ClawHub
Back to skill

Security audit

pentest-lyan

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed web penetration-testing skill, but it needs Review because it can run intrusive tests from a target URL alone and stores unredacted credentials in ordinary project/report files.

Install only for targets where you have explicit written authorization, a defined scope, and an agreed test window. Before using it, add pentest-data to .gitignore, avoid committing or syncing generated state and reports, prefer redacted reports, encrypt any raw evidence that must retain credentials, and revoke test sessions after delivery. Review or modify the workflow so active testing, destructive/state-changing checks, sensitive path probes, and dependency installation require clear user approval.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
gates.md:7
Finding

Active penetration testing begins without verifiable authorization or a hard scope gate

Content
View full analysis

Vulnerability Details

File Location: gates.md:7-13
Vulnerability Type: Authorization and scope-control failure
Risk Level: High

Evidence

text
## Authorization Prerequisite

This Skill is only intended for authorized security testing. Invoking
`/pentest-lyan <target>` is treated as confirmation that the user has legal
authorization for the target.

Scope soft rule: all requests should use the same origin as `base_url`.
Redirects to other domains, external links, and CDNs should not be followed.

Compliance responsibility is assigned to the user.

The source explicitly treats submission of a target as confirmation of authorization and describes same-origin enforcement as a soft rule rather than a blocking control.

Technical Analysis

The Skill performs active endpoint enumeration, sensitive-path probing, authenticated cross-role access tests, parameter manipulation, state-transition testing, SQL-injection timing tests, and concurrent requests. These operations can alter application state or access private data.

A target URL alone does not establish that the requester owns the target or is authorized to perform intrusive testing. No mandatory gate requires an authorization statement, approved host list, test window, allowed techniques, rate limit, or prohibited operations before active requests begin.

Although the Skill tells the Agent not to follow external redirects, this is only a model-enforced instruction. There is no programmatic URL canonicalization or request wrapper that rejects a different scheme, host, port, or resolved destination.

Attack Path

  1. A user invokes the Skill with a third-party URL.
  2. The Skill treats invocation as sufficient authorization.
  3. Discovery probes sensitive endpoints such as /.env, /.git/config, backup files, and debugging interfaces.
  4. The Skill logs in where credentials are available and sends authenticated requests across discovered endpoints.
  5. Attack-stage instruction ...[truncated 834 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require an explicit authorization declaration before sending active requests, including the organization, approved targets, test window, and responsible contact.
  2. Require an allowlist of exact schemes, hostnames, ports, and optional path prefixes.
  3. Turn same-origin enforcement into a hard gate. Canonicalize every URL and reject requests outside the allowlist before invoking curl, browser automation, or other network tools.
  4. Disable automatic redirect following and validate every redirect destination before proceeding.
  5. Resolve hostnames and block loopback, link-local, private, metadata-service, and unexpected internal addresses unless explicitly authorized.
  6. Require separate approval for destructive or high-impact techniques, including payment operations, privilege changes, bulk access, SQL timing payloads, and concurrent write testing.
  7. Record authorization and scope metadata in project state and refuse to continue if it is missing or expired.

T09 · Insecure Skill Coding Practices

Error
Location
.gitignore:1
Finding

Session credentials are persisted in plaintext without default repository exclusion

Content
View full analysis

Vulnerability Details

File Location: .gitignore:1-10, SKILL.md:159-167, schema/sessions_pool.schema.json:17-23
Vulnerability Type: Plaintext credential storage and unsafe repository configuration
Risk Level: High

Evidence

The active repository ignore file contains:

gitignore
/.playwright-mcp
/captcha.png
/captcha2.png
/captcha_fresh.png
/captcha_login.png
/captcha_login2.png
/captcha_now.png
/pentest-report
/pentest.zip
/pentestfile

It does not exclude pentest-data/, even though the Skill requires session data to be stored there. The session schema requires a non-empty plaintext cookie value:

json
"required": [
  "role",
  "username",
  "role_level",
  "session_file",
  "cookie_value",
  "status"
],
"cookie_value": {
  "type": "string",
  "minLength": 1,
  "description": "Raw cookie string used directly for cross-role fetch/curl requests"
}

A safer ignore rule exists only in templates/.gitignore and must be copied manually:

gitignore
pentest-data/
pentest-report/
*.token
*.cookies

Technical Analysis

The Skill persists reusable cookies and tokens in project files to support session recovery and cross-role testing. These values are bearer credentials: possession may be sufficient to impersonate the associated account until the session expires or is revoked.

