平台监控助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:29 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a real platform-monitoring tool, but its broad URL fetching and opt-out scheduled execution need careful review before installation.

Install only if you are comfortable with a tool that can make repeated network requests to configured URLs and persist scheduled checks. Review monitored URLs carefully, avoid private/internal/token-bearing URLs, update dependencies, and manually inspect or disable any cron or Windows scheduled tasks the installer creates.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/announcement.js:23

Finding

Server-Side Request Forgery Through Unrestricted Monitoring URLs

Content

View full analysis

{ const url = new URL(urlStr); const lib = url.protocol === 'https:' ? https : http; const req = lib.get(urlStr, { timeout: timeoutMs, headers: { 'User-Agent': 'Mozilla/5.0 PlatformMonitor/1.1' } }, (res) => { const chunks = []; res.on('data', d => chunks.push(d)); res.on('end', () => { resolve({ statusCode: res.statusCode, body: Buffer.concat(chunks).toString('utf8') }); }); }); req.on('timeout', () => { req.destroy(); reject(new Error(`timeout after ${timeoutMs}ms`)); }); req.on(' ...[truncated 2988 chars]

Remediation

View remediation

T06 · System Persistence

Note

• Location: scripts/install.sh:52

Finding

Recurring Scheduled Execution Uses an Opt-Out Installation Default

Content

View full analysis

> monitor.log 2>&1" # 检查是否已存在 if crontab -l 2>/dev/null | grep -q "monitor.js"; then echo " ⚠️ cron 任务已存在" else # 添加新的 cron 任务 (crontab -l 2>/dev/null; echo "$CRON_CMD") | crontab - echo " ✅ 定时任务已创建" echo " 每天 09:00 和 21:00 运行" fi fi ``` ```powershell # scripts/install.ps1:55-79 $setupCron = Read-Host "是否设置定时任务（每天9:00和21:00运行）？ (Y/n)" if ($setupCron -ne "n") { # 创建定时任务脚本 $taskScript = @" # Platform Monitor 定时任务 `$cwd = Get-Location `$nodePath = (Get-Command node).Source `$scriptPath = Join-Path `$cwd "monitor.js" # 创建任务 `$action = New-ScheduledTaskAction -Execute "`$nodePath" -Argument "`$scriptPath" -WorkingDirectory `$cwd `$trigger1 = New-ScheduledTaskTrigger -Daily -At "09:00" `$trigger2 = New-ScheduledTaskTrigger -Daily -At "21:00" Register-ScheduledTask -TaskName "PlatformMonitor-Morning" -Action `$action -Trigger `$trigger1 -Description "平台监控-早班" -Force Register-ScheduledTask -TaskName "PlatformMonitor-Evening" -Action `$action -Trigger `$trigger2 -Description "平台监控-晚班" -Force Write-Host "✅ 定时任务已创建" Write-Host " 早班: 每天 09:00" Write-Host " 晚班: 每天 21:00" "@ $taskScriptPath = "setup_cron_temp.ps1" $taskScript | Out-File -FilePath $taskScriptPath -Encoding UTF8 Write-Host " 请以管理员身份运行以下命令:" -ForegroundColor Yellow Write-Host " powershell -ExecutionPolicy Bypass -File $taskScriptPath" -ForegroundColor Cyan } ``` ### Technical Analysis Recurring monitoring is consistent with the Skill's declared scheduled-monitoring functiona ...[truncated 2702 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/monitor.js:459

Finding

Unbounded Response Buffering Can Exhaust Process Memory

Content

View full analysis

{ const chunks = []; res.on('data', d => chunks.push(d)); res.on('end', () => { resolve({ statusCode: res.statusCode, body: Buffer.concat(chunks).toString('utf8') }); }); }); ``` ```js // scripts/competitor.js:21-33 function httpGet(urlStr, timeoutMs) { return new Promise((resolve, reject) => { const url = new URL(urlStr); const lib = url.protocol === 'https:' ? https : http; const req = lib.get(urlStr, { timeout: timeoutMs, headers: { 'User-Agent': 'Mozilla/5.0 PlatformMonitor/1.1' } }, (res) => { const chunks = []; res.on('data', d => chunks.push(d)); res.on('end', () => { resolve({ statusCode: res.statusCode, body: Buffer.concat(chunks).toString('utf8') }); }); }); req.on('timeout', () => { req.destroy(); reject(new Error(`timeout after ${timeoutMs}ms`)); }); req.on('error', reject); }); } ``` ```js // scripts/announcement.js:23-28 async function fetchStaticPage(url, timeoutMs = 15000) { const res = await axios.get(url, { timeout: timeoutMs, headers: { 'User-Agent': 'Mozilla/5.0 PlatformMonitor/2.0' } }); return res.data; } ``` ### Technical Analysis The native HTTP implementations append every received chunk to an array and concatenate the complete response only after the server finishes sending data. No maximum response size, content-length limit, streaming parser, or accepted content-type policy is applied. The Axios request similarly does not specify an application-level response-size limit. The announcement fallback can also launch Playwri ...[truncated 1596 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This variant of the mismatch finding includes undeclared local file read/write and configuration/history import-export behavior. Undisclosed persistence is security-relevant because users may provide URLs, names, or internal endpoints that are then stored locally without clear consent, increasing privacy and integrity risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

