uniapp项目分析器 (脚本版)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:45 AM UTC
• Version: 1.0.0

Overview

This appears to be a project-analysis skill, but it has under-scoped local file handling and dependency-install behavior that users should review carefully before running.

Install only if you are comfortable running a local shell-based analyzer over your project and potentially installing skill-seekers from pip. Prefer running it in a sandbox or clean virtual environment, inspect the files selected for analysis yourself, and avoid using it on repositories containing secrets until exclusion handling is fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: analyze-project.sh:157

Finding

Unpinned Third-Party Package Is Automatically Installed and Executed

Content

View full analysis

/dev/null || python3 -m pip install skill-seekers 2>/dev/null; then echo -e "${GREEN}skill-seekers installed successfully!${NC}" return 0 else echo -e "${RED}Automatic installation failed. Please install manually.${NC}" return 1 fi fi fi ``` The installed executable is subsequently invoked: ```bash if $SKILL_SEEKERS_PATH analyze \ --directory "$TEMP_DIR" \ --output "$OUTPUT_PATH" \ --name "$PROJECT_NAME" \ --description "$PROJECT_TYPE project: $PROJECT_NAME"; then ``` ### Technical Analysis The script installs `skill-seekers` from the active pip package index without: - Pinning an audited package version. - Verifying a cryptographic package hash. - Enforcing an expected package repository. - Using a dependency lock file. - Installing into a dedicated isolated environment. - Verifying the provenance of the resulting executable. Python package inst ...[truncated 1884 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: analyze-project.sh:475

Finding

Sensitive-File and Pattern Exclusions Are Not Enforced During Recursive Project Copy

Content

View full analysis

/dev/null; then exclude_list=$(echo "$SKILL_SEEKERS_CONFIG" | jq -r '.exclude.directories[]') for item in "$PROJECT_PATH"/*; do local item_name=$(basename "$item") local exclude=false while IFS= read -r dir; do if [[ "$item_name" == "$dir" ]]; then exclude=true break fi done <<< "$exclude_list" if [[ "$exclude" == false ]]; then if [[ -d "$item" ]]; then cp -r "$item" "$TEMP_DIR/" else cp "$item" "$TEMP_DIR/" fi fi done fi ``` However, the generated configuration contains filename and pattern exclusions: ```bash exclude_dirs=$(echo "$config" | jq -c '.exclude.directories // []') exclude_files=$(echo "$config" | jq -c '.exclude.files // []') exclude_patterns=$(echo "$config" | jq -c '.exclude.patterns // []') include_extensions=$(echo "$config" | jq -c '.file_filters.include_extensions // []') max_file_size=$(echo "$config" | jq -r '.file_filters.max_file_size // 1048576') ``` Sensitive filename exclusions declared in `config/base.json` include: ```json ".env.local", ".env.*.local", ".env.development", ".env.test", ".env.production", ".env.example", ".secret", ".secrets", ".npmrc", ".yarnrc", ".pypirc" ``` ### Technical Analysis The script constructs a configuration containing directory, filename, and pattern exclusions, but the actual staging operation applies only top-level directory-name exclusions. When an accepted top-level directory i ...[truncated 2243 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: analyze-project.sh:272

Finding

Project-Specific, Custom, and Command-Line Security Restrictions Are Silently Ignored

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (34)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description does not accurately represent the supplied code. Most obviously, the code is a Bash script (analyze-project.sh), not a PowerShell script as declared. Its primary function is broader project analysis for uni-app/Vue repositories using skill-seekers, generating outputs like SKILL.md, code_analysis.json, references, and optional project metadata. That is materially different from a narrow 'precise offline statistical analysis' description. Additionally, the script has undeclared capabilities: it can attempt automatic installation of skill-seekers using pip, invokes another analyzer script for code quality, copies project contents into temp directories, renames .vue files for compatibility, and edits generated output. While dependency on skill-seekers is correctly mentioned, the overall declared purpose is incomplete and inaccurate.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

该代码的核心行为是本地静态分析源代码文件并输出代码质量报告，包括文件行数统计、注释率、变量声明风格统计、技术债务扣分，以及 Singleton/Factory/Observer/Module 模式的简单检测。这与“离线分析”有一定重叠，但声明中的关键表述“PowerShell 脚本版”与实际 Bash 实现明显不一致；同时“精确统计”不足以概括其主要用途，因为它还执行质量评分和设计模式识别，主功能更接近代码质量分析器而非单纯统计工具。因此属于描述与行为存在实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill is a PowerShell-based script for precise offline analysis with a dependency on skill-seekers. The supplied code is instead a Python example stub that merely prints a message and includes TODO comments. It does not implement statistical analysis, does not show any interaction with skill-seekers, and its primary purpose is clearly just a placeholder/example script. This is a strong description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

