Baoyu Electron Extract

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:51 AM UTC
• Version: 1.119.0

Overview

The skill is mostly coherent with its stated Electron extraction purpose, but it runs unpinned downloaded tools and automatically formats untrusted extracted app code, creating avoidable local code-execution risk.

Install only if you are comfortable with a tool that extracts local application code and runs downloaded npm packages during use. Prefer using a locally reviewed, pinned dependency setup, run with --skip-format for untrusted apps, and keep outputs in a dedicated directory rather than using --force on important paths.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/main.ts:399

Finding

Unpinned Third-Party Packages Are Downloaded and Executed at Runtime

Content

View full analysis

Vulnerability Details

File Location: scripts/main.ts:399-422 and scripts/main.ts:661-687
Vulnerability Type: Unpinned runtime dependency execution
Risk Level: Medium

Vulnerable Code

ts

async function extractAsar(
  asarPath: string,
  dest: string,
  json: boolean
): Promise<void> {
  mkdirSync(dest, { recursive: true });
  const args = ["-y", "@electron/asar", "extract", asarPath, dest];
  const code = json
    ? await new Promise<number>((res) => {
        const p = spawn("npx", args, { stdio: ["ignore", "ignore", "pipe"] });
        let err = "";
        p.stderr?.on("data", (d) => (err += d.toString()));
        p.on("close", (c) => {
          if ((c ?? 1) !== 0) process.stderr.write(err);
          res(c ?? 1);
        });
        p.on("error", (e) => {
          process.stderr.write(e.message);
          res(1);
        });
      })
    : await runForwarded("npx", args);
  if (code !== 0)
    throw new Error(`@electron/asar extract failed (code ${code})`);
}

ts

function formatBatches(files: string[], json: boolean): Promise<void> {
  const maxArgLen = 50_000;
  let batch: string[] = [];
  let len = 0;
  const flush = async () => {
    if (batch.length === 0) return;
    const args = ["-y", "prettier", "--write", ...batch];
    const code = json
      ? await new Promise<number>((res) => {
          const p = spawn("npx", args, { stdio: ["ignore", "ignore", "pipe"] });
          let err = "";
          p.stderr?.on("data", (d) => (err += d.toString()));
          p.on("close", (c) => {
            if ((c ?? 1) !== 0) process.stderr.write(err);
            res(c ?? 1);
          });
          p.on("error", (e) => {
            process.stderr.write(e.message);
            res(1);
          });
        })
      : await runForwarded("npx", args);

Technical

...[truncated 1853 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare exact, reviewed versions of Bun, @electron/asar, and Prettier in a project manifest.
2. Commit a lockfile containing resolved versions and integrity hashes.
3. Install dependencies using lockfile-enforcement options such as npm ci or the equivalent trusted package-manager command.
4. Invoke project-local binaries rather than using npx -y to retrieve packages on demand.
5. Configure the package manager to use a trusted registry and preserve integrity verification.
6. Require an already installed, trusted runtime instead of automatically retrieving Bun through npx.
7. Periodically review and deliberately update pinned dependencies after security testing.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.ts:661

Finding

Prettier Processes Untrusted Extracted Projects with Configuration Discovery Enabled

Content

View full analysis

Vulnerability Details

File Location: scripts/main.ts:661-687 and scripts/main.ts:851-863
Vulnerability Type: Unsafe execution of formatter configuration and plugins from untrusted content
Risk Level: High

Vulnerable Code

ts

function formatBatches(files: string[], json: boolean): Promise<void> {
  const maxArgLen = 50_000;
  let batch: string[] = [];
  let len = 0;
  const flush = async () => {
    if (batch.length === 0) return;
    const args = ["-y", "prettier", "--write", ...batch];
    const code = json
      ? await new Promise<number>((res) => {
          const p = spawn("npx", args, { stdio: ["ignore", "ignore", "pipe"] });
          let err = "";
          p.stderr?.on("data", (d) => (err += d.toString()));
          p.on("close", (c) => {
            if ((c ?? 1) !== 0) process.stderr.write(err);
            res(c ?? 1);
          });
          p.on("error", (e) => {
            process.stderr.write(e.message);
            res(1);
          });
        })
      : await runForwarded("npx", args);

ts

if (!opts.skipFormat) {
  for (const js of walked.jsFiles)
    if (!skipFormatSet.has(js)) toFormat.push(js);
  for (const css of walked.cssFiles) toFormat.push(css);
  if (toFormat.length > 0) {
    if (!opts.json)
      process.stdout.write(
        `Formatting ${toFormat.length} file(s) with prettier...\n`
      );
    await formatBatches(toFormat, opts.json);
    counts.formattedFiles = toFormat.length;
  }
}

Technical Analysis

The JavaScript and CSS files passed to Prettier originate from an Electron ASAR bundle and must therefore be treated as untrusted input. The Prettier invocation uses --write but does not disable configuration discovery or plugin loading.

Prettier configuration may be stored in executable JavaScript configuration files, and a discovered configuration can identify p ...[truncated 1770 chars]

Remediation

View remediation

Remediation Suggestions

1. Invoke Prettier with configuration discovery disabled, using --no-config where supported by the pinned Prettier version.
2. Explicitly prevent automatic or project-controlled plugin loading. Use the relevant plugin-search disabling mechanism supported by the selected pinned version and do not honor plugin entries from extracted content.
3. Supply a fixed, trusted parser and trusted formatting options maintained outside the extraction directory.
4. Run formatting in an isolated process or container with no network access, a read-only view of unrelated user files, a dedicated temporary home directory, and write access limited to the extraction output.
5. Set the formatter's working directory and environment explicitly so that it cannot discover configuration from either the extracted project or unrelated parent directories.
6. Treat configuration files such as .prettierrc.js, prettier.config.js, and equivalent executable formats as untrusted data and never import or evaluate them.
7. Consider making formatting opt-in rather than automatic when the source archive is not trusted.
8. Add a regression test containing a configuration file that would create a marker if evaluated, and verify that formatting completes without creating the marker.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

| `scripts/main.ts` | App discovery + asar extraction + source-map restoration + Prettier formatting |

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs the agent to execute 'npx -y bun' without pinning a specific version, which allows retrieval of whatever package currently resolves under that name at runtime. This creates a supply-chain execution risk: a compromised upstream package, account takeover, or unexpected major-version change could cause unreviewed code to run on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The description explicitly includes Chinese trigger phrases alongside English, which introduces a language-specific activation policy without stating that multilingual triggering is optional or user-configurable. Under the stated policy, language behavior should either be offered as a choice or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This line hard-codes Chinese activation examples in the skill's natural-language trigger list, but the file does not explain language selection behavior or indicate that users can choose their preferred language. That can be interpreted as a language/locale policy issue under the provided rule.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/main.ts:378