This variant of the mismatch finding includes undeclared local file read/write and configuration/history import-export behavior. Undisclosed persistence is security-relevant because users may provide URLs, names, or internal endpoints that are then stored locally without clear consent, increasing privacy and integrity risk.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Using the standalone trigger "帮助" is especially dangerous because it is a ubiquitous, context-free phrase likely to appear in ordinary chats. This can spuriously activate the skill and steer the agent into a workflow that exposes configuration details, prompts for URLs, or progresses toward persistent actions not intended by the user.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md

AI 自动调用 `monitor.js`，返回结果。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md

AI 自动调用 `monitor.js`，返回结果。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

md

AI 自动调用 `monitor.js`，返回结果。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

md

AI 自动调用 `monitor.js`，返回结果。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.

md

AI 自动调用 `monitor.js`，返回结果。

Known Vulnerable Dependency: axios==1.16.1 — 10 advisory(ies): CVE-2026-67313 (Axios: Excessive recursion in formDataToJSON can cause denial of service); CVE-2026-67319 (Axios: Nested axios option objects can consume polluted prototype values); CVE-2026-67315 (Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios) +7 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The lockfile pins axios 1.16.1, which the static analysis indicates is affected by multiple published vulnerabilities including denial of service, prototype-pollution-related behavior, and proxy bypass issues. In this monitoring skill, axios is likely used for outbound health checks and integrations, so a vulnerable HTTP client increases risk when processing attacker-controlled URLs, redirects, proxy settings, or response data from monitored platforms.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The lockfile includes form-data 4.0.5, which is reported as vulnerable to CRLF injection in multipart field names/filenames. If this skill sends notifications, attachments, or webhook payloads using multipart requests and any field metadata can be influenced by external input, an attacker may be able to manipulate outbound HTTP requests or smuggle unintended headers/content.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==7.26.0 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The lockfile contains undici 7.26.0, which the findings associate with multiple HTTP parsing, queue poisoning, and response desynchronization issues. This skill’s purpose is broad platform monitoring and web fetching, making HTTP client correctness security-relevant: interacting with many external services increases exposure to malicious or malformed responses that could cause data leakage, request mix-ups, or crashes.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.16.1 — 10 advisory(ies): CVE-2026-67313 (Axios: Excessive recursion in formDataToJSON can cause denial of service); CVE-2026-67319 (Axios: Nested axios option objects can consume polluted prototype values); CVE-2026-67315 (Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios) +7 more

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The file declares axios 1.16.1, which the scanner reports as having multiple known advisories including denial-of-service and proxy/prototype-related issues. This is especially relevant for a platform-monitoring skill because it makes outbound HTTP requests to arbitrary platforms, so vulnerable request-handling code could be exposed by attacker-controlled responses, crafted inputs, or proxy environments.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill instructs the agent to read and write local configuration files and create scheduled tasks, but it does not declare any explicit tool scope or permissions boundaries. In a skill context, missing capability declarations can cause the host agent to invoke filesystem or environment-related operations without clear user-visible consent or sandbox expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Overly broad trigger phrases increase the chance of accidental activation during normal conversation, which can lead the agent to perform network checks, persist configuration, or initiate monitoring flows without clear intent. In this skill, that risk is amplified because activation may lead to file writes or future task creation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The additional trigger list contains broad phrases that overlap with common user requests, making accidental or adversarial triggering more likely. Because this skill supports arbitrary URL monitoring and saved configurations, unintended activation could lead to unnecessary network access or persistent state changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill describes saving user-provided platform names and URLs into a local configuration file but does not warn users about that persistence or its location. This is dangerous because stored URLs may contain private endpoints, tokens, tenant identifiers, or other sensitive metadata, and users are not given clear consent, retention, or deletion information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill states that it will create scheduled tasks automatically for timed monitoring, but it does not warn the user that this changes system state and may persist beyond the conversation. Silent task creation can surprise users, generate repeated network traffic, and create an unwanted foothold for future automated actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest presents the skill description and tool descriptions only in Chinese, which can force a specific language experience without any user opt-in or documented locale constraint. The policy requires either offering language choice or clearly justifying the locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs users to set up automatic scheduled tasks and configure outbound webhook notifications, but it does not clearly warn that the tool will run persistently in the background and transmit monitoring results to third-party messaging services. This can lead users to enable continuous execution and data egress without informed consent, which is a real security and privacy concern for an installation-oriented skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/README.md (reported line 100)May include surrounding context.

手动创建：

bash

# 编辑 crontab
crontab -e

# 添加以下行（每天9:00和21:00运行）
0 9,21 * * * cd /path/to/platform-monitor && node monitor.js >> monitor.log 2>&1

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file's descriptive comments and runtime status messages are written exclusively in Chinese, indicating a language-specific behavior without any opt-in, fallback, or documented rationale. Under the policy, forcing a specific language without user choice is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s descriptive comments and all user-facing status/alert strings are written in Chinese, indicating the skill is designed to communicate in a fixed language. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script's title, usage guidance, prompts, status messages, and next-step instructions are all presented in Chinese, which imposes a specific language on users. The file does not offer an English alternative, locale selection, or any documented justification that this is a region-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's title, usage guidance, status messages, prompts, and next-step instructions are presented in Chinese throughout. This imposes a specific language on users with no opt-in or alternative, which matches the policy category for language/locale violations.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 14)May include surrounding context.

sh

if ! command -v node &> /dev/null; then
    echo "  ❌ 未找到 Node.js，请先安装: https://nodejs.org/"
    echo "  macOS: brew install node"
    echo "  Ubuntu: sudo apt install nodejs npm"
    exit 1
fi
NODE_VERSION=$(node --version)

Static analysis

No suspicious patterns detected.