Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent ChatPPT CLI helper, with disclosed cloud upload and login behavior, but users should treat installs, credentials, and document uploads carefully.
Before installing, consider using a restricted or disposable environment, avoid elevated npm installs, and do not upload confidential documents unless you are comfortable sending their contents to the ChatPPT/Baidu BOS-backed service. Do not paste or display raw auth config, AK/SK values, passwords, or tokens in chat logs.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T08 · Insecure Dependencies
Warning
Location
SKILL.md:12
Finding
Unpinned Global Installation of a Third-Party npm Package
Content
View full analysis
Vulnerability Details
File Location: SKILL.md, line 12 Vulnerability Type: T08: Insecure Dependencies Risk Level: Medium
Complete Code Snippet:
bash
npm install -g @yooai/cli
Technical Analysis
The skill instructs users or agents to install @yooai/cli globally without pinning an exact version or verifying package integrity. Consequently, npm resolves a mutable package release from the configured registry at installation time rather than a specific version that was reviewed alongside the skill.
A global installation expands the effect beyond an isolated project environment and exposes the invoking account to package lifecycle scripts and subsequently executed CLI code. The audit found no evidence that the named package is currently malicious; the risk arises from the unsafe dependency acquisition method. A compromised publisher account, registry response, or future package release could cause the installed implementation to differ from the one originally intended or reviewed.
Attack Path
An attacker compromises the npm publisher account, package release process, or another relevant supply-chain component for @yooai/cli.
The attacker publishes a malicious release that becomes the version selected by npm.
A user or agent follows the skill instruction and runs npm install -g @yooai/cli.
npm downloads and installs the mutable release. Malicious lifecycle scripts may execute during installation, or malicious code may execute when later chatppt commands are invoked.
The payload runs with the privileges of the account performing the installation and can affect files and resources accessible to that account.
Impact Assessment
Successful exploitation could permit arbitrary code execution with the invoking user's privileges. The accessible scope may include user files, environment variables, npm configuration, authentication material readable by that user, and the
...[truncated 305 chars]
Remediation
View remediation
Remediation Suggestions
Pin the dependency to an exact, reviewed version, for example:
bash
The manifest description is entirely in Chinese and states when the skill should be triggered, but it does not indicate that the user may choose another language. Because SQP-3 applies to all file types and covers language/locale policy violations, this is a natural-language policy issue if users are not given an explicit language choice.
The skill instructs the agent to upload local files to a cloud-backed service for PPT generation, but it does not require an explicit warning that document contents will leave the local environment and be transmitted to third-party infrastructure. This can lead users to share sensitive files without informed consent, especially because the workflow encourages automated execution once parameters are present.
The documentation includes a config output example exposing an access_key_id and describes config show without strong guidance to avoid displaying or logging credential-related material. In agent settings, this increases the risk of secrets being echoed into chat transcripts, logs, or telemetry, which can enable credential misuse or reveal sensitive infrastructure details.
