Security audit

libtv-cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent LibTV CLI guide, but its installer and update steps can run unverified code from the internet and make persistent local changes.

Review before installing. Avoid direct curl-to-shell or Invoke-Expression install commands unless you fully trust the LibTV release endpoints; prefer a version-pinned installer with published checksums or signatures. Keep LIBTV_CONFIG_DIR private because it stores active credentials, and be aware this CLI can upload local files and create, modify, run, or delete LibTV canvas content.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install.md:84
Finding: Remote PowerShell Installer Is Executed Without Verification
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install-libtv-cli.bat:12
Finding: Batch Bootstrapper Executes a Configuration-Controlled Remote Script
Content: View full analysis
nul 2>nul exit /b %EXIT_CODE% ``` ### Technical Analysis When the local PowerShell installer is absent, the batch file contacts an activity API and treats `data.linkUrl.install.PowerShell` as an authoritative executable-script URL. It downloads that script and runs it with `ExecutionPolicy Bypass`. The implementation does not constrain the returned URL to an approved origin, pin a release version, verify a checks ...[truncated 1262 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install-libtv-cli.sh:380
Finding: Unix Installer Installs and Executes an Unverified Downloaded Binary
Content: View full analysis
指定版本" [[ -n "$ver" ]] || die "无法解析远端默认版本；可改用 LIBTV_CLI_VERSION=<版本> 指定版本" fi url="${LIBTV_REMOTE_BASE}/${ver}/$(bundle_dir_name).zip" tmp="$(mktemp -t libtv_cli_zip.XXXXXX)" echo "正在下载: $url" >&2 fetch_url "$url" "$tmp" || { local bundle slug bundle="$(bundle_dir_name)" slug="$(platform_slug)" print_install_source_hint "$bundle" "$slug" "$ZIP_NAME" local pin_hint='' ``` ```bash install_copy_binary() { # 统一安装到 INSTALL_DIR/libtv；cp -f 会覆盖已有同名文件 local binary_src="$1" dest install_abs mkdir -p "$INSTALL_DIR" dest="$INSTALL_DIR/libtv" cp -f "$binary_src" "$dest" chmod +x "$dest" install_abs="$(cd "$INSTALL_DIR" && pwd)" echo "Installed: $dest" libtv_append_path_to_profile "$install_abs" "$dest" --help >/dev/null 2>&1 || true } ``` ```bash if binary_src="$(resolve_local_release_binary)"; then install_copy_binary "$binary_src" return fi # 本地皆失败：从官方站下载；失败时 resolve_remote_zip 会 die zip_path="$(resolve_remote_zip)" install_from_zip_path "$zip_path" ``` ### Technical Analysis The Unix installer resolves a version from remotely supplied metadata, downloads a platform ZIP, extracts a file named `libtv` or `libtv.exe`, copies it into the user's installation directory, makes it executable, places the directory on the user's PATH, and invokes the binary with `--help`. No archive digest, signed manifest, platform code signature, or expected binary identity is checked. Matching only the filename is insufficient because a maliciou ...[truncated 1255 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install-libtv-cli.ps1:199
Finding: PowerShell Installer Installs an Unverified Downloaded Executable
Content: View full analysis
\$BundleDirName\libtv.exe, for example release\0.0.9\$BundleDirName\libtv.exe Legacy layouts: release\$PlatformSlug\libtv.exe or release\libtv.exe "@ } return $tmp } ``` ```powershell function Install-FromZip([string]$ZipPath) { $extractRoot = Join-Path $env:TEMP ('libtv_cli_extract_' + [Guid]::NewGuid().ToString('N')) New-Item -ItemType Directory -Path $extractRoot | Out-Null try { Expand-Archive -LiteralPath $ZipPath -DestinationPath $extractRoot -Force $binary = Get-ChildItem -Path $extractRoot -Recurse -File -Filter 'libtv.exe' -ErrorAction SilentlyContinue | Select-Object -First 1 if (-not $binary) { $binary = Get-ChildItem -Path $extractRoot -Recurse -File -Filter 'libtv' -ErrorAction Silentl ...[truncated 2051 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install.md:111
Finding: Unverified Remote Skill Archive Is Used for Destructive Directory Replacement
Content: View full analysis
# 即含 SKILL.md / scripts/ 的目录的绝对路径 LINK_URL="$(curl -fsSL 'https://api2.liblib.art/api/www/landing-activities/getById?id=240' \ | tr -d '\\' | grep -oE '"skill"[[:space:]]*:[[:space:]]*"[^"]+"' | head -n1 | sed -E 's/.*"([^"]+)"[[:space:]]*$/\1/')" curl -fL -o /tmp/libtv-cli-skill.zip "$LINK_URL" rm -rf "$SKILL_DIR" # 删除旧 skill 目录，避免旧文件残留 mkdir -p "$SKILL_DIR" unzip -q /tmp/libtv-cli-skill.zip -d "$SKILL_DIR" cd "$SKILL_DIR" # 必须在该目录下执行 install 脚本 chmod +x scripts/install-libtv-cli.sh ./scripts/install-libtv-cli.sh ``` ```powershell # Windows：取 activity 下发的 skill zip URL，整目录替换并安装 $SkillDir = '<你的 skill 目录>' # 即含 SKILL.md / scripts\ 的目录的绝对路径 $resp = Invoke-RestMethod -Uri 'https://api2.liblib.art/api/www/landing-activities/getById?id=240' -UseBasicParsing $skillUrl = (ConvertFrom-Json $resp.data.linkUrl).skill # 直接取 skill 字段，无需拼接 Invoke-WebRequest -Uri $skillUrl -OutFile $env:TEMP\libtv-cli-skill.zip Remove-Item -Recurse -Force $SkillDir -ErrorAction SilentlyContinue # 删除旧 skill 目录 New-Item -ItemType Directory -Path $SkillDir -Force | Out-Null Expand-Archive -Path $env:TEMP\libtv-cli-skill.zip -DestinationPath $SkillDir -Force cd $SkillDir # 必须在该目录下执行 install 脚本 .\scripts\install-libtv-cli.ps1 ``` ### Technical Analysis The update procedure obtains a Skill archive URL from remote activity metadata and downloads the archive without checking its origin, digest, signature, or expected contents. It then recursively deletes the trusted existing Skill directory, extracts the unverified replacement, and runs an installer from the replacement. This creates a complete remote code-execution tr ...[truncated 1454 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (162)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as an operational CLI manual, but its referenced install flow introduces materially different behaviors: downloading remote binaries, modifying shell profiles, writing into install locations, and executing installed code. That mismatch can mislead users or agent systems into approving actions with persistence and remote code execution implications that were not clearly disclosed in the main skill contract.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · commands/login.md (reported line 3)May include surrounding context.
md
# `libtv logout` — 退出登录清除本机上由 [`libtv login`](./login.md) 写入的凭据：删除 `LIBTV_CONFIG_DIR`（默认 `~/.libtv`）下的 `credentials.json`，并清除当前进程中的内存凭据快照。 ## 子命令

