Security audit

ProcessOn Mindmap Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill does generate ProcessOn mind maps, but it also performs under-scoped cloud uploads, persistent identifier tracking, and unpinned global self-update actions that users should review before installing.

Install only if you are comfortable sending the document text you summarize to ProcessOn's cloud service and being correlated by a persistent local partner identifier. Avoid using it on confidential, regulated, or proprietary material unless your organization approves that data flow, and do not accept automatic updates unless you have reviewed the exact source version being installed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:42
Finding: Unpinned Remote Package and Skill Installation
Content: View full analysis
Remediation: View remediation

other

Warning

Location: scripts/processon_mindmap_client.py:14
Finding: Undisclosed Persistent Identifier Enables Cross-Session Request Correlation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger conditions are so broad that the skill may activate for many generic summarization or organization tasks, not just explicit mind-map requests. In context, that is dangerous because the skill also performs network actions and cloud submission, so over-triggering can cause unexpected data transfer and privileged behavior on unrelated user content.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The open-ended keyword list includes many common productivity phrases, making accidental invocation likely during ordinary work tasks. Because this skill later instructs external transmission and shell-assisted workflows, broad matching materially increases the chance of unintended exposure of user content.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill requires executing shell commands for remote version checks and package installation, even though those actions are not necessary to generate mind maps. This grants command execution and remote code retrieval pathways that could be abused for arbitrary command execution, persistence, or supply-chain compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill directs submission of user-provided markdown and derived content to a cloud service, but does not require a prominent upfront notice or consent for remote data transfer. In a summarization skill, users may provide sensitive documents, meeting notes, or internal materials, so silent transmission to a third-party service materially increases confidentiality risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to install the skill directly from a remote GitHub repository using npx skills add without pinning to a specific commit, tag, or immutable version. This creates a supply-chain risk: if the upstream repository is changed, compromised, or force-pushed, future installs may fetch different code than originally reviewed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The update command uses npx skills add ... --force -g -y against an unpinned remote repository, which increases supply-chain exposure by encouraging unattended replacement of the installed skill with whatever code is currently upstream. If the repository is compromised, users may automatically install malicious updates without noticing.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes shell commands, reads files, writes temporary files, and performs network access, but the manifest does not declare any explicit tool scope or allowed-tools restrictions. That mismatch weakens least-privilege controls and makes it easier for the skill to gain broader execution capability than users or the host may expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs automatic outbound access to GitHub on every use without clearly informing the user that a network request will occur. Even if the request is only for version metadata, it still creates undisclosed external communication and may leak usage patterns or environment information.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: A mind-map generation skill should primarily transform user content, but these instructions add version probing and self-update logic that is outside the declared functional scope. Expanding behavior beyond the advertised purpose increases the attack surface and can normalize privileged actions that users did not request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The instructions prescribe a fixed Chinese message to present to users when a new version is found. This forces a specific language for user-facing communication without opt-in or locale selection, which is a natural-language policy concern for a general-purpose skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The instruction to run npx skills add https://github.com/processonai/processon-skills.git --skill processon-mindmap-generator --force -g -y installs or updates code from a remote source without pinning a specific version or commit. This creates a supply-chain risk: if the upstream repository changes or is compromised, the agent may fetch and execute unexpected code.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The client sends user-supplied Markdown content, title, theme, structure, and a persistent partnerFlag to an external ProcessOn API over the network, but the code provides no explicit runtime warning, consent prompt, or data-classification notice before transmission. In a skill designed to process arbitrary documents and notes, this can cause unintended disclosure of sensitive internal text, credentials, personal data, or proprietary material if users assume processing is local.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documentation is written entirely in Chinese and does not indicate that users may interact in other languages or that the skill is intentionally limited to a Chinese-language audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Line L078 says the final result must be pure Markdown content with no explanatory wrappers or extra output. Later, lines L156-L165 require presenting a Markdown code block as well as full online-view and image links, which directly contradicts the earlier instruction about the final output format.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The script includes user-facing argparse description and help text entirely in English, while other comments/docstrings in the file are in Chinese, indicating a mixed-language context. Because the tool does not offer any language or locale choice, it effectively imposes a specific language on users without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This JSON manifest contains user-facing preset names such as "现代活力" and "极简黑白" exclusively in Chinese. Under the policy, forcing a specific language without user choice or documented locale scope is a natural-language policy concern.
Content: No source excerpt is available for this finding.