T09 · Insecure Skill Coding Practices
Error
- Location
src/git.js:18- Finding
Arbitrary Command Execution Through Unsanitized Git URL
- Content
View full analysis
- Remediation
View remediation
Security audit
项目宣传页和长截图一键生成工具
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it has unsafe handling of remote repositories and untrusted HTML that could let attacker-controlled input run code or make network requests.
Install only if you trust the projects and HTML files you will process. Avoid using the hidden `--git` option with untrusted repository URLs, avoid rendering untrusted README/HTML content, and run it in an isolated workspace without secrets or private network access until shell-safe git invocation, HTML sanitization, and restricted Playwright rendering are added.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
src/template.js:578- Finding
Stored Script Injection Through Unsanitized Repository Content
- Content
View full analysis
📖 项目介绍
${readmeHtml}`; } return ``; } ``` Dependency names and versions are also interpolated without HTML escaping: ```javascript const cards = entries.slice(0, 18) .map(([name, version]) => { const note = findUsage(name); const showVersion = version && !version.includes('${'); return `📖 项目介绍
暂无介绍，请点击上方按钮编辑添加...
`; }) .join(''); ``` The project name is similarly inserted into HTML contexts: ```javascript ${data.projectName} - 介绍 ``` ```javascript${name}${showVersion ? `${version}` : ''}${note}${data.projectName}
``` ### Technical Analysis The generated introduction page treats repository-controlled data as trusted markup. Markdown processors commonly preserve raw HTML unless explicitly configured otherwise. `marked.parse()` is not an HTML sanitizer, so active tags and event handlers in a repository README can survive conversion. Other repository-controlled fields—including package names, package versions, and the pac ...[truncated 1912 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
src/image.js:3- Finding
Untrusted HTML Is Executed in Playwright With Unrestricted Network Access
- Content
View full analysis
{ document.body.classList.add('export-mode'); }); await page.waitForTimeout(options.waitFor || 300); await page.screenshot({ path: imagePath, fullPage: true }); await browser.close(); } ``` ### Technical Analysis The screenshot operation loads either a local file or any string beginning with `http` into a JavaScript-enabled Chromium page. There is no request interception, origin allowlist, network egress restriction, script disabling, or content validation. This is especially dangerous because: - Project-generated pages can contain unsanitized README HTML. - The CLI accepts an arbitrary existing HTML file through `--html`. - Screenshot export is enabled by default for project generation. - `page.goto()` executes scripts and waits for network activity, allowing malicious content to contact arbitrary remote or local network destinations. The `htmlPath.startsWith('http')` check is also overly broad and does not perform structured URL parsing or restrict protocols and hosts. ### Attack Path 1. An attacker provides a malicious repository or HTML file. 2. The user runs project generation with default image export, or invokes ...[truncated 1425 chars]- Remediation
View remediation
{ const requestUrl = new URL(route.request().url()); if (requestUrl.protocol === 'file:' || requestUrl.protocol === 'data:') { await route.continue(); } else { await route.abort(); } }); ``` - Accept local regular files only by default. Require an explicit, separately documented option before rendering remote URLs. - Parse URLs with `new URL()` and enforce exact protocol and host policies rather than using `startsWith('http')`. - Sanitize generated HTML before rendering. - Apply navigation, execution, and screenshot timeouts. - Run Chromium in an isolated container or restricted account with: - No access to secrets. - Restricted filesystem access. - Blocked or allowlisted network egress. - Appropriate CPU and memory limits. - Ensure the browser is closed in a `finally` block to prevent resource leakage after failures. ]]>
T03 · Remote Payload Retrieval and Execution
Warning
- Location
public/html2canvas.min.js:1- Finding
Remote Browser Script Loaded at Runtime Without Integrity Enforcement
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (27)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md path: "bin/cli.js"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md path: "bin/cli.js"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md path: "bin/cli.js"
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The top-level description says the skill 'traverses project directories' and generates an intro page, which implies local project analysis. However, the documented directory structure later lists
src/git.jsas 'git 仓库克隆' (git repository cloning), introducing remote repository acquisition behavior not reflected in the stated local-directory workflow.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README instructs users to provide an absolute local project path, then states the skill will scan the directory and generate editable HTML/PNG outputs, but it does not warn that sensitive source code, secrets in README files, dependency metadata, or private paths may be copied into generated artifacts. In an agent-skill context, this increases the risk of unintended local data exposure and filesystem writes because users may trigger broad scanning with minimal awareness of what content will be collected and rendered.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger keyword "readme" is overly generic and can match many unrelated user requests, causing the skill to activate outside its intended scope. Because this skill scans local project directories and reads repository files, accidental invocation increases the risk of unintended local file analysis and disclosure of repository contents or metadata.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documentation does not clearly warn users that providing a path will cause local directory scanning and repository file reads. In this context, that omission is security-relevant because users may supply sensitive paths without understanding that README files, dependency manifests, and project structure will be parsed and included in generated output.