别整乱七八糟的原型

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:05 AM UTC
• Version: 2.3.3

Overview

The skill appears intended for prototype analysis, but its URL downloader can be tricked into reaching private network addresses despite claiming internal URLs are blocked by default.

Install only if you are comfortable reviewing and constraining its network access. Run it in an isolated environment, avoid analyzing untrusted URLs, disable redirects or restrict outbound access if possible, use --allow-internal only for URLs you control, do not feed sensitive screenshots to optional vision workflows, and treat generated API/database specs as draft suggestions that need human review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/url-prototype-analyzer.sh:111

Finding

SSRF Protection Can Be Bypassed Through DNS Resolution and HTTP Redirects

Content

View full analysis

"$output_file" 2>/dev/null; then log_info "网页内容已保存到: $output_file" return 0 else log_error "下载网页失败" log_error "请检查URL是否可访问，或是否需要认证" return 1 fi else log_info "使用缓存的网页内容: $output_file" return 0 fi } ``` The downloader is initialized with redirect following enabled: ```bash DOWNLOADER="curl -sL" ``` ### Technical Analysis The URL validator only compares the literal hostname against a regular expression. It does not resolve the hostname and inspect the resulting ...[truncated 2120 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/xmind-analyzer.py:48

Finding

Unbounded XMind Archive Decompression and Parsing Can Exhaust Resources

Content

View full analysis

bool: """加载XMind文件""" try: self.zip_file = zipfile.ZipFile(self.xmind_path, 'r') return True except Exception as e: print(f"加载XMind文件失败: {e}") return False def extract_content(self) -> bool: """提取XMind内容""" if not self.zip_file: return False try: # XMind文件结构 # - content.xml (XMind 8格式) # - content.json (XMind 2020+格式) # - manifest.xml # 尝试读取JSON格式（新版本） if 'content.json' in self.zip_file.namelist(): content_json = self.zip_file.read('content.json').decode('utf-8') self.content = json.loads(content_json) return True # 尝试读取XML格式（旧版本） if 'content.xml' in self.zip_file.namelist(): content_xml = self.zip_file.read('content.xml').decode('utf-8') self.content = self._parse_xml_content(content_xml) return True # 某些XMind版本使用其他命名 for name in self.zip_file.namelist(): if name.endswith('.json') and 'content' in name: content_json = self.zip_file.read(name).decode('utf-8') self.content = json.loads(content_json) return True if name.endswith('.xml') and 'content' in name: content_xml = self.zip_file.read(name).decode('utf-8') self.content = self._parse_xml_content(content_xml) return True print("未找到有效的XMind内容文件") return False except Exception as e: print(f"解析XMind内容失败: {e}") return False def _parse_xml_content(self, xml_content: str) -> Dict[str, Any]: """解析XML格式的XMind内容""" root = ET.fromstring(xml_content) result = {} ``` ### Technical ...[truncated 1815 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:4

Finding

Mutable Dependency Ranges Prevent Reproducible and Verifiable Installation

Content

View full analysis

=4.12.0 # HTML解析 Pillow>=10.0.0 # 图片处理（基础分析） ``` The installation documentation also instructs users to install dependencies without fixed versions: ```bash pip install beautifulsoup4 pillow lxml ``` ### Technical Analysis The use of open-ended `>=` constraints permits future package releases to be installed without review. The documented installation command is even less restrictive and includes `lxml`, which is not an active requirement in `requirements.txt`. No hashes or lockfile are provided to verify downloaded artifacts. As a result, installations performed at different times can execute materially different dependency code. This is not evidence that any currently named package is malicious. The risk arises from non-reproducible dependency resolution, future compromised releases, incompatible updates, or differences between the dependency manifest and installation instructions. ### Attack Path 1. A user follows the documented installation procedure or runs `pip install -r requirements.txt`. 2. The package index resolves the newest versions satisfying the mutable constraints. 3. A future compromised, malicious, or incompatible release is downloaded. 4. Package installation or later import executes unreviewed code in the user's environment. 5. That code receives the privileges of the user running the Skill. ### Impact Assessment The maximum impact depends on a compromised or unsafe dependency release. Python packages and build backends can execute code during installation and import, potentially obtaining: - The current user's filesystem access. - Environment variables available to the installation process. - Network access available to the runtime. - Modification rights within the activ ...[truncated 259 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (41)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a comprehensive prototype analysis and technical document generation skill with multi-format input support and inference capabilities. The supplied code chunk does not implement those behaviors. It is a narrow support module containing CSS selector configuration for different UI frameworks and simple accessors. While such a config file could be part of a larger HTML extraction system, this chunk by itself only supports HTML element location and does not perform the main declared functions. Therefore the description materially overstates what this code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

