Security audit

ProcessOn Mindmap Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill does generate ProcessOn mind maps, but it also performs under-scoped cloud uploads, persistent identifier tracking, and unpinned global self-update actions that users should review before installing.

Install only if you are comfortable sending the document text you summarize to ProcessOn's cloud service and being correlated by a persistent local partner identifier. Avoid using it on confidential, regulated, or proprietary material unless your organization approves that data flow, and do not accept automatic updates unless you have reviewed the exact source version being installed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:42
Finding: Unpinned Remote Package and Skill Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:42-49`; also documented in `README.md:7-14` **Vulnerability Type**: Supply-chain risk from mutable, unverified remote dependencies **Risk Level**: High ### Vulnerable Code ```markdown - [ ] **Check cloud version**: Immediately invoke `run_shell_command` to execute: `python3 -c "import urllib.request, json; print(json.load(urllib.request.urlopen('https://raw.githubusercontent.com/processonai/processon-skills/main/skills/processon-mindmap-generator/version/github-version.json', timeout=3))['version'])"`. ``` ```markdown - **Execute update**: If the user agrees, immediately execute: `npx skills add https://github.com/processonai/processon-skills.git --skill processon-mindmap-generator --force -g -y` ``` The same installation commands appear in `README.md`: ```bash npx skills add https://github.com/processonai/processon-skills.git --skill processon-mindmap-generator ``` ```bash npx skills add https://github.com/processonai/processon-skills.git --skill processon-mindmap-generator --force -g -y ``` ### Technical Analysis The update procedure executes an unpinned `npx` package and installs Skill content from a mutable GitHub repository reference. Neither the version of the `skills` command-line package nor the repository commit is cryptographically pinned. The options `--force`, `-g`, and `-y` make the operation particularly sensitive: - `--force` allows an existing installation to be overwritten. - `-g` installs the Skill globally rather than limiting it to the current project. - `-y` suppresses interactive package confirmation. - The repository URL does not identify an immutable commit or signed release. - The version metadata is retrieved from the mutable `main` branch and is not authenticated independently through a signature or checksum. Although user consent is requested before the update, consent does not mitigate compromise of the npm package, GitHub account, repository, branch, rel ...[truncated 1578 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the installer package to an explicitly reviewed version, for example by invoking an exact package version rather than an implicitly resolved latest version. 2. Pin the GitHub source to an immutable commit hash or verified signed release tag. 3. Publish and verify a cryptographic checksum or signature before installing downloaded Skill content. 4. Do not derive installation trust solely from a version file hosted in the same mutable repository as the payload. 5. Remove `--force`, `-g`, and `-y` from the default update path. Require explicit confirmation before overwriting an installation or changing global state. 6. Download updates into a staging directory and display the source revision, changed files, and requested permissions before activation. 7. Prefer a project-local installation so that a compromised update cannot affect every project using the user's global Skill installation. 8. Preserve the previous reviewed version and provide an atomic rollback mechanism. 9. Restrict automatic checks to signed release metadata and clearly separate update notification from installation. ]]>

other

Warning

Location: scripts/processon_mindmap_client.py:14
Finding: Undisclosed Persistent Identifier Enables Cross-Session Request Correlation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/processon_mindmap_client.py:14-16, 70-105, 241, 280-281` **Vulnerability Type**: Undisclosed persistent tracking and cross-session correlation **Risk Level**: Medium ### Vulnerable Code The script defines persistent storage locations in the user's home directory and inside the installed Skill: ```python PARTNER_FLAG_DIR = os.path.join(os.path.expanduser("~"), ".processon", "partner_flags") PARTNER_FLAG_PATH = os.path.join(PARTNER_FLAG_DIR, f"{SKILL_NAME}.json") SKILL_PARTNER_FLAG_PATH = os.path.join(SKILL_ROOT_DIR, ".partner_flag.json") ``` It reads an existing identifier from either location: ```python def load_partner_flag(): for file_path in (PARTNER_FLAG_PATH, SKILL_PARTNER_FLAG_PATH): partner_flag = load_partner_flag_from_path(file_path) if partner_flag: return partner_flag return None ``` It persists the identifier: ```python def save_partner_flag_to_path(file_path, partner_flag): try: os.makedirs(os.path.dirname(file_path), exist_ok=True) with open(file_path, "w", encoding="utf-8") as f: json.dump({"partnerFlag": partner_flag}, f, ensure_ascii=False, indent=2) return True except Exception: return False def save_partner_flag(partner_flag): for file_path in (PARTNER_FLAG_PATH, SKILL_PARTNER_FLAG_PATH): if save_partner_flag_to_path(file_path, partner_flag): return True return False ``` A UUID-derived value is created when no identifier exists: ```python def build_partner_flag(): return f"skill_mind_official_{uuid.uuid4()}" def get_or_create_partner_flag(): partner_flag = normalize_partner_flag(load_partner_flag()) if partner_flag: save_partner_flag(partner_flag) return partner_flag partner_flag = build_partner_flag() save_partner_flag(partner_flag) return partner_flag ``` The identifier is created or loaded on every invocation ...[truncated 2613 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the persistent partner identifier if it is not required for core mind-map generation. 2. If attribution is operationally necessary, disclose: - what the identifier represents; - where it is stored; - which service receives it; - how long it is retained; - whether it is used for analytics, referral attribution, or tracking. 3. Require explicit opt-in before creating or transmitting a persistent identifier. 4. Add a command-line option such as `--no-partner-flag` and make privacy-preserving behavior the default. 5. Provide a documented command to inspect, rotate, and delete the identifier. 6. Prefer an ephemeral per-request identifier if request uniqueness is needed without cross-session correlation. 7. Do not write runtime tracking state into the installed Skill directory. 8. Apply restrictive file permissions if any local identifier must be retained. 9. Present a clear warning before uploading confidential content, stating that the complete title and Markdown body are sent to a third-party cloud service. 10. Document the service's retention and deletion controls so users can make an informed decision before submission. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger conditions are so broad that the skill may activate for many generic summarization or organization tasks, not just explicit mind-map requests. In context, that is dangerous because the skill also performs network actions and cloud submission, so over-triggering can cause unexpected data transfer and privileged behavior on unrelated user content.

