Hekouwang Yandu Deck Skill

• Outcome: Review
• Latest audit: Jul 15, 2026 · 9:58 AM UTC
• Version: 1.2.0

Overview

This appears to be a real deck-building skill, but it can publish to a live Cloudflare Pages site and mutate the local environment in ways users should review first.

Install only if you intend to build and publish this specific YanDu DECK site. Prefer `--build-only` first, review `CF_PROJECT`, `wrangler.toml`, D1 settings, and comment/analytics behavior, and install Wrangler yourself rather than letting the script perform a global npm install.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return None
    print("\n📥 未检测到 Wrangler,自动安装:npm i -g wrangler …")
    try:
        subprocess.run(["npm", "i", "-g", "wrangler"], check=True)
    except subprocess.CalledProcessError:
        print("⚠️  Wrangler 安装失败,请手动 `npm i -g wrangler`。")
        return None

• Confidence: 84% confidence
• Finding: subprocess.run(["npm", "i", "-g", "wrangler"], check=True)

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The script silently injects a full interactive comment widget into every generated deck page, which materially expands the published site's attack surface beyond the stated build/publish function. In this skill context, hidden feature expansion is security-relevant because it introduces new client-side code paths and a backend dependency (/api/comments, D1, Pages Functions) that operators may not expect or review before deployment.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The documentation says deployment targets keynote.pages.dev, but the code actually targets the hekouwang Cloudflare Pages project. This mismatch is dangerous because operators may deploy to the wrong production destination, unintentionally overwriting or publishing content to a live site they did not mean to modify.

Intent-Code Divergence

Low

• Confidence: 83% confidence
• Finding: The CLI help text claims deployment goes to Cloudflare Pages / keynote, while runtime behavior deploys to the hekouwang project. This inconsistency can mislead users during execution and increase the chance of accidental deployment to the wrong site, especially because deployment is the default behavior.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The README advertises broad natural-language trigger phrases such as "turn this into a deck" and "publish to hekouwang," which can cause the skill to auto-load in contexts beyond the author's intent. In an agentic environment, overly generic activation phrases increase the chance of unintended invocation, leading to accidental publishing or file-modifying workflows being surfaced when a user only meant a general request.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README advertises one-click publishing to a live Cloudflare Pages site without prominently warning that this affects an external production-like service. In an agent context, this can increase the chance that a user or model treats deployment as a routine local action and unintentionally pushes content or changes to a public site.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Presenting the `python3 publish.py` command as a simple one-step action without a nearby caution about remote deployment makes it easy for an agent or operator to execute it without appreciating that it pushes changes to Cloudflare Pages. In this skill's context, that could lead to accidental public release, site defacement, or overwriting existing content.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document describes collecting visitor comments and deriving a salted hash from client IP addresses for rate limiting, but it does not mention any user-facing notice, retention policy, or consent/disclosure mechanism. Even though raw IPs are not stored, the hash is still derived from personal data and may trigger privacy and compliance obligations depending on jurisdiction.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script injects Cloudflare Web Analytics into every generated page without any user-facing disclosure, consent flow, or clear opt-in by the operator. In a publishing skill, this is sensitive because it silently adds third-party tracking code to all outputs, creating privacy/compliance exposure and surprising operators who may believe the tool only builds static pages.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.