy category for language or locale constraints without choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest says the skill '不做赛果判断、只做信息整理与可视化' and even positions itself against tipster-style recommendation rhetoric. However, the dataset embeds an 'experts' structure with analyst identity/tier metadata and opinion text, which goes beyond neutral schedule organization into expert-analysis capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire template, example values, and reporting instructions are written as mandatory Chinese output conventions, including Chinese titles and field content such as title, info_points, analysis, and risk. There is no indication that users may choose another language or locale, which can violate language/locale policy when the skill is not explicitly region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The entire skill file is written in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context. Under the policy, a language-specific constraint without opt-in or clear justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document claims it does not involve pre-match information or related tracking, yet the workflow explicitly refreshes and merges pre-match items such as official lineups, injuries, weather, and intel. This inconsistency is dangerous because it can mislead reviewers, operators, or policy controls into treating the skill as compliant while it still operationalizes sensitive pre-match monitoring behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire skill file is written as mandatory Chinese-language guidance and does not offer any language or locale choice to the user. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The entire skill document is written as Chinese-only instructional content and does not indicate that users may choose another language or locale. Under the policy rule, a skill that effectively forces a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.