Security audit

Backup image to StarDots

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it should be reviewed before installation because its runtime HTTP dependencies have confirmed credential-handling and upload-related vulnerabilities.

Review this skill before installing. It is purpose-aligned for Stardots image backup, but the publisher should update vulnerable runtime dependencies and ideally add an explicit pre-upload confirmation naming the local file and Stardots destination. Do not use it for sensitive images unless you are comfortable sending them to Stardots.io under your configured account and space.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (34)

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 93% confidence
Finding: axios is a direct runtime dependency, and the cited advisories include SSRF/proxy-bypass and prototype-pollution-related MITM/credential theft issues. Because this skill appears to perform backup/network operations, HTTP client flaws are more dangerous here than in a purely local utility, especially if user-controlled URLs, proxies, or redirects are involved.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

Category: Supply Chain
Confidence: 84% confidence
Finding: brace-expansion 1.1.12 is flagged for multiple DoS conditions involving pathological expansion patterns. Here it is a transitive dev dependency, so the primary risk is build/test process instability if attacker-controlled glob-like patterns are introduced into tooling inputs.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: browserslist is cited for crash/prototype-write and unbounded memory growth issues. Since it is a dev-time dependency, the risk is mostly limited to CI or local tooling abuse, but malformed attacker-controlled browserslist data could still disrupt builds or poison process state.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

Category: Supply Chain
Confidence: 91% confidence
Finding: form-data is a direct/runtime dependency and the cited CRLF injection in multipart field names or filenames can enable malformed request construction, header injection, or request smuggling effects against upstream services. In a backup/upload-oriented skill, multipart handling is likely relevant, making this more dangerous if any field names or filenames are derived from external input.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==3.14.2 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

Category: Supply Chain
Confidence: 82% confidence
Finding: js-yaml 3.14.2 is affected by multiple CPU-consumption issues and is present as a dev dependency through tooling. That makes the risk mainly a denial-of-service against development or CI workflows if untrusted YAML is parsed, rather than a direct runtime compromise of the skill itself.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: picomatch==2.3.1 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

Category: Supply Chain
Confidence: 83% confidence
Finding: picomatch is flagged for method injection and ReDoS issues and is commonly exercised through glob matching in tooling. In this lockfile it appears as a transitive dependency largely associated with dev/test infrastructure, so the main exposure is denial-of-service or incorrect matching when untrusted patterns are supplied.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description says images are automatically backed up to stardots.io and access links are provided, but it does not clearly warn users that files are transmitted to a third-party cloud service and may become accessible through generated URLs. This weak disclosure increases the risk of users uploading sensitive local images without informed consent about external storage and sharing exposure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The help trigger uses very broad natural-language phrases such as '帮助' and '如何使用备份', which can overlap with ordinary conversation and cause the skill to activate unintentionally. In a file-upload skill, accidental invocation is more dangerous than in a read-only skill because it can prompt or facilitate unintended access to local files and third-party transmission.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Natural-language strings in the description, responses, and help text are written in Chinese, and the intent matching also depends on Chinese command words alongside some English terms. There is no opt-in, language selection, or documentation that this skill is intentionally limited to a Chinese-speaking context, which can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill uploads a user-specified local image to Stardots.io, but the interaction does not clearly warn at execution time that local file contents will be transmitted to an external third-party service. In an agent context, implicit network exfiltration of local files is security-relevant because users may interpret 'backup' as local or trusted storage and disclose sensitive images unintentionally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The deleteFile method performs a destructive remote deletion operation via an HTTP DELETE request, but the code provides no confirmation prompt, logging, comment, or other user-facing disclosure about this irreversible action. In this file, the deletion behavior is silent aside from a boolean return value, which does not satisfy the warning/disclosure requirement for safety-critical operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest states that local image files are uploaded to a third-party platform, but it does not present an explicit user-facing warning or consent notice about off-device data transmission. Users may unintentionally send sensitive local content to a remote service, which is a privacy and data handling risk even if the feature is intended.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The exact trigger phrase "列出文件" is broad enough to match ordinary user requests unrelated to this specific backup service. In a skill that can access remote storage context and local file workflows, ambiguous activation can cause unintended invocation, confusing users and potentially exposing file metadata or causing actions in the wrong context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger "帮助" is extremely generic and is likely to collide with normal assistant help requests. This can cause the backup skill to activate when the user only wants general assistance, increasing the chance of unintended exposure of skill capabilities or workflow initiation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Natural-language strings throughout the skill, including the description, help text, command examples, and intent matching, are fixed in Chinese. This can violate language/locale policy when the skill forces a specific language experience without giving the user an explicit choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill uploads a user-specified local file to a remote Stardots.io service, but this file does not present an explicit consent prompt, destination disclosure at execution time, or any guardrails around what local paths may be exfiltrated. In an agent context, natural-language triggering plus direct path handling increases the risk of unintended disclosure of sensitive local images or files if the user message is ambiguous or manipulated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The method reads a local file from the provided path and uploads it to https://api.stardots.io. In this file there is no confirmation prompt, warning message, or explanatory comment disclosing that local file contents and optional metadata are sent off-system.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The deleteFile method issues a DELETE request to remove a file via the remote API, which is a destructive operation. This file does not include any user confirmation, warning text, or inline documentation alerting users that the action deletes remote data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: All user-facing instructions and invocation examples are presented in Chinese, which effectively forces a specific language for use and understanding of the skill. The documentation does not offer multilingual support, opt-in language selection, or a justification that this skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This is a manifest/config file, so vague-trigger review applies. The schema defines required credentials and target space fields but provides no contextual description of when or how this skill should be invoked, leaving activation scope and operational constraints unclear.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: Natural-language strings in the schema are exclusively English, and there is no indication that users can opt into another language or locale. Under the stated policy, forcing a specific language without user choice can be a locale-policy violation unless clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The method returns hard-coded Chinese messages such as '上传成功' and '上传失败' with no indication that the user can choose language or locale. This is a natural-language policy concern because the skill imposes a specific language in user-visible output without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: @babel/core==7.29.0 — 1 advisory(ies): CVE-2026-49356 (@babel/core: Arbitrary File Read via sourceMappingURL Comment)

Low

Category: Supply Chain
Confidence: 78% confidence
Finding: The lockfile pins @babel/core 7.29.0, and the finding cites an arbitrary file read issue via sourceMappingURL parsing. In this skill context it is a dev-only dependency used through Jest/Babel tooling, so the exploitability is reduced because it is not part of normal runtime behavior, but it still represents a real supply-chain weakness during development or CI if untrusted files are processed.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: baseline-browser-mapping==2.10.0 — 1 advisory(ies): CVE-2026-45819 (baseline-browser-mapping process termination on invalid input causes denial of s)

Low

Category: Supply Chain
Confidence: 71% confidence
Finding: baseline-browser-mapping is present as a dev dependency and the cited issue is a denial-of-service on invalid input. In this repository it is only transitively used by development tooling, so it is a real but low-risk issue unless CI or tooling ingests attacker-controlled input.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

Category: Supply Chain
Confidence: 86% confidence
Finding: follow-redirects is used by axios at runtime, and the cited issue can leak custom authentication headers across cross-domain redirects. In a backup skill that likely connects to remote services with API tokens, credential leakage through redirects is materially relevant even if exploitation depends on attacker influence over redirect targets.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.