T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:45- Finding
Unverified Remote Script Downloaded and Executed Through a Shell Pipeline
- Content
View full analysis
- Remediation
View remediation
Security audit
aipexbase
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent BaaS web-app builder, but it uses unsafe installation steps and handles an administrator token in ways that could expose it.
Review before installing. Do not provide a real administrator token unless you are comfortable with it being written to local config files and copied into projects. Avoid running the setup commands automatically; install prerequisites through trusted, pinned methods, and exclude secret config files from deployment archives.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:55- Finding
Unpinned Global CLI and Browser Dependencies Permit Supply-Chain Code Execution
- Content
View full analysis
``` ```html ``` The SDK reference repeats the same unpinned dependency: ```html ``` ### Technical Analysis The npm command installs the latest package matching `aipexbase-cli` globally rather than selecting an audited, exact version. npm package lifecycle scripts may execute during installation. A malicious newly published version, compromised maintainer account, or registry compromise could therefore execute code on the development host. Global installation also gives the package broader reach than a project-local dependency and can affect future projects or commands using that executable. The generated browser applications load Tailwind and `aipexbase-js` from remote CDNs without exact version pinning or Subresource Integrity metadata. The `aipexbase-js` URL does not contain a version, so future page loads can receive a different package version without changes to the audited application. Both CDN resources execute JavaScript in the application's origin and consequently have access to page content, application API keys, browser storage allowed to that origin, and authenticated application operations. No evidence in the project establishes the provenance or integrity of the `aipexbase-cli` package or the browser bundles. ### Attack Path #### CLI de ...[truncated 1480 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:69- Finding
Administrator Management Token Can Be Copied Into and Uploaded With Deployable Project Files
- Content
View full analysis
/config.json` and check whether `baseUrl` and `manageToken` are configured. If the file does not exist or required fields are missing: 1. Ask the user to provide `baseUrl` 2. Ask the user to provide `manageToken` (administrator token) ``` ```bash cd cp /config.json ./baas-config.json ``` The deployment workflow recursively archives the entire project without excluding the configuration: ```bash cd zip -r project.zip . -x "node_modules/*" -x ".git/*" -x "*.zip" ``` ```bash baas -c ./baas-config.json deploy ./project.zip ``` The shipped configuration currently contains an empty token: ```json { "baseUrl": "https://baas.kuafuai.net/baas-api", "manageToken": "" } ``` The immediate repository does not expose a live token, but the documented workflow instructs users to populate and propagate one. ### Technical Analysis The Skill combines management-plane credentials and project/runtime configuration in the same JSON file. It th ...[truncated 2358 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/html-template.html:122- Finding
Unsanitized Toast Messages Are Inserted With innerHTML, Enabling DOM-Based XSS
- Content
View full analysis
', error: '', warning: '', info: '' }; toast.className = `flex items-center px-4 py-3 rounded-xl border shadow-soft-lg animate-slide-down ${styles[type]}`; toast.innerHTML = ` ${icons[type]} ${message} `; container.appendChild(toast); } ``` The style guide contains the same pattern: ```javascript toast.innerHTML = ` ${icons[type]} ${message} `; ``` ### Technical A ...[truncated 2374 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (21)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Piping curl output directly into bash is a classic unsafe command-chaining pattern that executes untrusted network content immediately. In this skill, the context makes it more dangerous because the instructions encourage automated setup, so a compromised upstream script could lead to arbitrary code execution on the host.