./analyze-project.sh

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md

./analyze-project.sh

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md

./analyze-project.sh

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

./analyze-project.sh

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md

./analyze-project.sh

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

./analyze-project.sh

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

./analyze-project.sh

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

1. 读取 `SKILL.md` 和 `code_analysis.json`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.

md

### 基础配置 (config/base.json)
通用排除规则，适用于所有项目类型：
- 排除目录：node_modules、.git、dist、build、logs 等
- 排除文件：*.log、package-lock.json、.env 等
- 文件大小限制：最大 1MB
- 文件类型白名单：代码文件和文档

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config/base.json (reported line 17)May include surrounding context.

json

".venv",
      "venv",
      "env",
      ".env",
      "dist",
      "build",
      "out",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config/base.json (reported line 62)May include surrounding context.

json

"*.pid",
      "*.seed",
      "*.pid.lock",
      ".env.local",
      ".env.*.local",
      ".env.development",
      ".env.test",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config/base.json (reported line 64)May include surrounding context.

json

"*.pid.lock",
      ".env.local",
      ".env.*.local",
      ".env.development",
      ".env.test",
      ".env.production",
      ".env.example",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config/base.json (reported line 66)May include surrounding context.

json

".env.*.local",
      ".env.development",
      ".env.test",
      ".env.production",
      ".env.example",
      ".secret",
      ".secrets",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config/base.json (reported line 70)May include surrounding context.

json

".env.example",
      ".secret",
      ".secrets",
      ".npmrc",
      ".yarnrc",
      ".pypirc",
      ".gitignore",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises and instructs use of shell/PowerShell execution but does not declare any explicit tool scope such as allowed-tools or permissions. In an agent environment, missing tool constraints can lead to broader-than-expected command execution and make it harder for policy enforcement layers or users to understand that the skill will run local shell commands and manipulate files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation list includes generic phrases such as "分析这个项目", "生成项目文档", "代码审查", and "重构建议", which are common requests that could apply to many non-Vue projects. Although the description elsewhere limits the skill to Vue/uni-app, this trigger section itself lacks sufficient scope constraints or negative examples tied to each phrase, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list contains broad, generic phrases such as project analysis, code review, and documentation generation that overlap with common assistant requests. This can cause the skill to activate in situations where the user did not specifically intend to invoke it, increasing the chance of unintended execution of its analysis scripts or unexpected access to local project content.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · analyze-project.sh (reported line 47)May include surrounding context.

sh

-t, --project-type    Project type: auto|uniapp|vue (default: auto)
  -o, --output-dir      Output directory (default: ./analysis-output)
  --preview             Preview files to be analyzed without running analysis
  -y, --yes             Skip confirmation prompt
  -c, --custom-config   Path to custom configuration file
  --max-file-size       Max file size in MB (default: 1)
  --save-config         Save current settings as user default

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · analyze-project.sh (reported line 67)May include surrounding context.

sh

-t, --project-type    Project type: auto|uniapp|vue (default: auto)
  -o, --output-dir      Output directory (default: ./analysis-output)
  --preview             Preview files to be analyzed without running analysis
  -y, --yes             Skip confirmation prompt
  -c, --custom-config   Path to custom configuration file
  --max-file-size       Max file size in MB (default: 1)
  --save-config         Save current settings as user default

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script is presented as an offline project analyzer, but it can invoke pip/python3 -m pip to install skill-seekers from the network. That introduces outbound network activity and local package installation, which expands trust boundaries and creates supply-chain and environment-modification risk inconsistent with the stated offline purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Automatic package installation is not necessary to analyze local files and causes the script to change the host environment. For a tool whose purpose is offline analysis, silently coupling analysis with dependency installation increases the chance of unintended code execution via package managers or compromised upstream packages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

When the script is run in a mode intended to skip prompts, it can still perform package installation and network access without a dedicated warning gate. In automation or CI contexts, that can lead to unexpected system modification, dependency drift, and execution of unreviewed third-party install code.

Content

No source excerpt is available for this finding.