Back to skill

Security audit

code-to-requirement-analyser

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local code-analysis tool, but it ships a repair script that can overwrite its own React and Angular parser files without warning or backup.

Install only if you are comfortable with local caching of source-derived analysis data and avoid running fix_setup.sh unless you have backed up the skill directory and accept that it can replace React and Angular parser implementations. Use a virtual environment and pinned dependencies where possible.

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
fix_setup.sh:15
Finding

Setup Script Destructively Overwrites Existing Parser Implementations

Content
View full analysis
scripts/parser/react_parser.py << 'EOF' from .base import BaseCodeParser, ParsedComponent, ParsedAPI, ParsedRule from typing import List, Dict, Any class ReactParser(BaseCodeParser): """React component parser (placeholder implementation)""" def parse(self) -> Dict[str, Any]: return { "file_info": { "path": self.file_path, "type": "react", "note": "React parser is not fully implemented" }, "components": [], "apis": [], "business_rules": [], "complexity": self.calculate_complexity() } def extract_components(self) -> List[ParsedComponent]: return [] def extract_apis(self) -> List[ParsedAPI]: return [] def extract_business_rules(self) -> List[ParsedRule]: return [] EOF # 3. Create Angular parser placeholder echo "Creating Angular parser placeholder..." cat > scripts/parser/angular_parser.py << 'EOF' from .base import BaseCodeParser, ParsedComponent, ParsedAPI, ParsedRule from typing import List, Dict, Any class AngularParser(BaseCodeParser): """Angular component parser (placeholder implementation)""" def parse(self) -> Dict[str, Any]: return { "file_info": { "path": self.file_path, "type": "angular", "note": "Angular parser is not fully implemented" }, "components": [], "apis": [], "business_rules": [], "complexity": self.calculate_complexity() } def extract_components(self) -> List[ParsedComponent]: return [] ...[truncated 2095 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:262
Finding

Runtime Dependencies Are Installed Without Version or Integrity Pinning

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

代码块的核心行为是环境修复和脚手架补全:创建 init.py、写入 React/Angular 解析器占位文件、校验 base.py、测试导入 VueParser。虽然这些操作与一个代码分析工具的开发准备工作相关,但它并没有实际执行所声明的主要功能。尤其是声明中强调的“智能分析”“逆向推导业务需求”“构建知识图谱”“支持 Vue/React/Angular”在该代码中均未真正实现;其中 React/Angular 甚至明确标注为“尚未完全实现”的占位代码。因此,描述与代码实际行为存在明显且实质性的偏差。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

该代码的核心功能与“交易业务分析”部分基本相关,但声明明显夸大了能力范围。实际代码只是对传入的 parsed_data 做启发式分析和规则整理,不能证明支持 Vue/React/Angular 多技术栈源码逆向分析,因为没有任何框架解析逻辑。所谓“交易知识图谱”也未落地为图结构、实体关系建模或持久化复用机制,只是返回普通分析结果。此外,声明中的智能缓存和错误恢复机制在代码中都不存在;异常相关部分只是识别 exception flows,不属于恢复机制。因此描述与实际行为存在实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

该代码块的核心职责是把已有的 analysis_result 组织成知识节点和关系边,保存到本地文件系统,并维护 tags/dimensions 索引,再提供简单搜索和相关知识查询。这与描述中的“智能分析前端代码、自动逆向推导业务需求”存在明显差异:代码没有读取、解析或扫描 Vue/React/Angular 前端源码,也没有任何框架特定 AST/模板分析逻辑;输入已经是分析后的结构化结果。描述中提到的“智能缓存”和“错误恢复机制”在代码中也没有实质实现,只有普通的 index.json 持久化与目录创建。虽然“构建可复用的交易知识图谱”这一部分与代码行为部分一致,但整体主要能力与宣称范围相比明显不足且重点不同,因此应判定为描述与实际行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

该代码的核心功能是对 React/TSX 前端源码做静态正则解析,提取组件结构、API、表单校验、条件逻辑、权限检查、状态管理等元信息,属于通用 React 前端代码分析器。它与声明中‘交易维度业务需求逆向’有部分弱相关,因为确实尝试推断 business_rules 和 business_purpose,但并未体现交易领域特化,也没有知识图谱构建逻辑。更重要的是,声明强调支持 Vue/React/Angular 多技术栈,而该代码块明确只处理 React;声明中的智能缓存和错误恢复也未在本代码块中得到实质实现,只有基础异常捕获。因此描述明显超出了实际行为,存在实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