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · commands/login.md (reported line 11)May include surrounding context.
md
# `libtv logout` — 退出登录清除本机上由 [`libtv login`](./login.md) 写入的凭据：删除 `LIBTV_CONFIG_DIR`（默认 `~/.libtv`）下的 `credentials.json`，并清除当前进程中的内存凭据快照。 ## 子命令

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · commands/logout.md (reported line 3)May include surrounding context.
md
# `libtv logout` — 退出登录清除本机上由 [`libtv login`](./login.md) 写入的凭据：删除 `LIBTV_CONFIG_DIR`（默认 `~/.libtv`）下的 `credentials.json`，并清除当前进程中的内存凭据快照。 ## 子命令

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The batch file silently downloads and runs a remote PowerShell script with no user-facing warning, consent, or review opportunity. This enables unnoticed execution of attacker-controlled code if the API response, linked configuration, or remote script host is compromised, and it reduces the chance a user will detect suspicious behavior before system changes occur.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 96% confidence
Finding: The documentation normalizes a curl | bash installation pattern for shell environments, which causes users to execute remote script content directly from the network. This is dangerous because any compromise of the source, redirect chain, CDN object, or URL-discovery API can lead to arbitrary command execution without giving the user a chance to review the script first.
Content: Scanner excerpt · scripts/install.md (reported line 32)May include surrounding context.
md
| 字段 | 含义 | | -------------------- | ------------------------------------------------------------ | | `version` | 最新 CLI 版本号 | | `install.shell` | macOS / Linux 一键安装脚本 URL（`curl -fsSL <url> \| bash`） | | `install.PowerShell` | Windows PowerShell 一键安装脚本 URL | | `install.CMD` | Windows cmd / 双击运行的 `.bat` URL | | `skill` | 该版本 skill 包（含本文档 + install 脚本）zip 的下载 URL |