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The help text is presented entirely in Chinese, and the tool's default output filenames and messages also assume a Chinese locale. This creates a natural-language policy concern because the skill enforces a specific language/locale without any user opt-in or documented justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code dynamically loads executable JavaScript from a third-party CDN at runtime, which introduces a supply-chain trust dependency outside the application's control. If the CDN, package, or delivery path is compromised, arbitrary code could execute in the application's origin; the lack of user-facing disclosure is secondary to the more important issue that remote script execution is being introduced without integrity pinning or local bundling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The line states the rules include Chinese usage and later sections repeatedly require Chinese descriptions, which amounts to a language constraint in the skill instructions. Because the file does not offer a user language choice or document a justified region-specific requirement, this is a natural-language policy concern.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Several keywords such as "项目介绍", "介绍html", and "project intro" are ambiguous and overlap with general documentation or web-content tasks. In an agent environment, ambiguous triggers increase the risk of accidental invocation, which can cause the skill to act on requests better handled by other skills or by the base assistant.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger keyword "readme" is extremely broad and commonly appears in unrelated software-development requests. This can cause the skill to activate outside its intended scope, leading to incorrect tool selection, unintended content generation, or interception of user workflows that were not asking for a project intro page.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file includes a default description string in Chinese (
项目简介暂未提供，已基于代码结构自动生成。) with no apparent opt-in or locale selection. That can violate language/locale policy because the skill forces a specific language for user-facing text rather than adapting to user preference or documented regional scope.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code interpolates a user-supplied gitUrl directly into an execSync shell command, which creates a command injection risk if the URL contains shell metacharacters. In addition, cloning arbitrary repositories can trigger unsafe behavior through git transport/options abuse and performs a network-side effect without any validation or confirmation, making the skill context more dangerous rather than less.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js return resolve(null); } const [owner, repo] = match.slice(1); const apiUrl = `https://api.github.com/repos/${owner}/${repo}`; const req = https.get(apiUrl, { headers: {
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code loads either a remote HTTP(S) URL or a local file into a browser context and then writes a screenshot to the provided image path, but it includes no confirmation prompt, logging, or explanatory comment/docstring warning the user about these side effects. Because the function can access local content via file:// and persist output to disk, the safety-relevant behavior is not disclosed within this code file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The skill may perform a network operation by cloning a remote repository when
options.gitUrlis provided. In this file there is no confirmation prompt, user-facing log/message, or explanatory comment/docstring disclosing that remote content will be fetched.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The generated HTML hard-codes
lang="zh-CN", which imposes a specific language/locale on all rendered output regardless of user preference or project context. This is a natural-language policy concern because the skill does not offer any language choice or document a justified region-specific constraint.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language instructions and usage guidance are presented only in Chinese, which effectively forces a specific language for users without indicating any language choice. Under the stated policy, language-specific behavior should either be optional or clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest description is written as a Chinese-only user-facing capability statement, indicating the skill is oriented toward Chinese output without any mention of language choice or opt-in. Under the policy for natural-language violations, forcing a specific language or locale without user choice should be flagged unless clearly justified.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "author": "", "license": "MIT", "dependencies": { "marked": "^11.2.0" }, "optionalDependencies": { "playwright": "^1.58.2"
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "marked": "^11.2.0" }, "optionalDependencies": { "playwright": "^1.58.2" }, "engines": { "node": ">=18.0.0"
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
Natural-language policy review applies to all file types, including manifest files. The visible display name and description are Chinese-only, which can impose a language/locale assumption on users without offering an alternative or documenting that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The thrown error strings are written only in Chinese, which imposes a specific language on users with no opt-in or documented justification. The policy requires avoiding fixed language constraints unless the skill offers language choice or clearly documents a locale-specific purpose.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This code performs a network request to api.github.com using repository data derived from user input, but there is no confirmation prompt, user-visible log message, or explanatory comment/docstring disclosing that external network access occurs. For code files, outbound transmission of user or system data should have some visible disclosure unless clearly documented elsewhere.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/git.js:8