Security audit

Blind Box

Security checks for vulnerabilities and agentic risk

Overview

This is a low-impact blind-box/gacha entertainment skill that only prints themed prompts and catalogue text.

Install only if you are comfortable with a simple local Node-based entertainment skill whose default language is Chinese and whose daily pull is not technically limited to one use per day.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description mostly matches the thematic domain: the code contains 5 themed series, rarity tiers, single and multi-pull support capped at 10, and share-style ending text. However, there are material gaps. First, the declared 'daily free pull' capability is absent: there is no date check, state, quota tracking, or free-pull logic. Second, the code's actual behavior is not to run a full blind-box skill directly, but to output a structured prompt instructing a downstream model to generate the experience. That is a meaningful behavior difference from a straightforward 'virtual blind box gacha skill.' There are no suspicious undeclared permissions or external resource accesses, but the missing daily-free-pull feature and prompt-generator nature make this a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
md
node scripts/daily.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
node scripts/daily.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
node scripts/series.js

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sets --lang to zh by default, which forces a specific language when the user does not explicitly choose one. This is reinforced by later instructions requiring all output to be in Chinese, creating a locale policy issue without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The generated instructions explicitly require Chinese output for all names, descriptions, and UI text under the default zh path. Because the script defaults to that path, the skill imposes a language choice rather than offering it as an opt-in preference.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script sets the default language to 'zh' when no --lang argument is provided. This imposes a specific language choice by default rather than prompting for or preserving user preference, which is a natural-language policy concern under the locale/language rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script defaults to 'zh' when no --lang argument is provided, which imposes a specific language choice on the user by default. The policy allows locale constraints only when the user is given a language choice or when the constraint is clearly justified; here, the user can choose English, but only through an explicit flag while the default remains a forced locale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.