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document explicitly instructs users to pipe a remotely downloaded PowerShell script into Invoke-Expression, which executes network content immediately without inspection, integrity verification, or signature validation. If the hosting endpoint, CDN, API-fed URL, or transit path is compromised, users could run arbitrary code on their systems with the permissions of their account.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill declares shell-capable behavior but does not specify any tool scope such as allowed-tools or permissions. In an agent environment, this creates unnecessary ambiguity about what commands may be run, which increases the chance of over-broad execution or unsafe command use beyond the documented purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description is written as an instruction set in Chinese and includes absolute wording like '一律通过 libtv CLI 完成', but nowhere in this file does it offer a language choice or explain that the skill is intentionally restricted to Chinese-speaking users or a China-specific compliance context. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file documents that account info and account use refresh the local active account scope, causing later project list and project create commands to default to a different team space. While the behavior is described, it is not presented as a warning or caution despite its potential to affect where user data is listed or created.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · commands/group.md (reported line 22)May include surrounding context.
md
**共享 flags** | 选项 | 必填 | 说明 | | ---------------------- | ---- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `-p, --project <uuid>` | 否 | 目标项目 UUID；缺省时使用目录绑定。 | | `-g, --group <父组>` | 否 | 父级**普通分组**；在其 `childNodeIds` 内解析分组名 / 子节点名，避免同名冲突。 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · commands/group.md (reported line 25)May include surrounding context.
md
| 选项 | 必填 | 说明 | | ---------------------- | ---- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `-p, --project <uuid>` | 否 | 目标项目 UUID；缺省时使用目录绑定。 | | `-g, --group <父组>` | 否 | 父级**普通分组**；在其 `childNodeIds` 内解析分组名 / 子节点名，避免同名冲突。 | | `-r, --run` | 否 | 主流程成功后对**目标普通分组**做一次**整组按顺序执行**（与网页「整组执行」一致）。进度在 stderr 约每 3 分钟一条、前缀 `[run-group]`；成功结果在 stdout，管道下为单行 NDJSON。 | | `--help` | 否 | 打印该子命令帮助。 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · commands/script.md (reported line 40)May include surrounding context.
md
| 选项 | 必填 | 说明 | | ---------------------- | ---- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `-p, --project <uuid>` | 否 | 目标项目 UUID；缺省时使用目录绑定。 | | `-g, --group <父组>` | 否 | 父级**普通分组**；在其 `childNodeIds` 内解析分组名 / 子节点名，避免同名冲突。 | | `-r, --run` | 否 | 主流程成功后对**目标普通分组**做一次**整组按顺序执行**（与网页「整组执行」一致）。进度在 stderr 约每 3 分钟一条、前缀 `[run-group]`；成功结果在 stdout，管道下为单行 NDJSON。 | | `--help` | 否 | 打印该子命令帮助。 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · node-types/README.md (reported line 67)May include surrounding context.
md
| 选项 | 必填 | 说明 | | ---------------------- | ---- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `-p, --project <uuid>` | 否 | 目标项目 UUID；缺省时使用目录绑定。 | | `-g, --group <父组>` | 否 | 父级**普通分组**；在其 `childNodeIds` 内解析分组名 / 子节点名，避免同名冲突。 | | `-r, --run` | 否 | 主流程成功后对**目标普通分组**做一次**整组按顺序执行**（与网页「整组执行」一致）。进度在 stderr 约每 3 分钟一条、前缀 `[run-group]`；成功结果在 stdout，管道下为单行 NDJSON。 | | `--help` | 否 | 打印该子命令帮助。 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · commands/group.md (reported line 27)May include surrounding context.
md
| `-p, --project <uuid>` | 否 | 目标项目 UUID；缺省时使用目录绑定。 | | `-g, --group <父组>` | 否 | 父级**普通分组**；在其 `childNodeIds` 内解析分组名 / 子节点名，避免同名冲突。 | | `-r, --run` | 否 | 主流程成功后对**目标普通分组**做一次**整组按顺序执行**（与网页「整组执行」一致）。进度在 stderr 约每 3 分钟一条、前缀 `[run-group]`；成功结果在 stdout，管道下为单行 NDJSON。 | | `--help` | 否 | 打印该子命令帮助。 | **绑定来源**（`create` / 默认子命令共用）

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · node-types/README.md (reported line 33)May include surrounding context.
md
| `-p, --project <uuid>` | 否 | 目标项目 UUID；缺省时使用目录绑定。 | | `-g, --group <父组>` | 否 | 父级**普通分组**；在其 `childNodeIds` 内解析分组名 / 子节点名，避免同名冲突。 | | `-r, --run` | 否 | 主流程成功后对**目标普通分组**做一次**整组按顺序执行**（与网页「整组执行」一致）。进度在 stderr 约每 3 分钟一条、前缀 `[run-group]`；成功结果在 stdout，管道下为单行 NDJSON。 | | `--help` | 否 | 打印该子命令帮助。 | **绑定来源**（`create` / 默认子命令共用）

