漫播技能

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:26 AM UTC
• Version: 1.0.2

Overview

The skill is simple and purpose-aligned, but it asks users to globally install an unpinned external npm CLI that is not included in the reviewed artifact.

Before installing, verify the `manbo-cli` npm package, publisher, source, and version yourself; prefer a pinned or local install if available, avoid running it with administrator privileges, and require clear confirmation before installation or execution when the user only mentions broad terms like hot-search rankings or audio dramas.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:10

Finding

Unpinned Global Installation of an Unverified npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-20
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: High

Vulnerable Code

markdown

## 安装

```bash
npm install -g manbo-cli

使用

bash

manbo hot

text

### Technical Analysis

The skill instructs users to globally install `manbo-cli` without specifying an audited version, package integrity hash, verified publisher, or trusted source repository. Consequently, npm resolves the current package version at installation time, allowing the effective installed code to change after this skill has been reviewed.

An npm installation can execute package lifecycle scripts, while the installed `manbo` executable can run arbitrary package code when invoked. Global installation also exposes the command system-wide for the installing user. The project contains no implementation source, lockfile, package manifest, or vendored dependency from which the external package's behavior can be audited.

This finding does not establish that the current `manbo-cli` package is malicious. It establishes that the documented installation process crosses a mutable, unverified supply-chain boundary and immediately executes the resulting software.

### Attack Path

1. An attacker compromises the npm account or publication pipeline associated with `manbo-cli`, takes control of an abandoned package, or causes users to resolve a malicious release.
2. The attacker publishes a modified package version containing a malicious npm lifecycle script or malicious `manbo` executable.
3. A user follows the skill instruction and runs `npm install -g manbo-cli`.
4. npm retrieves the mutable package release. Malicious lifecycle code may execute during installation.
5. The user runs `manbo hot`, executing the package's CLI code.
6. The payload operates with the privileges and environment access of the account performing the installation.

### Impact Assessment

Successful exp
...[truncated 716 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin manbo-cli to a specific, independently audited version rather than resolving the latest release.
2. Document and verify the official npm publisher and source repository before recommending installation.
3. Record and validate package integrity metadata, and use a lockfile where the installation model permits it.
4. Prefer a project-local installation over npm install -g to reduce command exposure and simplify removal.
5. Audit the package source, transitive dependencies, lifecycle scripts, and published npm artifact before use.
6. Disable npm lifecycle scripts during installation where compatible with the package, then explicitly review any required setup steps.
7. Avoid running npm installation or the resulting CLI with administrative privileges.
8. Include the auditable implementation in the reviewed project, or clearly document the external trust boundary and package verification procedure.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger keywords are broad enough to match common conversation terms such as “热搜”, “广播剧”, or “manbo”, which can cause the skill to activate when the user did not explicitly intend to use this CLI tool. Unintended invocation can lead to unnecessary command suggestions or tool execution in contexts where the user was only discussing the topic, increasing the chance of confusing or undesired agent behavior.

Content

No source excerpt is available for this finding.