T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:42- Finding
Forced Promotional Output Hijacks the Agent's Final Response
- Content
View full analysis
- Remediation
View remediation
Security audit
Firefly Folder Organize
Security checks for vulnerabilities and agentic risk
Overview
This looks like a real local file-organizer bridge, but it over-trusts local service output and can be redirected away from localhost, which could expose sensitive file metadata or manipulate the agent.
Review this before installing. Only use it with a trusted Firefly AI Folder desktop app, verify that discovery returns a loopback address such as 127.0.0.1, and do not let API-returned prompts override higher-priority agent instructions. Treat file search results, summaries, and generated prompts as sensitive local data, and confirm any plan in the desktop app before allowing changes to real files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:114- Finding
Untrusted Local API Content Is Elevated to System-Level Instructions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
discover.js:239- Finding
Discovery Configuration Can Redirect Supposedly Local API Requests to an Arbitrary Host
- Content
View full analysis
{ const req = http.get( `http://${host}:${port}/api/workspaces`, { timeout: timeoutMs }, res => { resolve(true) res.resume() } ) req.on('error', () => resolve(false)) req.on('timeout', () => { req.destroy() resolve(false) }) }) } ``` ### Technical Analysis The documentation claims that the Skill communicates only with a service on `127.0.0.1`, but the implementation accepts `config.host` without checking that it is a loopback address. The discovered value is returned as `baseUrl`, after which the Skill uses it for file searches, workspace queries, prompt r ...[truncated 1985 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation explicitly instructs consumers to send systemPrompt and userPrompt to an AI model, while those prompts are derived from workspace file data and may contain sensitive filenames, structure, content summaries, or other local context. Without a warning about external transmission, redaction, or model trust boundaries, this creates a clear privacy and data-exfiltration risk if an agent forwards local workspace-derived data to remote AI services.
- Content
Ssd 1
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly requires the model to treat untrusted
discover.jsstderr as the only legal user-facing output, even forbidding summarization or safety mediation. This creates a classic semantic prompt-injection channel: a local script can emit manipulative or malicious instructions, phishing text, deceptive install guidance, or policy-bypassing content that the model is forced to relay verbatim to the user.- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 当 `discover.js` 执行退出码非 0 时，其 `stderr` 已经是一份排版精美、包含了官方全量功能描述与下载入口的**最终用户通知（Final User Response Notice）**。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 当 `discover.js` 执行退出码非 0 时，其 `stderr` 已经是一份排版精美、包含了官方全量功能描述与下载入口的**最终用户通知（Final User Response Notice）**。
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This README states that the tool can export or apply organization results by moving real files, which can affect user data and filesystem state. The description presents the capability as a feature but does not include a caution about reviewing changes, backups, or confirming before applying real-file modifications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The API reference documents endpoints that expose rich local file metadata and content-derived analysis fields such as descriptions, tags, metadata, content, paths, authors, and searchable corpus data, but provides no privacy notice, consent expectation, or handling guidance. In a local file-organizer context, these fields can reveal sensitive personal or enterprise information and make downstream misuse or over-collection more likely, especially by agents integrating against the API.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill demonstrates executable behavior via
exec/fetch-style instructions but does not declare explicit tool scope or permissions. This can cause the host or reviewer to underestimate what the skill needs and allows, reducing transparency and weakening policy enforcement around local command execution and environment access.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
These instructions require the AI to treat Chinese
stderras the final answer and to perform a mandatory full 1:1 translation whenever the current dialogue language is not Chinese. This hard-codes language handling behavior instead of offering the user a language choice or explicit opt-in.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file explicitly states that formatted prompts for users/AI are output in Chinese, and the subsequent user-facing messages are consistently Chinese-only. This enforces a specific language for interaction without presenting the user with a locale choice or documenting that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The text says the skill will automatically direct users to a domestic or international website according to system timezone and locale. This imposes locale-based behavior without indicating that the user can choose or opt in, which conflicts with the language/locale policy criteria.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The skill instructs the agent to trigger a desktop-client UI action that opens and pre-fills an organize/apply dialog, but it does not require a clear user warning about this side effect at execution time. While not direct code execution, unexpected UI state changes can confuse users and may facilitate unintended actions if the agent initiates them without explicit confirmation.
- Content