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · commands/group.md (reported line 31)May include surrounding context.
md
**绑定来源**（`create` / 默认子命令共用） | 来源 | 说明 | | ----------------- | ------------------------------------------------------------------------------------------------ | | `--node <子节点>` | 子节点 **id 优先**，否则按展示名匹配（重名取第一个）；可重复指定。 | | 管道 stdin | 每行一条 JSON，读取 `nodeKey` 或 `newNodeKey`（与 `libtv node` / `libtv upload` 成功输出一致）。 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · commands/group.md (reported line 80)May include surrounding context.
md
**选项** | 选项 | 作用范围 | 说明 | | ---------------------- | --------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | `-p, --project <uuid>` | `use` / `unuse` | 缺省使用当前目录绑定；指定时须与写入的 `projectUuid` 一致。 | | `-g, --group <父组>` | 仅 `use` | 仅在指定父级普通分组的 `childNodeIds` 内解析 `<group>`，消歧义；**不是** [`libtv node -g`](./node.md) 那条「覆盖 node 分组范围」。 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · commands/image.md (reported line 9)May include surrounding context.
md
## 子命令 | 子命令 | 作用 | | --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | **`libtv image shortcut list`** | 列出当前环境可用的 Slash 项（与画布图片工具栏九宫格、图片生成器 `/` 面板一致）。 | | **`libtv image shortcut <scene\|label> -n <node>`** | 在指定源 `image` 节点上执行一条 Slash：按 `gridType` 选择「原地改图」或「右侧新建节点」，随后触发一次生成。 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · commands/image.md (reported line 52)May include surrounding context.
md
**执行分支**（由命中条目的 `gridType` 决定） | `gridType` | 画布落点 | | --------------------------- | ----------------------------------------------------------------------------------------------------------------------- | | `4` / `9` / `16` / `25` | **原地改图**：对 `-n` 的源节点直接改展示名为 `label`、合并 Slash params（`prompt` 强制为 `/`），再对同一节点 run 一次。 | | 其它（含未声明 `gridType`） | **右侧新建节点**：在源节点右侧偏移处新建一个 `image`，入边 = 源节点（replace 语义），合并 Slash params 后 run 新节点。 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · commands/image.md (reported line 61)May include surrounding context.
md
**输出** | 流 | 内容 | | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | stdout | 命令成功时为 JSON（含 `nodeKey`、`data` 等），与 [`libtv node --run`](./node.md) 的最终成功帧同构；接到管道时为单行 NDJSON，可被 [`libtv node`](./node.md) / [`libtv group`](./group.md) 作为上游消费。 | | stderr | 运行进度前缀 `[run-node] …`；失败的校验 / 接口错误以非 0 退出码呈现。 |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file documents a login flow that stores valid credentials in a local credentials.json file under a configurable directory. Although it states where the file is written, it does not give a clear user warning about the security sensitivity of those stored credentials or the need to protect the directory, which is the kind of user-data/system-integrity warning expected for a login skill.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · commands/login.md (reported line 17)May include surrounding context.
md
**选项**： | 选项 | 必填 | 说明 | | -------- | ---- | ------------------------------------------------------------------------------------------------------ | | `--open` | 否 | 尝试用系统默认浏览器打开登录链接（macOS `open`、Windows `start`、其它 `xdg-open`）。未设时仅打印链接。 | | `--help` | 否 | 打印该子命令帮助。 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · model-schema/schema.md (reported line 22)May include surrounding context.
md
**选项**： | 选项 | 必填 | 说明 | | -------- | ---- | ------------------------------------------------------------------------------------------------------ | | `--open` | 否 | 尝试用系统默认浏览器打开登录链接（macOS `open`、Windows `start`、其它 `xdg-open`）。未设时仅打印链接。 | | `--help` | 否 | 打印该子命令帮助。 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · commands/group.md (reported line 60)May include surrounding context.
md
| 选项 | 必填 | 说明 | | -------- | ---- | ------------------------------------------------------------------------------------------------------ | | `--open` | 否 | 尝试用系统默认浏览器打开登录链接（macOS `open`、Windows `start`、其它 `xdg-open`）。未设时仅打印链接。 | | `--help` | 否 | 打印该子命令帮助。 | **相关环境变量**（与 `web` 登录页地址拼装相关）：

Static analysis

No suspicious patterns detected.