Security audit

Document to Mindmap

Security checks for vulnerabilities and agentic risk

Overview

This skill does generate ProcessOn mind maps, but it also pushes full document content to ProcessOn, mandates remote version checks and unpinned forced updates, and stores a persistent identifier without clear user control.

Review this skill carefully before installing. It is not classified as malicious, but use it only for documents you are allowed to send to ProcessOn, avoid confidential or regulated content unless your organization approves that service, and do not accept the automatic forced update flow unless you have independently verified the source and version. Be aware that it can store a persistent local partner identifier and may delete Markdown inputs placed under temp or `.agents/cache` paths.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:40
Finding: Mandatory Version Check, Task Interruption, and Output Control
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:40
Finding: Forced Global Installation from Mutable Remote Sources
Content: View full analysis
Remediation: View remediation

other

Warning

Location: scripts/document_to_mindmap_client.py:70
Finding: Undisclosed Persistent Identifier Stored Locally and Sent to ProcessOn
Content: View full analysis
Remediation: View remediation

other

Error

Location: scripts/document_to_mindmap_client.py:239
Finding: Complete Document Content Transmitted to an External Service Without a Per-Request Consent Gate
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/document_to_mindmap_client.py:177
Finding: Automatic Deletion of Caller-Owned Markdown Files in Temporary Directories
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest presents a content-structuring tool, but the embedded instructions add remote update and code execution behavior not disclosed by that purpose. This mismatch is dangerous because users may provide sensitive documents expecting summarization, while the skill silently performs unrelated operational actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill mandates shell execution and remote version checks before normal use, even though the advertised function is document-to-mindmap conversion. This expands the attack surface unnecessarily and enables network and command execution paths that are unrelated to the user’s core request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill documentation is written entirely in Chinese and provides no indication that other languages are supported or that Chinese is required for a region-specific reason. This can constitute a language/locale policy violation because the skill appears to impose a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to install the skill via npx skills add from a GitHub repository without pinning a specific immutable version, tag, or commit. This creates a supply-chain risk because future upstream changes could alter what gets installed, allowing users to fetch unexpected or malicious code if the repository or package path is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The update command uses npx skills add ... --force -g -y against an unpinned GitHub source, which increases supply-chain exposure because it encourages unattended retrieval and replacement of local skill code from a mutable remote source. If the upstream repository is changed maliciously, users may automatically overwrite a previously trusted installation with compromised content.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill uses capabilities that imply file access, network access, and possible file creation/cleanup, but it declares no explicit tool or permission scope. That creates an overbroad trust boundary: a host may permit execution without clear user/admin review of what the skill can access or transmit.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest explicitly limits the skill to knowledge-organization graphics and says it is not for technical diagram generation. Later instructions direct the model to include code blocks, mathematical formulas, and external image placeholders in output, which conflicts with the earlier intent framing of a pure mind-map transformation tool and broadens output semantics beyond the stated restriction.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation section says the skill should trigger whenever a request involves broad concepts like structured organization, summarization, knowledge extraction, or framework generation, and the keyword list includes many generic work and study phrases. These descriptions lack clear boundaries or negative examples, so the skill could be invoked for many ordinary requests that do not specifically call for this specialized tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill requires shell execution and network access before normal operation, but the description does not clearly warn users about those actions. In context, this is dangerous because a document-processing skill may be given sensitive files, and users are not told that operational commands and remote checks happen automatically.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The required update prompt text is hard-coded in Chinese and the skill content generally directs Chinese-language interaction, but there is no opt-in or statement that the skill is intended only for Chinese-speaking users. This can violate language or locale policy expectations when used in broader multilingual environments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill instructs the agent to run npx skills add ... --force -g -y, which fetches and installs remote code without pinning an exact version or immutable commit. This creates a supply-chain risk: if the upstream package/repo changes or is compromised, the agent could execute attacker-controlled code during an update flow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill directs content to a cloud service for mindmap generation, including uploaded documents, webpages, and OCR-extracted image text, but it does not provide a clear privacy warning or consent step. That can result in unintentional exfiltration of confidential or regulated data to a third party.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The client sends user-supplied markdown content to https://smart.processon.com/v1/api/transform/md, which may contain sensitive document text, but the code provides no runtime disclosure, consent prompt, or data-classification check before exfiltrating it off-host. In a document summarization skill, users may reasonably pass internal reports, meeting notes, or proprietary materials, so silent transmission to a third-party service creates a real confidentiality risk even if it is required for functionality.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The code persistently stores a generated or normalized partnerFlag under ~/.processon/partner_flags or the skill directory without notifying the user. Although this value is not a secret in the usual sense, undisclosed persistent identifier storage enables cross-run tracking/correlation and creates a privacy concern, especially when paired with API requests that include the same identifier.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This JSON file contains user-facing preset names such as "现代活力" and "复古单色" only in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language locale violation, and the file provides no indication of localization alternatives or a documented Chinese-only scope.
Content: No source excerpt is available for this finding.