Auto Tech Research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:00 AM UTC
• Version: 1.0.0

Overview

This skill needs review because it claims to gather real web research, but its included script fabricates source lists and saves reports without strong safeguards.

Do not rely on this skill's generated reports as real research evidence unless the retrieval path is fixed and every source has verifiable provenance. If installed for experimentation, use an isolated browser profile, avoid confidential topics or private links, review any generated files, and require explicit confirmation before authenticated browsing or file writes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: scripts/auto-research.py:290
• Finding: Synthetic Research Results Are Presented as Successfully Retrieved Platform Data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/auto-research.py:290-380` **Vulnerability Type**: Fabricated research output and misleading provenance **Risk Level**: Medium ### Vulnerable Code ```python async def _multi_platform_search(self, platform_configs: List[Dict], keywords: Dict) -> List[ContentItem]: """Multi-platform parallel search""" results = [] # Sort by relevance and search high-relevance platforms first sorted_configs = sorted(platform_configs, key=lambda x: x['score'], reverse=True) for cfg in sorted_configs: platform = cfg['name'] count = cfg['fetch_count'] lang = "zh" if platform in ["Zhihu", "CSDN", "Juejin", "Bilibili", "Xiaoyuzhou", "WeChat"] else "en" items = self._simulate_search(platform, keywords[lang], count) results.extend(items) # Update statistics stats = self.platform_stats[platform] stats.fetched_count = len(items) print(f" ✓ {platform}: {len(items)} items") return results def _simulate_search(self, platform: str, keywords: Dict, count: int) -> List[ContentItem]: """Simulate search results (a real API should be called in production)""" items = [] core_word = keywords["core"][0] # Platform-specific fixed title templates are selected here. template_list = templates.get(platform, [f"{core_word} content"]) for i in range(min(count, len(template_list) * 3)): title = template_list[i % len(template_list)] level = self.classifier.classify_level(title) content_type = self.classifier.classify_type(platform) item = ContentItem( title=title, url=f"https://example.com/{platform.lower()}/{i}", platform=platform, content_type=content_type, language="zh" if platform in ["Zhihu", "CSDN", "Juejin", "Bilibili", "Xiaoyuzhou", "WeChat"] else "en", level=level, quality_score=round(0.7 + (i % ...[truncated 2962 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `_simulate_search()` with the documented browser or approved API implementation. 2. Preserve verifiable provenance for every result, including the final URL, retrieval time, platform, and retrieval status. 3. Validate that retrieved URLs use the expected platform domain before assigning a platform label. 4. Do not assign a successful fetch count until content has actually been retrieved and validated. 5. Derive quality scores from documented criteria and retain the evidence used to calculate each score. 6. Extract publication dates and authors from source content; use an explicit `unknown` value when unavailable. 7. Clearly label fixture or demonstration data as simulated and prevent it from entering production reports. 8. Add an execution mode field such as `data_mode: live|fixture`, and display it prominently in generated reports. 9. Add automated tests that fail if production reports contain `example.com` sources or simulated metadata. 10. Reconcile `README.md`, `SKILL.md`, and `OVERVIEW.md` with the implementation so operational claims accurately describe current behavior. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/auto-research.py:636