Vague Triggers

High

Confidence: 96% confidence
Finding: The open-ended keyword list includes many common productivity phrases, making accidental invocation likely during ordinary work tasks. Because this skill later instructs external transmission and shell-assisted workflows, broad matching materially increases the chance of unintended exposure of user content.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill requires executing shell commands for remote version checks and package installation, even though those actions are not necessary to generate mind maps. This grants command execution and remote code retrieval pathways that could be abused for arbitrary command execution, persistence, or supply-chain compromise.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill directs submission of user-provided markdown and derived content to a cloud service, but does not require a prominent upfront notice or consent for remote data transfer. In a summarization skill, users may provide sensitive documents, meeting notes, or internal materials, so silent transmission to a third-party service materially increases confidentiality risk.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to install the skill directly from a remote GitHub repository using `npx skills add` without pinning to a specific commit, tag, or immutable version. This creates a supply-chain risk: if the upstream repository is changed, compromised, or force-pushed, future installs may fetch different code than originally reviewed.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The update command uses `npx skills add ... --force -g -y` against an unpinned remote repository, which increases supply-chain exposure by encouraging unattended replacement of the installed skill with whatever code is currently upstream. If the repository is compromised, users may automatically install malicious updates without noticing.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes shell commands, reads files, writes temporary files, and performs network access, but the manifest does not declare any explicit tool scope or allowed-tools restrictions. That mismatch weakens least-privilege controls and makes it easier for the skill to gain broader execution capability than users or the host may expect.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs automatic outbound access to GitHub on every use without clearly informing the user that a network request will occur. Even if the request is only for version metadata, it still creates undisclosed external communication and may leak usage patterns or environment information.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: A mind-map generation skill should primarily transform user content, but these instructions add version probing and self-update logic that is outside the declared functional scope. Expanding behavior beyond the advertised purpose increases the attack surface and can normalize privileged actions that users did not request.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The instructions prescribe a fixed Chinese message to present to users when a new version is found. This forces a specific language for user-facing communication without opt-in or locale selection, which is a natural-language policy concern for a general-purpose skill.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The instruction to run `npx skills add https://github.com/processonai/processon-skills.git --skill processon-mindmap-generator --force -g -y` installs or updates code from a remote source without pinning a specific version or commit. This creates a supply-chain risk: if the upstream repository changes or is compromised, the agent may fetch and execute unexpected code.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The client sends user-supplied Markdown content, title, theme, structure, and a persistent partnerFlag to an external ProcessOn API over the network, but the code provides no explicit runtime warning, consent prompt, or data-classification notice before transmission. In a skill designed to process arbitrary documents and notes, this can cause unintended disclosure of sensitive internal text, credentials, personal data, or proprietary material if users assume processing is local.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: The skill documentation is written entirely in Chinese and does not indicate that users may interact in other languages or that the skill is intentionally limited to a Chinese-language audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Intent-Code Divergence

Low

Confidence: 92% confidence
Finding: Line L078 says the final result must be pure Markdown content with no explanatory wrappers or extra output. Later, lines L156-L165 require presenting a Markdown code block as well as full online-view and image links, which directly contradicts the earlier instruction about the final output format.

Natural-Language Policy Violations

Low

Confidence: 83% confidence
Finding: The script includes user-facing argparse description and help text entirely in English, while other comments/docstrings in the file are in Chinese, indicating a mixed-language context. Because the tool does not offer any language or locale choice, it effectively imposes a specific language on users without opt-in.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: This JSON manifest contains user-facing preset names such as "现代活力" and "极简黑白" exclusively in Chinese. Under the policy, forcing a specific language without user choice or documented locale scope is a natural-language policy concern.

Static analysis

No suspicious patterns detected.