Interactive Widget

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:47 AM UTC
• Version: 0.1.2

Overview

The skill appears purpose-built for widgets, but it publishes potentially sensitive content to a persistent remote service with insufficient guardrails.

Install only if you are comfortable with widget content and form submissions going to the configured widget service and becoming durable/shareable. Do not use it for secrets, credentials, regulated personal data, or confidential business records unless access controls and retention are separately verified. Prefer pinning the CLI version, reviewing the package source, escaping all untrusted text before inserting it into HTML, and avoiding mutable third-party CDN scripts for sensitive pages.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:20

Finding

Unpinned Global npm Package Installation Creates a Supply-Chain Execution Risk

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:33

Finding

Potentially Sensitive Widget Content Is Uploaded to an External Persistent Service Without a Mandatory Consent Gate

Content

View full analysis

/tmp/w-{wid}.html << 'SKELETON'

Title

Subtitle

SKELETON cat /tmp/w-{wid}.html | duoduo-widget update --wid "wid_..." ``` The external destination and persistence behavior are documented later: ```markdown Finalized artifacts are permanent. Fork: `open --fork `. ## Environment `WIDGET_SERVICE_URL` env var (default: `https://aidgets.dev`). ``` Interactive form values may also be submitted through the hosted widget: ```html Label ``` ### Technical Analysis The Skill pipes generated HTML into `duoduo-widget update`, whose default service endpoint is `https://aidgets.dev`. The generated page may contain dashboard records, operational data, form fields, confirmation values, or other information originating from the conversation. Remote hosting is directly related to the declared purpose of creating durable, shareable pages, so the network operation is not inherently covert or unrelated. However, the instructions do not impose a mandatory sensitivity review or explicit informed-consent step before upload. They also do not require redaction, audience restrictions, deletion controls, or a warning that final artifacts are permanent. The Skill can additionally create interactive forms and wait for submitted values. Those values cross a remote service boundary, but the documentation does not establish which information must ne ...[truncated 1651 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/html_patterns.md:116

Finding

Remotely Executed Chart.js Dependency Is Not Pinned to an Immutable Version or Protected by Integrity Verification

Content

View full analysis

``` The Skill also broadly permits scripts from several external CDN providers: ```markdown - Inline styles only. CDN: `cdnjs.cloudflare.com`, `esm.sh`, `cdn.jsdelivr.net`, `unpkg.com` - Forbidden: `fetch()`, `XMLHttpRequest`, `WebSocket`, `eval()`, `new Function()` ``` ### Technical Analysis The Chart.js URL specifies only the major version, `@4`, rather than an immutable release. A compatible package release can therefore change the JavaScript executed by previously generated or newly opened widgets without any corresponding change to the reviewed Skill files. The script element does not use Subresource Integrity (`integrity`) or `crossorigin`. Browser viewers consequently trust whatever JavaScript the CDN serves for that mutable URL. The restrictions against `fetch`, `XMLHttpRequest`, and similar constructs apply to authored templates, but they do not technically prevent a compromised external script from performing network operations or reading page content. Loading a chart library is necessary for the supplied chart template, but allowing mutable executable code from multiple CDNs is broader than the minimum privilege needed. ### Attack Path 1. An attacker compromises the CDN, upstream package publication account, or a release selected by the major-version URL. 2. The mutable `@4` path begins serving modified JavaScript. 3. A user opens a generated widget containing the chart template. 4. The browser downloads and executes the modified script in the page context. 5. The script can inspect rendered widget data and interact with browser-accessible APIs available to that origin. 6. D ...[truncated 600 chars]

Remediation

View remediation

``` 2. Prefer self-hosting a reviewed copy on the trusted widget service. 3. Add Subresource Integrity and ensure the digest is updated only through a controlled dependency-review process. 4. Restrict allowed script sources with a Content Security Policy. 5. Reduce the CDN allowlist to the smallest necessary set instead of permitting four interchangeable external sources. 6. Isolate widgets from privileged service interfaces using a sandboxed iframe and a separate origin. 7. Keep sensitive data outside pages that execute third-party JavaScript whenever possible. 8. Re-review the exact dependency version before upgrading it. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

<div style="background:#1a1a1a;color:#e0e0e0;padding:20px;font-family:system-ui;min-height:100vh;">
  <h1 style="color:#fff;font-size:28px;font-weight:500;margin:0 0 4px;">Title</h1>
  <p style="color:#999;font-size:14px;margin:0 0 20px;">Subtitle</p>
<!-- NEXT -->
</div>
SKELETON
cat /tmp/w-{wid}.html | duoduo-widget update --wid "wid_..."

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

<p style="margin:0;color:#999;font-size:14px;">Content — $100 safe, no escaping needed</p>
</div>
<!-- NEXT -->"""
html = html.replace('<!-- NEXT -->', section)
open(f, 'w').write(html)
PYEOF
cat /tmp/w-{wid}.html | duoduo-widget update --wid "wid_..."

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description emphasizes permanent browser URLs but does not prominently warn that finalized artifacts are durable and shareable, which can cause accidental publication of sensitive or regulated information. In an agent setting, this omission materially affects user consent and safe tool selection.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are broad enough to match many ordinary requests, increasing the chance this skill is invoked when a plain-text response would suffice. Because the skill produces durable, browser-accessible artifacts, over-triggering expands exposure of sensitive content and increases the odds of unsafe HTML generation in contexts that did not require it.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly states that raw HTML is safe and needs no escaping in a system that creates permanent, shareable web pages. That guidance can lead an agent to interpolate untrusted user or data content directly into HTML or patch payloads, enabling stored XSS, UI redressing, or malicious script/event injection in artifacts opened by other users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.