The default .gitignore protects report output but not the pentest-data/ directory where the sensitive state is written. The separate template does not protect users who install and invoke the Skill without manually replacing or merging their workspace ignore rules.

Cleanup is deferred until after report delivery and is presented as a recommendation. There is no encryption, restrictive permission setup, automatic expiry, secure deletion, or pre-commit enforcement.

Attack Path

  1. The Skill authenticates to the target with a supplied account.
  2. It writes the session cookie or token to pentest-data/{project-id}/sessions/.
  3. The active ` ...[truncated 711 chars]
Remediation
View remediation

Remediation Suggestions

  1. Add /pentest-data/ to the active project .gitignore, rather than relying on a manually copied template.
  2. Avoid storing raw bearer credentials where possible. Use operating-system credential storage or references to an external secret manager.
  3. If resumable state is required, encrypt credential files with a user-controlled key that is not stored in the project.
  4. Create session files with owner-only permissions and verify permissions before writing.
  5. Store only the minimum required cookie fields and avoid duplicating the same secret in both pool and account files.
  6. Revoke or invalidate test sessions automatically when testing finishes.
  7. Implement automatic cleanup with an explicit opt-in retention mode, rather than merely advising users to delete files later.
  8. Add secret-scanning and pre-commit checks for cookie_value, Authorization, bearer tokens, and session files.

T09 · Insecure Skill Coding Practices

Error
Location
references/report-template.md:117
Finding

Generated reports intentionally retain complete credentials and personal data

Content
View full analysis

Vulnerability Details

File Location: references/report-template.md:117-121
Vulnerability Type: Sensitive-data exposure in generated artifacts
Risk Level: High

Evidence

text
### Packet Format

- Requests must use raw Burp Suite HTTP request format.
- Do not redact: reports retain complete credentials, including cookies, tokens,
  and phone numbers, because they are needed for reproduction. Redaction is
  deferred to the delivery process through encryption or internal transfer.
- Mark important parameters explicitly.
- Include multiple packets for chained vulnerabilities.
- Authorization issues must include baseline and attack requests.

The post-delivery instructions further state that generated DOCX files contain complete requests and authorization headers, while encryption or internal transfer is advisory rather than technically enforced.

Technical Analysis

The reporting workflow deliberately copies live cookies, bearer tokens, authorization headers, phone numbers, response bodies, and concrete object identifiers into persistent Markdown and DOCX files.

Reproducibility does not generally require reusable secrets. A report can preserve request structure while replacing credentials with controlled placeholders and retaining separately encrypted evidence only where necessary.

The renderer writes ordinary files without encryption or access-control enforcement. The workflow retains the full Markdown report and DOCX deliverable after deleting only a temporary Markdown file. Consequently, sensitive values are duplicated across state files and report artifacts.

Attack Path

  1. The Skill captures complete authenticated requests and responses during testing.
  2. Reporting instructions require credentials and personal data to remain unredacted.
  3. The data is written into persistent Markdown and DOCX files.
  4. A report is emailed, uploaded, synchronized, archived, or shared through an insufficiently protected channel.
  5. A recipi ...[truncated 607 chars]
Remediation
View remediation

Remediation Suggestions

  1. Redact cookies, tokens, passwords, phone numbers, and unrelated personal data by default.
  2. Replace live credentials with named placeholders such as REDACTED_ADMIN_SESSION.
  3. Preserve only the minimum request and response fragments needed to demonstrate the vulnerability.
  4. Store raw evidence in a separate encrypted evidence archive with a restricted recipient list and retention period.
  5. Require encryption before writing or exporting any artifact containing secrets, rather than recommending encryption after generation.
  6. Add automated detection that blocks report generation when unredacted Authorization, Cookie, token, or credential patterns remain.
  7. Revoke all sessions represented in evidence before delivery.
  8. Apply owner-only file permissions and document a mandatory deletion schedule.