• Finding: Unsanitized Topic Input Is Incorporated into the Report Output Path<![CDATA[ ## Vulnerability Details **File Location**: `scripts/auto-research.py:636-646` **Vulnerability Type**: User-controlled path construction **Risk Level**: Low ### Vulnerable Code ```python topic = sys.argv[1] config = ResearchConfig() researcher = AutoResearcher(config) report = await researcher.research(topic) # Generate Markdown report md_report = generate_markdown_report(report) # Save report filename = f"research-report-{topic.replace(' ', '-').lower()}-{datetime.now().strftime('%Y%m%d')}.md" with open(filename, 'w', encoding='utf-8') as f: f.write(md_report) ``` ### Technical Analysis The command-line `topic` value is incorporated directly into the output filename. Replacing spaces does not remove or reject: - Forward slashes. - Backslashes on platforms where they are path separators. - Traversal components such as `..`. - Control characters. - Platform-specific reserved filename characters. - Excessively long path components. Because the file is opened in write mode, the resolved destination is created or truncated using the privileges of the process. The fixed `research-report-` prefix limits straightforward traversal, but it does not establish path containment. A crafted topic can introduce additional path components. Redirection outside the expected location is possible when the resulting intermediate directory structure exists or is prepared in advance. The issue can also cause predictable denial of service through invalid paths, missing intermediate directories, or filename-length violations. ### Attack Path 1. An attacker or untrusted caller controls the topic argument passed to the script. 2. The topic contains path separators, traversal-like components, or reserved filename characters. 3. The script only replaces spaces and concatenates the remaining input into `filename`. 4. The operating system resolves the constructed string as a filesystem path rather than a single safe filename. 5. If the required intermediate director ...[truncated 1156 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Convert the topic into a strict filename slug using an allowlist of letters, digits, hyphens, and underscores. 2. Explicitly reject `/`, `\`, `..`, null bytes, control characters, and platform-specific reserved characters. 3. Enforce a conservative maximum slug length. 4. Write all reports beneath a dedicated output directory. 5. Resolve both the output directory and candidate path with `pathlib.Path.resolve()`. 6. Verify that the resolved candidate remains a child of the intended output directory before opening it. 7. Use a generated identifier when the sanitized topic is empty. 8. Consider exclusive creation mode (`"x"`) or an explicit overwrite policy to avoid silently truncating existing reports. 9. Handle filesystem errors without reporting successful completion. Example hardening approach: ```python import re from pathlib import Path output_dir = Path("reports").resolve() output_dir.mkdir(parents=True, exist_ok=True) slug = re.sub(r"[^A-Za-z0-9_-]+", "-", topic).strip("-_")[:80] if not slug: slug = "research" candidate = ( output_dir / f"research-report-{slug.lower()}-{datetime.now():%Y%m%d}.md" ).resolve() if output_dir not in candidate.parents: raise ValueError("Unsafe report output path") with candidate.open("x", encoding="utf-8") as report_file: report_file.write(md_report) ``` ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill appears to materially misrepresent its behavior: it claims live browser-based research and HTML reporting, but the finding indicates the actual implementation uses local template generation without real browsing or transparent diagnostics. This is dangerous because users may rely on fabricated or unverifiable results as if they were grounded in real external sources, undermining integrity and potentially masking other unsafe behavior.

