Product Design Workflow

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:27 AM UTC
• Version: 1.1.1

Overview

This skill’s product-design workflow is mostly coherent, but it uses unsafe server upload handling and forces third-party branding/destinations that users should review before installing.

Install only after reviewing the deployment pieces. Avoid production server passwords, remove password-in-CLI usage, require SSH host verification, and replace the hardcoded group/domain/footer branding with values you explicitly approve before any upload or report is sent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: references/workflow-guide.md:49

Finding

Mandatory Third-Party Promotional Content Injection into Generated Demos

Content

View full analysis

重新定义企业生产力范式 · 企业级智能体应用

Copyright © DIX AI All Rights Reserved.

`); ``` ### Technical Analysis The Skill directs the Agent to include immutable shared components in every generated HTML demo. The mandatory footer injects DIX AI branding, promotional language, a remotely hosted image, and a clickable link to `https://www.dix-ai.com`. This content is not inherently necessary to generate a product prototype. Because the workflow expressly prohibits removing or replacing the component, loading the Skill alters the expected output by systematically adding third-party promotional material. The behavior propagates through all supplied templates, including: - `assets/html/base.html:24-25 ...[truncated 1254 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/upload_demos.py:23

Finding

Arbitrary Command Execution Through Shell Command Injection

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/upload_demos.py:19

Finding

Plaintext SSH Password Exposure in Arguments and Logs

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/upload_demos.py:47

Finding

SSH Host Authentication Disabled During Upload

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: assets/html/base.html:16

Finding

Remote Stylesheet Dependency Loaded Without Subresource Integrity

Content

View full analysis

``` Equivalent references are present at: - `assets/html/components-demo.html:14-15` - `assets/html/detail-template.html:15-16` - `assets/html/list-template.html:15-16` - `assets/html/tool-template.html:15-16` ### Technical Analysis Every supplied HTML template loads Font Awesome from a third-party CDN. Although the URL includes a version, the resource is not protected by a Subresource Integrity hash. If the CDN account, hosted object, or content-delivery path is compromised, browsers loading generated demos will trust the modified stylesheet. Malicious CSS can alter page presentation, conceal warnings, overlay or reposition interface elements, trigger additional resource requests, and facilitate user-interface deception. Loading the resource also discloses ordinary network metadata, including visitor IP address and potentially referrer information, to the CDN. The workflow describes the CDN reference as fixed, making this dependency propagate into generated deliverables. ### Attack Path 1. A generated demo retains the mandatory CDN stylesheet reference. 2. A visitor opens the published demo. 3. The browser requests the stylesheet from `cdnjs.cloudflare.com`. 4. A compromised dependency or delivery path returns modified CSS. 5. The browser applies that CSS with the page's styling authority. 6. The altered styles can manipulate the rendered interface or initiate further external resource requests. ### Impact Assessment The issue affects the confidentiality and integrity of visitors' browser sessions at the presentation layer. It does not directly establish arbitrary opera ...[truncated 250 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Unlike the generic mismatch reports, this finding notes that the skill actually includes remote upload behavior using server passwords and SSH/SCP while presenting itself as a broader product-design workflow. Embedding deployment instructions with password-based remote access in a high-level content-generation skill increases the chance that users provide credentials and trigger publication to remote infrastructure without clear trust boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Unlike the generic mismatch reports, this finding notes that the skill actually includes remote upload behavior using server passwords and SSH/SCP while presenting itself as a broader product-design workflow. Embedding deployment instructions with password-based remote access in a high-level content-generation skill increases the chance that users provide credentials and trigger publication to remote infrastructure without clear trust boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Unlike the generic mismatch reports, this finding notes that the skill actually includes remote upload behavior using server passwords and SSH/SCP while presenting itself as a broader product-design workflow. Embedding deployment instructions with password-based remote access in a high-level content-generation skill increases the chance that users provide credentials and trigger publication to remote infrastructure without clear trust boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Unlike the generic mismatch reports, this finding notes that the skill actually includes remote upload behavior using server passwords and SSH/SCP while presenting itself as a broader product-design workflow. Embedding deployment instructions with password-based remote access in a high-level content-generation skill increases the chance that users provide credentials and trigger publication to remote infrastructure without clear trust boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Unlike the generic mismatch reports, this finding notes that the skill actually includes remote upload behavior using server passwords and SSH/SCP while presenting itself as a broader product-design workflow. Embedding deployment instructions with password-based remote access in a high-level content-generation skill increases the chance that users provide credentials and trigger publication to remote infrastructure without clear trust boundaries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Unlike the generic mismatch reports, this finding notes that the skill actually includes remote upload behavior using server passwords and SSH/SCP while presenting itself as a broader product-design workflow. Embedding deployment instructions with password-based remote access in a high-level content-generation skill increases the chance that users provide credentials and trigger publication to remote infrastructure without clear trust boundaries.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This is a true tool-parameter abuse issue because untrusted parameters flow into shell commands that perform networked file transfer and remote directory creation. Given this skill handles server credentials and deployment targets, successful injection could execute arbitrary local commands, misuse SSH access, alter uploaded content, or pivot into the target server environment.

