Security audit

AI建站助手

Security checks for vulnerabilities and agentic risk

Overview

This skill is a website-building assistant that uses user-provided MCP credentials to read and modify a target site, with the main risks disclosed and tied to that purpose.

Install only if you intend to manage a Yunzhi SAAS website through an MCP endpoint. Provide MCP addresses and Bearer tokens only for sites you control, review every proposed write/delete/batch import carefully, and add privacy notices to generated forms that collect phone numbers, email addresses, verification codes, or uploaded files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation condition is overly broad because it includes common phrases like '帮我建个网站' and extends to '任何需要…管理网站数据时', which can cause the skill to trigger in loosely related conversations. In a skill that can query and write site content via MCP, accidental activation increases the chance of unnecessary credential requests, unintended tool use, or destructive follow-on actions if the agent proceeds too eagerly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill instructs the agent to remind users in Chinese to register on an external website before use, without checking the user's language preference or obtaining opt-in. This is primarily a consent and usability issue, but in context it also nudges users toward an external service before establishing necessity, which is risky in a privileged skill that later asks for MCP endpoints and bearer tokens.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document instructs use of SMS and email verification APIs, including sending phone numbers and email addresses to backend endpoints, but it does not warn that personal contact information will be transmitted for verification. Since this behavior affects user privacy and data handling, the skill description should disclose it explicitly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file instructs implementers to automatically intercept form submission, upload files to server endpoints, and submit hidden fields containing uploaded file paths, but it does not include any warning that these actions transmit and store user-provided data. Under the markdown-specific SQP-2 criteria, behaviors affecting user data and privacy should be accompanied by clear disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This is a markdown file, so SQP-2 applies to omissions in the skill description itself. The top-of-file notes only mention parser compatibility and preserving JS, while the embedded example later performs AJAX form submission, SMS/email verification requests, region lookups, and file uploads without any user-facing warning in the markdown description about data transmission or upload behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This HTML/JS form collects user-supplied query data, including mobile numbers and SMS verification codes, and submits them to backend endpoints. The file contains no user-facing notice explaining that this personal data will be transmitted or processed, which is a missing warning for a safety-relevant data-handling operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code issues a fetch request containing the user's mobile number to the SMS endpoint, but the interface provides no disclosure about this network transmission beyond the button label. For personal contact data, the absence of a clear warning or explanatory text is a quality/safety gap.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The title and the entire instructional content are written exclusively in Chinese, with no indication that language selection is optional or user-driven. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern unless the constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file’s instructional content is exclusively Chinese from title to examples, and there is no indication that users may choose another language or that the document is intended only for a China-specific audience. This can violate a language/locale policy when a skill or reference forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: SQP-3 applies to natural-language policy issues in any file type. This template presents most labels, alerts, and instructions in Chinese, while the international region selector uses English-only placeholders such as 'select country' and 'please select city', with no documented locale choice or opt-in for users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file is predominantly Chinese, but field labels and placeholders for the international region selector are hard-coded in English (for example, 'select country' and 'please select province/state'). This creates a fixed language experience without opt-in or documented locale justification, which fits the locale-policy concern for natural-language behavior.
Content: No source excerpt is available for this finding.