T08 · Insecure Dependencies

Warning
Location
references/docx-template.md:63
Finding

Report generation installs an unpinned package from the active Python package index

Content
View full analysis

Vulnerability Details

File Location: references/docx-template.md:63-64
Vulnerability Type: Unpinned runtime dependency installation
Risk Level: Medium

Evidence

text
2. Run:
   python3 scripts/render_docx.py pentest-report/{project-id}-deliverable-tmp.md
   pentest-report/{project-id}-{system-name}-pentest-{YYYYMMDD}.docx
3. If python-docx is not installed, run:
   pip3 install python-docx

The same fallback installation instruction appears in references/post-delivery.md:46.

Technical Analysis

The Skill directs the Agent to install the latest package selected by the active Python package index and resolver. No version, artifact hash, lock file, approved index, or isolated environment is specified.

Although python-docx is a legitimate package name and no malicious dependency is embedded in the repository, unpinned installation creates supply-chain risk. The effective code can change after the Skill has been reviewed. A compromised package release, package index, mirror, DNS path, or local pip configuration could introduce arbitrary installation-time or import-time behavior.

Installation into the Agent's current environment may also alter shared dependencies used by unrelated tasks.

Attack Path

  1. DOCX rendering is requested on a system without python-docx.
  2. The Agent follows the Skill instruction and runs pip3 install python-docx.
  3. pip resolves the package and transitive dependencies from its configured index without hash verification.
  4. A compromised artifact or index response is installed.
  5. Package code executes during installation or when render_docx.py imports docx.
  6. The malicious package receives the Python process's local file and network permissions.

Impact Assessment

A compromised dependency could read testing credentials, reports, environment variables, and other files available to the Agent; alter generated reports; or make network requests using the host's access.

The attainabl ...[truncated 124 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin python-docx and all transitive dependencies to reviewed versions.
  2. Provide a lock file containing cryptographic hashes and install with hash verification.
  3. Use an isolated virtual environment dedicated to the Skill.
  4. Install only from an approved package index or a verified internal artifact repository.
  5. Move dependency installation to an explicit setup phase requiring user approval; do not install packages automatically during report generation.
  6. Document the required Python and dependency versions and test them in continuous integration.
  7. Consider distributing a reproducible, signed environment or container for rendering.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/render_docx.py:391
Finding

Markdown image references can embed arbitrary readable local image files into DOCX reports

Content
View full analysis

Vulnerability Details

File Location: scripts/render_docx.py:391-405
Vulnerability Type: Unrestricted local file access through absolute paths and directory traversal
Risk Level: Medium

Evidence

python
# Image: standalone ![alt](path), relative to the source Markdown directory
img_m = re.match(r'^!\[([^\]]*)\]\(([^)]+)\)$', stripped)
if img_m:
    img_path = img_m.group(2).strip()
    if not os.path.isabs(img_path):
        img_path = os.path.join(os.path.dirname(os.path.abspath(SRC)), img_path)
    if os.path.exists(img_path):
        try:
            doc.add_paragraph().paragraph_format.space_after = Pt(2)
            doc.add_picture(img_path, width=Cm(15))
            cap = img_m.group(1).strip()
            if cap:
                cp = doc.add_paragraph()

The renderer accepts absolute paths. Relative paths are joined to the source directory but are not canonicalized or checked against an approved root, so ../ traversal remains possible.

Technical Analysis

The image path is controlled by Markdown content. The renderer verifies only that the path exists before passing it to python-docx. It does not reject absolute paths, resolve and constrain paths to a report-assets directory, prevent symbolic-link escape, or impose file-size limits.

The practical file formats are limited by the image formats supported by python-docx, so this is not an unrestricted arbitrary-text file read. However, any readable local file recognized as an image can be copied into the resulting DOCX package.

This matters when Markdown is generated from untrusted or insufficiently reviewed content, or when target-controlled text is incorporated into the report.

Attack Path

  1. An attacker influences report Markdown or causes a crafted image reference to be inserted.
  2. The reference uses an absolute path or traversal, such as ../../private/screenshot.png.
  3. The renderer resolves the path outside the intended report directory.
  4. `os.path.exi ...[truncated 604 chars]
Remediation
View remediation