代码的核心功能是解析 Vue 单文件组件并抽取结构化信息,这与“前端代码分析”部分相关,也确实包含较完整的错误处理,和声明中的“错误恢复机制”部分大体一致。但声明中的多个关键能力在代码中没有体现或明显夸大:首先,多技术栈支持不存在,代码类名和实现都专注于 Vue;其次,所谓“交易知识图谱构建”没有任何图谱实体、关系建模、持久化或聚合逻辑;再次,“逆向推导业务需求”在这里主要是基于标签、按钮文本、URL 关键词做启发式分类,属于浅层语义推断,不足以等同于业务需求逆向;最后,“智能缓存”仅在构造函数参数中透传 use_cache,片段内没有实际缓存策略或实现。因此,描述相对代码实际能力存在明显夸大和范围不符,应判定为不匹配。

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/parser/angular_parser.py (reported line 248)May include surrounding context.

python
except Exception as e:
            self.logger.warning(f"提取业务规则失败: {e}")
        
        return rules
    
    def _extract_imports(self) -> List[Dict]:
        """提取导入"""

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/parser/react_parser.py (reported line 479)May include surrounding context.

python
except Exception as e:
            self.logger.warning(f"提取业务规则失败: {e}")
        
        return rules
    
    def _extract_imports(self) -> List[Dict]:
        """提取导入"""

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/parser/vue_parser.py (reported line 371)May include surrounding context.

python
except Exception as e:
            self.logger.warning(f"提取业务规则失败: {e}")
        
        return rules
    
    def _extract_imports(self) -> List[Dict]:
        """提取导入"""

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/parser/vue_parser.py (reported line 419)May include surrounding context.

python
except Exception as e:
            self.logger.warning(f"提取业务规则失败: {e}")
        
        return rules
    
    def _extract_imports(self) -> List[Dict]:
        """提取导入"""

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises capabilities that imply file reads, file writes, cache management, and optional network use via an LLM API, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an avoidable least-privilege failure: users and the hosting platform cannot clearly constrain what the skill is permitted to access, increasing the risk of overbroad filesystem or network operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description and the skill documentation are entirely in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language or region-specific context. The policy requires flagging language or locale constraints when they are imposed without opt-in or clear justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill documents persistent writes to a knowledge base and cache-clearing behavior, but it does not warn users about local data retention, overwrite risk, or destructive effects of clearing stored analysis artifacts. In a code-analysis context, this is more sensitive because analyzed source structure and derived business knowledge may contain proprietary or regulated information that remains on disk unexpectedly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description says it supports multiple frontend stacks including React and Angular, implying actual analysis capability. In this file, both parsers are generated as placeholder implementations that return empty components, APIs, and business rules, which does not match the claimed functional support.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This Python file uses Chinese-only natural-language comments, docstrings, labels, and user-facing suggestion strings throughout, with no indication that language is configurable or chosen by the user. That creates a locale/language policy concern under the rule because the skill effectively imposes a single language across its natural-language outputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code presents its primary docstring, command descriptions, help text, and runtime messages in Chinese only, which imposes a specific language on users without offering an alternative or opt-in. The policy explicitly flags language or locale constraints unless the skill offers choice or clearly documents a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The class docstring is written entirely in Chinese, and similar Chinese-only natural-language strings appear throughout the file. This imposes a specific language on users or maintainers without any opt-in or documented justification for a locale-specific constraint, which matches the language policy violation criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest emphasizes analyzing trading frontend code and inferring business requirements, which reads primarily as an analysis function. In this file, the implementation creates a persistent cache directory under the user's home directory and writes analysis results plus metadata JSON files there, adding local stateful storage behavior beyond pure code analysis.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This Python file contains user-visible natural-language comments and docstrings exclusively in Chinese, including the class docstring and inline comments. Per the policy, forcing a specific language without opt-in or a documented regional justification is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This Python file contains natural-language comments and user-visible log/docstring text primarily in Chinese, such as the logging configuration comment and many later messages. Under the stated policy, forcing a specific language without offering a user choice can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code file contains user-facing natural-language documentation entirely in Chinese, including the class docstring describing the parser's supported capabilities. Under the policy, forcing a specific language or locale without offering user choice can be a natural-language policy violation when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains user- and maintainer-facing natural language exclusively in Chinese, such as the class docstring and method documentation. Under the stated policy, forcing a specific language without user opt-in can be a locale/language policy violation when no alternative or opt-in is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.