Content

Scanner excerpt · scripts/upload_demos.py (reported line 28)May include surrounding context.

python

"""执行命令"""
    print(f"执行: {cmd}")
    try:
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
        if result.returncode != 0:
            print(f"错误: {result.stderr}")
        return result.returncode == 0

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill instructs use of file reads and shell-executed scripts (python scripts/..., SSH/SCP tooling) but does not declare any explicit tool scope or allowed-tools boundary. That increases the chance of over-broad execution privileges and makes it harder to constrain what the agent may access or run during execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language instructions and output expectations are entirely specified in Chinese and the skill does not state that language selection is optional or user-configurable. Under the policy, forcing a specific language without user opt-in can be a locale policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill asks users to provide sensitive data including server-pass and target-group-id without any warning about secure handling, storage, masking, or transmission. In this context, collecting plaintext server credentials for shell-based deployment materially increases the risk of credential exposure, misuse, or accidental logging.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs uploading generated demos to a remote server and exposing them via a preview domain, but does not prominently warn users that this modifies remote systems and may publish content publicly. In context, this is more dangerous because the workflow is framed as routine automation, which can normalize deployment actions that should require explicit consent and review.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md

## ⚠️ 前置依赖（用户需要安装）
需要安装 `sshpass` 工具（用于免密SSH/SCP）：
- Ubuntu/Debian：`sudo apt install sshpass`
- CentOS/RHEL：`sudo yum install sshpass`

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

## ⚠️ 前置依赖（用户需要安装）
需要安装 `sshpass` 工具（用于免密SSH/SCP）：
- Ubuntu/Debian：`sudo apt install sshpass`
- CentOS/RHEL：`sudo yum install sshpass`

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This JavaScript injects a fixed footer containing Chinese-language copy, which imposes a specific language on all pages using the shared template. The file does not indicate that the skill is China-specific or that users can opt into another language, so it may violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This HTML file sets lang="zh-CN" and presents the page title and surrounding instructions entirely in Chinese, which indicates a fixed language/locale experience. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The HTML root sets lang="zh-CN", and the page content throughout the template is written in Chinese, indicating a fixed language/locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified, which is not present in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire template is written as a Chinese-only product design document, with section headings and field labels fixed in Chinese and no indication that users may choose another language. This can violate language/locale policy when a skill implicitly requires a specific language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The title and content requirements are entirely specified in Chinese, and L04-L05 impose strict wording constraints without any opt-in or alternative language option. Under the policy rule for language/locale, forcing a specific language is a violation unless the locale constraint is explicitly justified or optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The template explicitly requires the document title to use a Chinese product name ("[点子中文名称]") rather than allowing the user to choose language or locale. This creates a natural-language locale policy issue because it forces a specific language without opt-in or stated regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The title and opening instruction require all reports to use a fixed Chinese template and be sent in a uniform format. This is a natural-language locale policy constraint with no indication that users may choose another language or that the Chinese-only requirement is optional or justified as region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The report template hard-codes a specific leadership group ID, which overrides the skill’s documented user-supplied target-group-id parameter and can cause reports to be sent to an unintended recipient group. In this skill’s context, reports include operational status and demo URLs, so misrouting creates a real confidentiality and integrity risk and can also bypass user intent or tenant boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file is entirely prescriptive in Chinese and states the reporting standard is 'permanently effective' and must be followed for all tasks. That creates a natural-language locale policy constraint without any indication that users may choose another language or opt in to Chinese-only behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire workflow guide is written as a prescriptive Chinese-language instruction set, including required output structure and wording guidance, but it does not state that the language is optional or limited to a justified region-specific use case. This can violate language/locale policy because it implicitly forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script hard-codes allowed topic and audience values in Chinese and rejects anything outside those exact strings. This creates a natural-language locale constraint without any opt-in or documented justification, which matches the policy concern for forced language/locale behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script accepts the server password as a CLI argument and embeds it in sshpass commands, exposing credentials through process listings, shell history, logs, and debug output. In this file, run_cmd also prints the full command, making password disclosure even more likely to local users or monitoring systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.