Remediation Suggestions

  1. Define a dedicated report-assets directory and allow images only from that directory.
  2. Reject absolute image paths.
  3. Resolve paths with realpath or Path.resolve() and verify that the resolved path remains beneath the approved root.
  4. Resolve and validate symbolic links before opening files.
  5. Permit only an explicit set of image extensions and verify file signatures rather than trusting extensions.
  6. Enforce maximum file dimensions and size before parsing.
  7. Copy approved assets into a controlled staging directory and render only from that directory.
  8. Reject or require manual approval for image references originating from target-controlled content.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (61)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The README states that simply invoking the skill is treated as authorization, explicitly removing the need to confirm scope, timing window, or production approval. In a pentesting skill, this is dangerous because it encourages the agent to perform intrusive security testing without verifying that the requester actually has authority over the target, increasing the risk of unauthorized access attempts against third-party systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation defaults to permitting pentesting once a target is supplied, without warning that authorization must be explicit and validated. Because this skill is designed to drive active web security testing, that omission materially lowers safeguards and can normalize misuse for unauthorized assessments.

Content

No source excerpt is available for this finding.

Ssd 1

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The README semantically grants blanket authorization by saying scope, time window, and production designation do not need to be declared and that issuing the command counts as authorization. In the context of an offensive security skill, this makes the skill substantially more dangerous because it bypasses the core safety control that should separate legitimate assessment from unauthorized penetration testing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

声明描述的是一个面向 Web 安全测试的技能，应当包含对目标 Web 应用进行评估、可能的状态结构校验，以及按功能汇总测试威胁的逻辑。但提供的代码完全没有网络请求、扫描、测试、目标 URL 处理、漏洞验证或 JSON Schema 校验相关行为。相反，它只是使用 python-docx 将本地 Markdown 报告渲染为 Word 文档，附带封面、页眉页脚、漏洞汇总表、严重级别配色、代码块/图片/表格排版等报告生成功能。虽然注释和字段提到“渗透测试报告”，但那只是报告内容的呈现，不是执行渗透测试本身。因此代码的实际主用途与声明的技能用途存在明显且实质性的偏差。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly states that a user's request is treated as sufficient proof of authorization for penetration testing. That removes a critical safety check and makes it easy to use the skill for unauthorized testing against third-party targets while still appearing policy-compliant.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The hard-gate section repeats the unsafe rule that the user's request alone confirms authorization. Repetition in a control section makes this more dangerous because it operationalizes the bypass as a mandatory workflow rule rather than an incidental wording issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs storage of session cookies and account data in project files, but does not prominently warn at the point of use that these are sensitive secrets with takeover value. If those files are exposed through logs, backups, version control, or shared workspaces, an attacker could hijack sessions or reuse credentials.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill directs the agent to persist session cookies and plaintext account credentials across runs in project files. These artifacts are effectively authentication secrets; persisting them broadly increases the blast radius of accidental disclosure and enables session hijacking, account compromise, and lateral misuse.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The workflow explicitly instructs probing for high-value credential and secret locations such as /.env, /.git/config, backup.zip, db.sql, and actuator/env. While such checks can be relevant in authorized assessments, embedding them as unconditional discovery behavior increases the chance of collecting credentials or sensitive configuration outside the minimal necessary scope.

Content

Scanner excerpt · references/discovery-guide.md (reported line 101)May include surrounding context.

  1. 公共路径探测：无论业务类型，都探测：
    text
    /.env  /config.php  /phpinfo.php  /info.php
/api/  /swagger.json  /swagger-ui.html
/.git/config  /backup.zip  /db.sql
/actuator  /actuator/env  /_debug  /debug

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The template instructs execution of a shell deletion command containing unquoted placeholders such as {project-id}. If those values are attacker-controlled or improperly validated, they can trigger path traversal, shell metacharacter injection, or deletion of unintended files, especially because the command is presented as an automatic cleanup step.

Content

Scanner excerpt · references/docx-template.md (reported line 65)May include surrounding context.

md
1. 按上述结构写交付件内容,Write 成临时 `pentest-report/{project-id}-deliverable-tmp.md`(首部必须 `# 标题` + `>` 引用块 + `---`)
2. 执行 `python3 scripts/render_docx.py pentest-report/{project-id}-deliverable-tmp.md pentest-report/{project-id}-{系统名}-pentest-{YYYYMMDD}.docx`
3. `python-docx` 未安装先 `pip3 install python-docx`
4. 确认 `SAVED` 后删除临时 md:`rm pentest-report/{project-id}-deliverable-tmp.md`
5. 最终 pentest-report/ 留:完整报告 `.md` + 交付件 `.docx`