代码的大部分核心能力与描述高度一致，尤其是HTML原型结构提取、技术实现推断、数据库/API/路由生成、状态枚举、ER关系推断，以及交互式业务分析/问题生成功能，均有明确实现。因此其主目的基本匹配声明。 但描述中明确宣称支持四种输入类型（URL、本地HTML、图片、XMind），而本代码片段仅实现对传入HTML字符串的解析，url参数只用于报告展示，不包含网络抓取；也没有看到本地文件读取、图片识别/OCR、XMind解析逻辑。这属于对外宣称的能力超出实际代码行为的情形，构成描述与行为不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

描述与代码存在明显且实质性的不一致。代码范围远窄于声明：它只覆盖“图片输入”这一子场景，且分析能力也很基础，核心识别逻辑大量以占位符形式存在，明确写明需要外部视觉模型/OCR 才能实现精确分析。更重要的是，声明中的关键输出目标——技术规范生成、接口设计、数据库设计、ER 图、状态枚举、业务流程分析——在代码中均不存在。因此这不是轻微的实现差距，而是主用途和能力层面的显著不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明描述的是一个端到端原型分析与技术规格生成技能，重点在于多种原型输入的解析、信息抽取和智能推断。而提供的代码只覆盖了流程后半段：接收已整理好的 analysis_data，生成文档文本。它依赖输入 JSON 中预先存在的 forms、navigation、interactive_elements、identified_components 等字段，说明解析工作应由其他模块完成，但在该代码片段中并不存在。代码还能从 references 目录加载模板内容并填充 API/数据库/ER 图等章节，这些章节很多是静态或半静态参考内容，不足以支撑“增强版智能推断、完整数据库表结构设计、状态枚举定义、交互式业务分析”等强声明。因此该代码片段与声明能力存在明显不匹配；虽然它与“生成技术文档”这一子能力相关，但远不足以代表所宣称的完整技能。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

描述与代码存在明显不一致。代码的核心用途确实与“原型分析并生成文档”方向相关，但就本片段可见行为而言，它只是一个 URL/本地 HTML 原型分析主脚本，主要负责输入识别、URL/路径安全验证、下载 HTML、调用外部 Python 脚本提取结构并生成输出。声明中提到的图片原型、XMind 文件、交互式业务分析、业务流程/状态流转确认，以及完整数据库/ER 图/状态枚举/智能推断等增强能力，都没有在该代码片段中体现。由于声明的输入范围和能力范围显著大于代码实际展示的行为，应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

声明描述的是一个覆盖多种原型输入、并能生成较完整技术规范的综合型原型分析技能；而代码片段的实际功能明显更窄，只处理XMind文件，解析其节点结构并做基于关键词的启发式分类。虽然Markdown输出中包含“路由规划”“API接口规划”“数据库表设计建议”等内容，但这些只是根据XMind节点名称生成的简单模板建议，远未达到声明中的“完整技术文档”“完整数据库表结构设计”“实体关系图”“状态流转分析”等能力。代码也没有任何HTML、URL、图片处理逻辑，更没有交互式确认流程。因此描述与实际行为存在显著不匹配，且代码的主要目的已从“综合原型转技术规范”收缩为“XMind脑图分析与简单推断”。

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 353)May include surrounding context.

md

- `extractor.py` - 核心解析器

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 354)May include surrounding context.

md

- `analyzer.py` - 业务流程分析器（v3.0 新增）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/sample-output/sample-user-management.md (reported line 534)May include surrounding context.

