Security audit

ProcessOn Diagram Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended to generate ProcessOn diagrams, but it overreaches by forcing broad diagram requests through an external service and by installing/running npm tooling and persisting tokens with limited safeguards.

Install only if you are comfortable sending diagram prompts and any included code or architecture details to ProcessOn, and review the setup script first. Avoid using it for sensitive internal systems unless endpoint settings and token storage are controlled. Prefer a pinned release, install mcporter deliberately yourself, and avoid automatic global npm installation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:3
Finding: Mandatory Skill Invocation Hijacks Agent Tool Selection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: setup.mjs:76
Finding: Automatic Download and Global Installation of an Unverified npm Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: setup.mjs:23
Finding: Environment-Controlled MCP Endpoint Can Receive the Persisted Bearer Token
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (35)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill uses extremely broad mandatory trigger language ('any structured diagram', plus common phrases like '画图' and '生成图表') and insists it must be called preferentially. This can hijack unrelated or only loosely related user requests, forcing the agent into shell/network/auth flows and external service usage without meaningful user intent or informed consent.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The invocation rules contain ambiguous catch-all requirements such as any request involving '画图', '可视化', or '生成图表' must use this skill and must not be bypassed. In context, this is dangerous because invocation leads into external auth, token handling, network checks, and MCP calls, so ambiguous routing can escalate ordinary conversation into unnecessary privileged operations.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.
md
node ./setup.mjs processon_check_and_start_auth

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: checkMcporter() performs npm install -g mcporter@..., modifying the host system globally to satisfy the skill's dependency. Global installation is unnecessary for the stated purpose and gives the skill persistent host-modification capability, increasing supply-chain risk and violating least privilege.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README states the skill uses browser-based authorization and MCP, and advertises using natural language and code context, but it does not clearly warn that user prompts, diagram content, and possibly contextual code/data may be transmitted to the external ProcessOn service. This can lead to unintended disclosure of sensitive business logic, architecture details, or source code, especially because the skill is designed to be triggered broadly for diagram-generation tasks.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README instructs users to install and update the skill via npx skills from a GitHub repository without pinning an immutable version, tag, or commit. This creates a supply-chain risk: future upstream changes or a compromised repository/package could cause users to fetch and run different code than was originally reviewed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The forced update command again pulls the skill from GitHub without a pinned version and explicitly encourages overwriting the current installation. If the upstream source changes maliciously or unexpectedly, users may automatically replace a known-good version with unreviewed code.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes shell/Node commands, performs network access, and manages tokens, yet the manifest does not declare an explicit tool scope or allowed-tools policy. That mismatch weakens containment and review because the runtime capabilities materially exceed what the manifest communicates, increasing the chance of unintended command execution or secret handling.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: setup.mjs:57

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: setup.mjs:120