渲染脚本位置:`scripts/render_docx.py`。

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High
Category
YARA Match
Confidence
70% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/post-delivery.md (reported line 33)May include surrounding context.

md
] 文件名规范 `{project-id}-{系统名}-pentest-{YYYYMMDD}.md`,保留不删
- [ ] md 首部 `# 标题` + `>` 引用块(目标/系统/测试时间/测试方法) + `---`
- [ ] 每个功能都列出 threat_model + 测试结果(`threats_total=0` 也要写"无威胁面"+note)
- [ ] 每个 confirmed 漏洞有 feature_id + feature_name + access_path + CVSS 评分 + 修复建议
- [ ] 数据包 **BurpSuite 原始 HTTP 格式**,关键参数 `【】` 标注;越权类 baseline vs attack
- [ ] 等级按「写作规范」判定标准(risk_level + cvss)
- [ ] 测试设定(规律码/弱口令/Mock)与纯配置项 **不在** confirmed_vulns
- [ ] 盲区清单状态只用 BLOCKED/NEEDS/N/A
- [ ] `page_coverage` 已填,未触发的页面/功能均有 BLOCKED 原因
- [ ] 无"部分覆盖"、"基本完成"等模糊词

**docx 交付件自检**:

- [ ] 交付件只含:封面 + 每漏洞(概要/影响/漏洞复现/修复建议);**无**覆盖率/账号矩阵/功能明细/系统级审计/参

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High
Category
YARA Match
Confidence
70% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/report-template.md (reported line 83)May include surrounding context.

md
� / 调试端点 / 版本泄露 / Console / WAF 各项发现

## 4. 漏洞统计概览
   - 按风险等级统计
   - WAF 防护效果

## 5. 漏洞详情(每个 confirmed 漏洞)
   - 编号(VULN-xxx)/ 类型(沿用 threat_model 中的 vuln_type)/ 等级 / CVSS 量化评分
   - 模块 + 功能点名称 + feature_id
   - access_path(完整访问链)
   - 复现步骤(每步附 URL + **BurpSuite 原始 HTTP 请求包** + 响应包;关键参数用 `【】` 标注)
   - PoC 与证据(越权类必须 **baseline vs attack 对比**)
   - 业务影响(**量化**:影响用户量级 / 可遍历 ID 范围 / 可造成最大危害)
   - 修复建议(**短期止血** + **长期加固**)

   **本节严格排除**:CORS 配置 / Host 头 / 缓存投毒 / HTTP 请求走私 / 安全响应头缺失 / 其他请求响应头配置不当。这些统一在第 3 节系统级审计里描述。

## 6. 攻击链(如适用)

## 7. 高可疑点
   - 类型 / 位置 / 当前证据 / 缺失条�

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The template explicitly instructs report authors to include full credentials, cookies, tokens, and phone numbers without masking. That creates a direct secret-handling and privacy risk: the generated report becomes a high-value container of reusable authentication material and personal data that could enable account compromise, lateral movement, or secondary disclosure if the file is accessed by unauthorized parties.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document directs persistent storage of sensitive authentication data and user identifiers in the report itself, increasing the chance of long-term exposure through file sharing, backups, indexing, or downstream conversion to DOCX. In the context of a pentest skill, reports are likely to circulate among internal teams and clients, so embedding unmasked secrets materially increases the blast radius of any mishandling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The README is written as if the skill operates in Chinese and does not indicate that users may choose another language or locale. That can violate language/locale policy when a skill imposes a specific language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
77% confidence
Finding

The natural-language instructions are written as mandatory operational guidance in Chinese, and the skill metadata/description does not offer a language or locale choice for users. This can violate language/locale policy when a skill effectively constrains interaction or outputs to a specific language without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill permits destructive actions such as deleting test-created data to validate functionality, but it does not present a strong upfront warning about operational impact or require explicit confirmation before performing such actions. In a live environment, even scoped destructive testing can cause service disruption, data loss, or confusion if not tightly controlled.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The workflow leaves credential files in place until a later manual cleanup prompt, which increases the window in which sensitive material can be exposed. Delayed or forgotten cleanup is common, so this design creates unnecessary residual secret retention risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The document states operational instructions entirely in Chinese and explicitly says checks are performed by the model itself, with no indication that the user may choose another language or locale. This creates a natural-language policy issue because the skill effectively imposes a fixed language without documenting user choice or a justified locale restriction.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · gates.md (reported line 23)May include surrounding context.