Hidden Instructions

High

• Category: Prompt Injection

Content

<div class="container">

  <!-- 技术概览 -->
  <section id="overview">
    <h2>📋 技术概览</h2>
    <div class="overview-content">

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill metadata promises real browser/CDP-driven research across live platforms, but the implementation fabricates results via `_simulate_search` using hard-coded titles, fake URLs, synthetic summaries, and current timestamps. In a research skill, this is dangerous because downstream users may trust the output as real-world evidence and make technical, business, or security decisions based on invented sources.

Natural-Language Policy Violations

Medium

• Confidence: 77% confidence
• Finding: The file title and nearly all user-facing examples and output structures are presented in Chinese, including the canonical input phrase shown in the architecture diagram. There is no explicit user choice for language or a documented reason that the skill is intentionally locale-specific, which can violate language/locale policy expectations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill is designed for broad multi-platform searches across domestic and international services using browser automation, but the overview lacks a clear privacy/network warning. That omission can cause users to unknowingly send sensitive research topics, organization names, or internal project terms to third-party services, creating privacy leakage and operational-security risk.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest says the skill outputs 'HTML 格式的结构化调研报告', but this file repeatedly documents the generated report as Markdown, including an explicit Markdown template and a data flow ending in 'Markdown报告'. That is a direct description-behavior mismatch at the skill-design level rather than an implementation detail.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The overview describes retrieving external content, checking links, backing up important material, and producing output files without clearly warning users about network access, local file writes, retention, or possible copying of third-party content. In a browser-automation skill that searches many external platforms, silent data handling increases privacy, compliance, and unintended persistence risks, especially if user-provided topics contain sensitive internal terms.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The manifest's core principle explicitly says not to use web_fetch and to rely on browser/CDP interactions that mimic human search behavior. This overview, however, gives an extension example using 'api.search(keywords)', which indicates a non-browser retrieval mode inconsistent with the stated browser-only operational model.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The README describes the skill entirely in Chinese and frames the generated research workflow and outputs around Chinese-language usage, while not indicating that users can choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale constraint is explicitly documented and justified.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are very broad, natural-language requests that can easily match ordinary user conversation and invoke the skill unintentionally. In a skill that drives a browser, performs multi-platform searches, and generates reports, accidental activation can cause unintended browsing activity, data collection, and downstream file creation without clear user intent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README states that a report is automatically generated and saved to disk, but it does not warn users about local file creation or describe where outputs go, naming behavior, or overwrite safeguards. In an automated browsing/research skill, silent persistence can leak sensitive search topics, clutter the filesystem, or overwrite existing files if path handling is unsafe in the implementation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill declares no explicit tool scope while the analyzer detected file-writing capability, which creates unnecessary ambiguity about what the skill may do at runtime. In an agent environment, missing permission boundaries can enable unintended file creation or overwrite behavior, especially when the skill also claims broad automation and report generation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs use of the user's logged-in Chrome profile (`chrome-relay`) to access content, but does not clearly warn about the privacy and account-security implications. Reusing an authenticated browser context can expose private account data, session-bound content, browsing state, or cause actions to be attributed to the user on third-party platforms.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The manifest repeatedly states that v4.0 fully abandons web_fetch and uses browser/CDP as the sole mechanism for search and extraction. However, the GitHub diagnostic line explicitly says '仓库搜索+API', which contradicts the stated browser-only approach and indicates a different retrieval method than the documented intent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill automatically opens and snapshots user-supplied links without an explicit warning that external sites will be contacted and their contents processed. This can leak user intent to third-party sites, trigger tracking or authenticated page access, and unexpectedly ingest sensitive content from private or semi-private URLs.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The file's title and all instructional content are in Chinese, and there is no statement offering users an alternate language or clarifying that the guide is intentionally limited to Chinese-speaking users. Under the policy for natural-language issues, forcing a specific language without user opt-in is a reportable locale-policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The HTML root sets `lang="zh-CN"`, which hard-codes the document language/locale to Simplified Chinese. Under the policy criteria, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The manifest explicitly states '不使用 web_fetch，全程使用 browser（CDP 协议）', but the inline diagnostic example text says 'web_fetch API 成功', 'web_fetch 403', and 'web_fetch 返回空'. Because this file is a report template intended to represent how the skill operates, these comments/example outputs actively contradict the documented browser-only intent rather than merely omitting detail.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown template is written entirely in Chinese and defines report headings, labels, and narrative placeholders in Chinese, effectively constraining generated output to a specific language. The file does not offer a language choice or explain a justified region-specific requirement, which matches the language/locale policy violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: This markdown file is entirely written in Chinese and presents the generated report as a fixed-format output, with no indication that users can choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The script’s natural-language interface and generated report content are hard-coded in Chinese, beginning with the module description and continuing throughout user-facing behavior. This creates a locale/language policy issue because the skill does not offer opt-in or any alternative language selection.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The inline comment explicitly states the function should call a real API, yet the code only simulates content. This discrepancy increases the risk that maintainers, reviewers, or operators will misunderstand the behavior and deploy the skill believing it performs authentic collection when it does not.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The technical overview template emitted into the final report is entirely in Chinese and is always used regardless of user preference or topic language. Forcing a specific output language without giving the user a choice matches the language/locale policy violation criteria.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill description promises HTML structured output, but the implementation generates and saves Markdown instead. This is primarily an integrity and contract-mismatch issue: consumers expecting HTML may mis-handle the output, skip sanitization assumptions, or fail integrations built around the declared format.

Intent-Code Divergence

Low

• Confidence: 72% confidence
• Finding: The file presents the skill as production-ready ('状态：Ready for Use'), but the roadmap still lists '接入真实平台API' as a future item. That creates an internal documentation contradiction about whether the described search capability is already implemented or still planned.

Static analysis

No suspicious patterns detected.