T08 · Insecure Dependencies
Error
- Location
references/container-deployment.md:14- Finding
Dependencies Installed Through an Unencrypted Custom npm Registry
- Content
View full analysis
- Remediation
View remediation
Security audit
魔盒node服务开发技能包
Security checks for vulnerabilities and agentic risk
Overview
This documentation-only skill is not malicious, but its copyable deployment guidance includes unsafe production patterns that could expose or weaken systems if followed as written.
Install only if you treat this as rough internal documentation and review every deployment/configuration snippet before use. Do not copy the Dockerfile or Kubernetes examples as production templates without replacing chmod 777, using a trusted HTTPS npm registry, removing sshd/crond from the app container, moving database credentials to Secrets or a secret manager, and restricting CORS to known origins.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/container-deployment.md:12- Finding
World-Writable Application and Data Directories Enable Code Tampering
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/container-deployment.md:30- Finding
Unnecessary SSH and Cron Daemons Expand the Privileged Container Attack Surface
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/container-deployment.md:222- Finding
Database Credentials Are Placed in a Kubernetes ConfigMap
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/config-management.md:178- Finding
Wildcard CORS Is Enabled by Default for API Requests
- Content
View full analysis
{ const corsOrigin = process.env.CORS_ORIGIN || '*'; res.header('Access-Control-Allow-Origin', corsOrigin); res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS'); res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, Authorization'); if (req.method === 'OPTIONS') { res.sendStatus(200); } else { next(); } }); ``` The example production configuration also explicitly sets the wildcard at `references/config-management.md:62`: ```json "CORS_ORIGIN": "*" ``` ### Technical Analysis The middleware defaults `Access-Control-Allow-Origin` to `*`, allowing scripts hosted by any origin to issue browser-readable cross-origin requests to the API. It also permits state-changing methods and the `Authorization` header globally. CORS is not itself an authentication control, and wildcard origin does not cause browsers to automatically disclose every type of credential. However, this policy removes the browser's same-origin read restriction for unauthenticated responses and for requests where attacker-controlled JavaScript can supply an accessible token. It can therefore expose sensitive API responses or amplify token leakage and client-side compromise. The middleware applies the same broad policy to every endpoint and does not validate origins against a trusted allowlist. ### Attack Path 1. The service is deployed without a restrictive `CORS_ORIGIN`, causing the wildcard default to be used. 2. A victim visits an attacker-controlled website. 3. The attacker's JavaScript sends requests to the API using permitted methods. 4. If an endpoint is unauthenticated, relies on browser-accessible credentials, or the attacker can obtain a usable token, the AP ...[truncated 611 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md export function loadEnvConfig(): void { const nodeEnv = process.env.NODE_ENV || 'development'; // 开发环境：使用 .env 文件 if (nodeEnv === 'development') { const envFile = '.env.develop'; const envPath = path.resolve(process.cwd(), envFile);
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 88% confidence
- Finding
This command combines directory creation with a dangerous permission change, normalizing unsafe filesystem permissions as part of the build. In deployment guidance, that is security-relevant because operators may copy it verbatim, resulting in writable locations that facilitate tampering or privilege abuse within the container.
- Content
md ARG DIR="/home/export/App" # 创建必要的目录 RUN mkdir -p /export/Data && chmod 777 /export/Data && mkdir -p /home/export/App RUN node -v && npm -v && npm config set registry=http://registry.m.jd.com
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 84% confidence
- Finding
The use of chained shell commands here hides a risky chmod 777 inside a broader setup line, making unsafe behavior easier to overlook during review. While chaining itself is not inherently vulnerable, in this context it contributes to insecure deployment practices by obscuring a high-risk permission change.
- Content
md ARG DIR="/home/export/App" # 创建必要的目录 RUN mkdir -p /export/Data && chmod 777 /export/Data && mkdir -p /home/export/App RUN node -v && npm -v && npm config set registry=http://registry.m.jd.com
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill name, description, and document content are entirely in Chinese, which can amount to a language/locale policy constraint when no opt-in or alternative language option is provided. The file does not state that the skill is region-specific or that users may choose another language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The entire skill file is written in Chinese and does not provide any language-selection option or indicate that the skill is intentionally limited to Chinese-speaking users or a China-specific compliance context. Under the policy, a forced language/locale without opt-in is a natural-language policy violation.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
env # 环境配置 NODE_ENV=development # 服务器配置 PORT=3000
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document explicitly says sensitive information must not be hardcoded, yet the production JSON example includes literal database credentials such as DB_USERNAME and DB_PASSWORD. Even if presented as an example, operators commonly copy documentation verbatim into real deployments, which can lead to credential exposure, secret reuse, and insecure configuration practices.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
Setting /export/Data to mode 777 makes it world-readable and world-writable inside the container, allowing any process to alter application data. In a compromised container or multi-process context, this enables tampering, persistence, and abuse of shared writable paths.
- Content
md ARG DIR="/home/export/App" # 创建必要的目录 RUN mkdir -p /export/Data && chmod 777 /export/Data && mkdir -p /home/export/App RUN node -v && npm -v && npm config set registry=http://registry.m.jd.com
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Granting mode 777 to the application directory makes the full codebase writable by any user or process in the container. That weakens code integrity and can allow runtime modification of scripts or application files if any foothold is gained.
- Content
md WORKDIR ${DIR} COPY . ${DIR} RUN chmod 777 /home/export/App/ && npm install # 添加版本管理和部署脚本执行权限 RUN chmod +x /home/export/App/scripts/*.sh && chmod +x /home/export/App/start.sh
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The container entrypoint starts sshd and crond inside the application container, expanding the attack surface well beyond a typical Node.js service. Running multiple long-lived system services in one app container increases remote access opportunities, complicates hardening, and violates least-functionality/container best practices.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file documents scripts that overwrite
version.jsonand copy artifacts, and later instructs users to rundocker build,docker push, andkubectl apply. The guide provides operational steps but does not warn that these actions modify local files and deploy changes to a live container/Kubernetes environment, which can affect user data or system integrity.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire markdown document is written in Chinese and does not indicate that the skill is region-specific or that other language options are available. Under the policy rule for language or locale constraints, this can be a natural-language policy violation because it imposes a specific language without user opt-in.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
L140-L141 明确声明敏感配置应使用环境变量且密码等敏感信息不硬编码，但紧随其后的配置文件结构示例在同一文档中直接给出了 DB_USERNAME 和 DB_PASSWORD 字段及明文值。这不是单纯信息缺失，而是文档中的安全意图与示例内容存在直接张力，容易误导使用者照此落地。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file title and all guidance are written exclusively in Chinese, which indicates a language-specific constraint in the skill documentation. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file's headings, instructions, and operational guidance are all presented in Chinese, and there is no indication that the skill is intentionally limited to Chinese-speaking users or a China-specific deployment context. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Line L008 states '切换到root用户', which asserts a concrete execution step, but the shown Dockerfile fragment contains no USER instruction or equivalent command that actually switches users. This is an active contradiction between inline documentation and the code example, not merely missing detail.
- Content
Static analysis
No suspicious patterns detected.