md
**判定逻辑**(账号不足不阻塞,降级放行):

| 账号情况          | 处置                                                                                                                                                                                 |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `≥2` 个账号    | 正常进入阶段 2                                                                                                                                                                       |
| `0 或 1 个账号` | **不阻塞**。`state.json` 记 `session_pool_limitation`(`single_account` / `no_account`),正常进行测试。Discovery 探测是否存在注册页 → 阶段 3 报告时提示用户注册补全账号 |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · gates.md (reported line 122)May include surrounding context.

md
**判定逻辑**(账号不足不阻塞,降级放行):

| 账号情况          | 处置                                                                                                                                                                                 |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `≥2` 个账号    | 正常进入阶段 2                                                                                                                                                                       |
| `0 或 1 个账号` | **不阻塞**。`state.json` 记 `session_pool_limitation`(`single_account` / `no_account`),正常进行测试。Discovery 探测是否存在注册页 → 阶段 3 报告时提示用户注册补全账号 |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · gates.md (reported line 25)May include surrounding context.

md
| 账号情况          | 处置                                                                                                                                                                                 |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `≥2` 个账号    | 正常进入阶段 2                                                                                                                                                                       |
| `0 或 1 个账号` | **不阻塞**。`state.json` 记 `session_pool_limitation`(`single_account` / `no_account`),正常进行测试。Discovery 探测是否存在注册页 → 阶段 3 报告时提示用户注册补全账号 |

`role_level` 由用户在启动时显式声明,不从用户名推断。

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · gates.md (reported line 120)May include surrounding context.

md
报告前 `js_analysis.channels_covered` 须含全部六项:

| 渠道               | 要求                                                                                                                                                                                                                            |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `js_ref`         | 所有独立 .js 的 fetch/jsonPost/axios 调用已提取                                                                                                                                                                                 |
| `inline_script`  | **每个抓取 HTML 页面的内联 `<script>`** 已解析(漏读内联脚本是漏接口的首要原因)                                                                                                                                          |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · gates.md (reported line 123)May include surrounding context.

md
| 渠道               | 要求                                                                                                                                                                                                                            |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `js_ref`         | 所有独立 .js 的 fetch/jsonPost/axios 调用已提取                                                                                                                                                                                 |
| `inline_script`  | **每个抓取 HTML 页面的内联 `<script>`** 已解析(漏读内联脚本是漏接口的首要原因)                                                                                                                                          |
| `asset_ref`      | 每个 `<script src>`/`<link>` 引用资产已抓取;**src 相对其所在页面解析**(页面在 `/admin/login.php` 引 `js/config.js` → 取 `/admin/js/config.js`,不是按全局 base 取,404 时换 base 重试);资产内容 grep `access_key |
| `page_link`      | 导航/页内链接的页面(**页面本身,不止 API**)已纳入权限矩阵(页面级越权)                                                                                                                                                      |
| `path_inference` | 路径推断候选(batch→单品、list→export/-count、create→submit/cancel、复数→单数记录接口)已批量探活                                                                                                                             |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · gates.md (reported line 125)May include surrounding context.

md
| `js_ref`         | 所有独立 .js 的 fetch/jsonPost/axios 调用已提取                                                                                                                                                                                 |
| `inline_script`  | **每个抓取 HTML 页面的内联 `<script>`** 已解析(漏读内联脚本是漏接口的首要原因)                                                                                                                                          |
| `asset_ref`      | 每个 `<script src>`/`<link>` 引用资产已抓取;**src 相对其所在页面解析**(页面在 `/admin/login.php` 引 `js/config.js` → 取 `/admin/js/config.js`,不是按全局 base 取,404 时换 base 重试);资产内容 grep `access_key |
| `page_link`      | 导航/页内链接的页面(**页面本身,不止 API**)已纳入权限矩阵(页面级越权)                                                                                                                                                      |
| `path_inference` | 路径推断候选(batch→单品、list→export/-count、create→submit/cancel、复数→单数记录接口)已批量探活                                                                                                                             |
| `response_body`  | 运行时响应体里出现的新接口/参数由 Attack 阶段追加                                                                                                                                                                               |

Static analysis

No suspicious patterns detected.