md

- **权限**: `user:update` 或自己的信息

#### 4.2.2 删除用户接口
- **URL**: `DELETE /api/v1/users/{id}`
- **权限**: `user:delete` 或 `admin` 角色
- **注意**: 软删除，标记is_deleted=true

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/sample-output/sample-user-management.md (reported line 776)May include surrounding context.

md

### 8.1 安全性
- 所有用户输入必须进行XSS过滤和SQL注入防护
- 密码使用bcrypt算法加密存储，强度至少12轮
- JWT令牌设置合理过期时间（access token: 15分钟，refresh token: 7天）
- 敏感操作（删除、修改权限）需要二次确认
- 登录失败次数限制和账户锁定机制

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-design.md (reported line 52)May include surrounding context.

md

GET    /api/v1/users/{id}     # 获取指定用户
PUT    /api/v1/users/{id}     # 全量更新用户
PATCH  /api/v1/users/{id}     # 部分更新用户
DELETE /api/v1/users/{id}     # 删除用户

# 子资源操作
GET    /api/v1/users/{id}/orders      # 获取用户的订单

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/html_extractor/extractor.py (reported line 1874)May include surrounding context.

python

md_lines.append(f"  detail: GET /api/{api_name}/:id")
                md_lines.append(f"  create: POST /api/{api_name}")
                md_lines.append(f"  update: PUT /api/{api_name}/:id")
                md_lines.append(f"  delete: DELETE /api/{api_name}/:id")
            md_lines.append("```")
            md_lines.append("")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises and instructs use of capabilities equivalent to environment-variable access, file reads, shell execution, and writing output, but it does not declare an explicit tool/permission scope. In an agent setting, missing least-privilege boundaries makes it easier for the skill to overreach into local files, secrets, or command execution when handling untrusted prototype inputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description forces a specific language/locale for the skill's instructions and behavior presentation. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific; neither is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The visible user-facing instructions begin in Chinese and continue in that language throughout the file, which effectively enforces a locale without opt-in. This matches the language/locale policy violation category because no alternative language path or user preference mechanism is documented.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill contains contradictory security guidance: one section says internal URLs are blocked by default, while another states internal links are supported. In a tool that analyzes attacker-controlled URLs, inconsistent SSRF guidance is dangerous because operators or downstream agents may interpret it as approval to access internal resources, weakening network-boundary protections.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document content is presented entirely in Chinese, beginning with a Chinese title, with no indication that language selection is optional or context-specific. Under the policy criteria, forcing a specific language without user opt-in is a natural-language locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file title and all instructional content are written exclusively in Chinese, with no indication that language choice is optional or limited to a justified locale-specific context. This can violate language/locale policy when a skill or reference material implicitly requires one language without offering user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document title and all instructional template content are written exclusively in Chinese, which indicates a fixed language expectation for the skill output. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified or optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This Python file contains natural-language descriptions, role labels, and generated questions entirely in Chinese, indicating the analyzer will present its results in a fixed language. The policy explicitly disallows forcing a specific language or locale unless the skill offers user choice or clearly documents a justified region-specific constraint, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This Python file contains user-facing natural-language strings and generated report content entirely in Chinese, starting with the module docstring and continuing throughout report-generation methods. The file does not offer any language choice or indicate that Chinese is a justified locale-specific requirement, which conflicts with the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The to_interactive_markdown method emits headings, prompts, and instructions only in Chinese, including questions the user is expected to answer. Because the skill provides no opt-in or alternative locale path, it imposes a specific language on users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The to_markdown method produces all report sections, labels, and closing guidance in Chinese only. This is a natural-language policy issue because the skill enforces one language for user-visible output without presenting a choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains user-facing natural-language strings and documentation exclusively in Chinese, including the module docstring and CLI usage/help text. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and no alternative language option or justification is provided.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The helper returns base64-encoded image content in the result object (image_data), which can expose user-supplied prototype images to downstream logs, callers, or other components that only expected analysis metadata. In this skill’s context, prototypes and screenshots may contain sensitive product details, internal workflows, credentials in mockups, or personal data, so unnecessarily propagating raw image bytes increases data leakage risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.