T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:14- Finding
Mandatory Commercial Promotion Alters Agent Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
AI网站迁移助手
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent website-migration purpose, but it requires unpinned remote skill installation and can copy executable site code into a new production site.
Review before installing. Use only if you trust the third-party dependency source, can verify the dependency packages independently, and are prepared to manually review any JavaScript before it is uploaded to the new site. Prefer DNS ownership verification, avoid HTTP/meta verification unless hardened, and confirm retention rules for migration logs, inventories, and the copyright freeze list.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:30- Finding
Unpinned Third-Party Skills Are Retrieved and Loaded from Mutable Remote Sources
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:194- Finding
Unreviewed Source-Site JavaScript Is Copied into the Target Production Site
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/source-site-ownership-verification.md:80- Finding
Ownership Verification Performs Unrestricted Plaintext HTTP Requests
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 若**已可用**：读取其 `SKILL.md` 的 `name` 字段作为真实调用名，直接进入第 4 步登记（幂等）。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 若**已可用**：读取其 `SKILL.md` 的 `name` 字段作为真实调用名，直接进入第 4 步登记（幂等）。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 若**已可用**：读取其 `SKILL.md` 的 `name` 字段作为真实调用名，直接进入第 4 步登记（幂等）。
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger list includes broad phrases such as '复制网站' and conversational migration terms that can cause the skill to activate in situations where the user did not intend a full website-copying workflow. In this skill's context, unintended invocation is more dangerous because the workflow includes external dependency loading, ownership verification, scraping, and later write actions to a target site, so a misfire can expose third-party content to analysis or start a high-risk migration flow unnecessarily.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs large-scale source-site scraping and extraction of pages, products, news, images, forms, SEO data, and even rendered HTML/CSS/JS, but it does not present an explicit user-facing privacy/data-handling warning covering third-party personal data, embedded secrets, analytics tokens, or confidential form contents that may be copied during migration. This is especially dangerous here because the skill is designed for whole-site replication and structured extraction, which increases the chance of collecting sensitive data from old sites and transferring it into new systems or logs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file contains user-facing operational instructions only in Chinese, and does not indicate that the user may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document mandates token expiry, audit logging, and a lightweight recheck before migration, but the provided implementation example omits all three controls. This creates a likely implementation gap where integrators may copy the sample and deploy verification that is replayable, unaudited, and not revalidated before sensitive migration actions.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The spec explicitly allows migration to proceed after any one of three verification methods, including weaker web-layer proofs such as an HTTP-served file or a homepage meta tag. In a full-site migration context, those weaker methods may be satisfiable by parties with limited CMS or hosting access that does not necessarily prove durable domain ownership, increasing the risk of unauthorized scraping or migration of someone else's site.
- Content
Dynamic Request Target
Medium
- Category
- Server-Side Request Forgery
- Confidence
- 93% confidence
- Finding
The verification pseudocode issues HTTP requests to a user-controlled domain string without showing any validation, allowlisting, redirect controls, or protections against access to internal network targets. In a migration skill, this is especially dangerous because the system is expected to fetch arbitrary source sites, making SSRF pathways realistic and potentially allowing probing of internal services, cloud metadata endpoints, or other restricted infrastructure.
- Content
def verify_meta(domain, token): """方式三：HTML Meta 标签验证""" html = requests.get(f"http://{domain}/", timeout=10).text return f'content="{token}"' in html # 实际应使用 HTML 解析器
text
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The operational instructions and required user reminders/forms are written as mandatory Chinese-language workflow steps, while the skill metadata is bilingual. There is no explicit option for the user to choose their preferred language for prompts, forms, or confirmations, which may conflict with language/locale choice policies.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file’s operational instructions, templates, and required user forms are all presented in Chinese only. Under SQP-3, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file states that agents should copy, fill, and write stage outputs to disk as deliverables. Because markdown files are in scope for SQP-2, user-impacting data storage behavior should be disclosed clearly so users understand that migration artifacts containing site URLs, inventories, and mappings will be saved.
- Content