- Content
bash # 安装 nvm curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash # 加载 nvm 环境 source ~/.bashrc
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <body class="bg-gradient-subtle min-h-screen"> <!-- 顶部导航（玻璃态） --> <nav class="sticky top-0 z-50 glass border-b border-gray-200/50"> <div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8"> <div class="flex justify-between h-16 items-center">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <body class="bg-gradient-subtle min-h-screen"> <!-- 顶部导航(玻璃态) --> <nav class="sticky top-0 z-50 glass border-b border-gray-200/50"> <div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8"> <div class="flex justify-between h-16 items-center">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
3.10 加载状态
html <!-- 页面加载（全屏） --> <div class="fixed inset-0 bg-white/80 backdrop-blur-sm flex items-center justify-center z-50"> <div class="flex flex-col items-center"> <div class="w-12 h-12 rounded-full border-4 border-primary-200 border-t-primary-600 animate-spin"></div>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
3.10 加载状态
html <!-- 页面加载(全屏) --> <div class="fixed inset-0 bg-white/80 backdrop-blur-sm flex items-center justify-center z-50"> <div class="flex flex-col items-center"> <div class="w-12 h-12 rounded-full border-4 border-primary-200 border-t-primary-600 animate-spin"></div>
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly says new app creation and iterative code/schema changes should be performed automatically without user confirmation. Because these operations can create resources, mutate schemas, and alter project code, they can cause unintended data-impacting changes and surprise side effects if the agent misinterprets requirements.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs installation of system-level tooling and package modifications, including piping a remote installer into bash and using sudo to install OS packages. For a frontend/BaaS development skill, these actions expand the host attack surface and can change the environment in ways unrelated to the immediate task, especially if run automatically without explicit user consent.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The sudo apt-get install step requires elevated privileges and modifies the host operating system. In an agent skill context, privilege escalation is risky because it can make persistent system changes beyond the task scope and magnify harm if any preceding command or package source is compromised.
- Content
npm i aipexbase-cli -g
安装 zip（部署打包时需要）
sudo apt-get install -y zip
text ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs collecting a manageToken and storing it in a shared config.json without any warning about secret handling, access control, or file exposure. Administrator tokens are highly sensitive; placing them in project-accessible configuration files increases the risk of accidental disclosure, reuse across projects, and privilege misuse.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill instructs the agent to use external public image/network sources during data insertion even though this is not essential to core app generation. This can cause unreviewed third-party network access, introduce privacy and licensing issues, and make builds depend on untrusted remote content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file includes a delete example that removes database records, but the surrounding description provides no warning that deletion is destructive or may permanently affect user data. For markdown files, safety-relevant behaviors that can impact data integrity should be accompanied by an explicit caution to users.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes an end-to-end web application development skill, where database, auth, deployment, and normal frontend implementation details are expected. This reference file additionally instructs use of unrelated platform-extension capabilities such as package tracking, geolocation, robot/webhook notifications, email sending, and arbitrary custom API invocation, which go beyond what is inherently required for generic frontend app construction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Line L01 presents the document heading and instructions entirely in Chinese, including a directive that constrains how the PRD should be produced. Because this is a reusable template rather than a clearly region-specific compliance artifact, it effectively forces a specific language/locale without opt-in, which matches the stated policy-violation category.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The style guide is written as a mandatory standard and begins by requiring all pages to follow it, but it is entirely in Chinese with no indication that language choice is optional or region-specific. This creates a natural-language locale policy issue because it effectively forces one language/locale without user opt-in or documented justification.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The Toast example builds HTML with
toast.innerHTMLand interpolates${message}directly into the DOM. Ifmessagecan contain user-controlled content, this creates a DOM XSS sink that can execute arbitrary script or markup, which is especially risky in a frontend skill intended as reusable guidance.- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
Fetching and executing a remote installation script from GitHub introduces supply-chain risk because the script content is not reviewed at execution time and could change or be compromised. In a skill designed to run autonomously, this is especially dangerous because it normalizes executing remote code during setup.
- Content
bash # 安装 nvm curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash # 加载 nvm 环境 source ~/.bashrc
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill recommends using third-party image URLs but omits warnings about outbound network access, content provenance, licensing, and potential leakage of search terms or project context. While lower severity, this still creates compliance and privacy risks when agents fetch or embed external assets automatically.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The documentation demonstrates updating database records, including changing user status, but does not mention that this alters persisted user data and should be done carefully. In markdown skill guidance, state-changing operations that affect user data should disclose their impact so users understand the risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file's instructional content is presented entirely in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context. This creates a natural-language policy concern because it implicitly enforces a specific language without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The HTML document hard-codes
lang="zh-CN", and the visible UI text throughout the template is also fixed in Chinese. For a general-purpose template, this is a natural-language locale constraint without any user opt-in or documented region-specific justification.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
L825-L829 明确规定上传失败必须有 toast 提示，但图片上传相关函数 handleUpload、handleDrop、showPreview 仅处理成功预览路径，没有文件过大、类型非法、读取失败等错误处理，也没有调用 showToast。这里不是简单的说明不完整，而是文档中的“必须”要求与示例代码行为不一致。
- Content