T08 · Insecure Dependencies
Warning
- Location
assets/playwright-control-test-harness.js:35- Finding
Unpinned Global Playwright Installation in Mandatory Verification Workflow
- Content
View full analysis
- Remediation
View remediation
Security audit
玩转AI校园(BNBU)
Security checks for vulnerabilities and agentic risk
Overview
This AI-education skill is not malicious, but it bundles broad automatic cloud, sharing, device, and recurring workflow actions that need careful review before installation.
Install only if you intentionally want a WorkBuddy-centered teaching workflow that can save to IMA or Tencent Docs, share materials, create reminders/calendar items, and run recurring education workflows. Before enabling automation, require explicit review of what will be written, where it will be shared, when recurring actions run, and how to pause or delete stored state. Avoid following the unpinned global npm or npx setup guidance unless you replace it with pinned local dependencies in a trusted environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
references/p5js-courseware-guide.md:421- Finding
Automatic Execution of an Unpinned Package Through npx
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (90)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md LIVER→REPORT→LEARN）。⭐ 自动化：意图自动分类路由、互动控件由 Playwright 自动实测闭环（生成→实测→修复→复测，预算 3 次，见 assets/playwright-control-test-harness.js）、WorkBuddy 原生分发（IMA/腾讯文档/设备侧）自动接上。⭐ 智能
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md LIVER→REPORT→LEARN）。⭐ 自动化：意图自动分类路由、互动控件由 Playwright 自动实测闭环（生成→实测→修复→复测，预算 3 次，见 assets/playwright-control-test-harness.js）、WorkBuddy 原生分发（IMA/腾讯文档/设备侧）自动接上。⭐ 智能
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md LIVER→REPORT→LEARN）。⭐ 自动化：意图自动分类路由、互动控件由 Playwright 自动实测闭环（生成→实测→修复→复测，预算 3 次，见 assets/playwright-control-test-harness.js）、WorkBuddy 原生分发（IMA/腾讯文档/设备侧）自动接上。⭐ 智能
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md LIVER→REPORT→LEARN）。⭐ 自动化：意图自动分类路由、互动控件由 Playwright 自动实测闭环（生成→实测→修复→复测，预算 3 次，见 assets/playwright-control-test-harness.js）、WorkBuddy 原生分发（IMA/腾讯文档/设备侧）自动接上。⭐ 智能
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md LIVER→REPORT→LEARN）。⭐ 自动化：意图自动分类路由、互动控件由 Playwright 自动实测闭环（生成→实测→修复→复测，预算 3 次，见 assets/playwright-control-test-harness.js）、WorkBuddy 原生分发（IMA/腾讯文档/设备侧）自动接上。⭐ 智能
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md LIVER→REPORT→LEARN）。⭐ 自动化：意图自动分类路由、互动控件由 Playwright 自动实测闭环（生成→实测→修复→复测，预算 3 次，见 assets/playwright-control-test-harness.js）、WorkBuddy 原生分发（IMA/腾讯文档/设备侧）自动接上。⭐ 智能
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md LIVER→REPORT→LEARN）。⭐ 自动化：意图自动分类路由、互动控件由 Playwright 自动实测闭环（生成→实测→修复→复测，预算 3 次，见 assets/playwright-control-test-harness.js）、WorkBuddy 原生分发（IMA/腾讯文档/设备侧）自动接上。⭐ 智能
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md LIVER→REPORT→LEARN）。⭐ 自动化：意图自动分类路由、互动控件由 Playwright 自动实测闭环（生成→实测→修复→复测，预算 3 次，见 assets/playwright-control-test-harness.js）、WorkBuddy 原生分发（IMA/腾讯文档/设备侧）自动接上。⭐ 智能
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md LIVER→REPORT→LEARN）。⭐ 自动化：意图自动分类路由、互动控件由 Playwright 自动实测闭环（生成→实测→修复→复测，预算 3 次，见 assets/playwright-control-test-harness.js）、WorkBuddy 原生分发（IMA/腾讯文档/设备侧）自动接上。⭐ 智能
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description promises automatic Playwright testing, WorkBuddy-native delivery, cloud document storage, and device-side integration without clearly stating that these actions may affect external systems or user data. In practice, users could trigger storage, sharing, or device actions without understanding the consequences, creating consent, privacy, and integrity risks.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill documents time-triggered operational flows such as daily updates, exam reminders, and weekly reports, but it does not provide an explicit warning that these may continue acting over time after initial setup. Ongoing automation magnifies the risk of repeated unwanted notifications, data propagation, or persistent background actions without clear user awareness.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
md - 示例：DAN（Do Anything Now）
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
代码引入标准
html <!-- 主用 cdnjs，备用 jsdelivr（onerror 自动回退，避免单一 CDN 不可达导致白屏） --> <script src="https://cdnjs.cloudflare.com/ajax/libs/p5.js/2.0.3/p5.min.js"></script> <script> if (typeof p5 === 'undefined') {
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
代码引入标准
html <!-- 主用 cdnjs,备用 jsdelivr(onerror 自动回退,避免单一 CDN 不可达导致白屏) --> <script src="https://cdnjs.cloudflare.com/ajax/libs/p5.js/2.0.3/p5.min.js"></script> <script> if (typeof p5 === 'undefined') {
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly describes automatic delivery to external systems and automatic writes to device-side state such as calendar, alarms, and memos, but does not require clear user confirmation or warn about side effects on personal data and device state. In a teaching/workflow skill, this materially increases the risk of unintended disclosure, unwanted actions on a user's device, and silent propagation of generated or sensitive educational content to third-party services.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README states that data collected while offline will automatically sync when connectivity returns, but does not warn users that locally stored content may later be transmitted to remote services. This creates a consent and transparency gap: users may assume offline usage is fully local, while the skill later exports data without a fresh notice or approval.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 72% confidence
- Finding
The skill advertises automation assets and references runtime/code-oriented capabilities, but the manifest does not declare an explicit tool scope or allowed-tools boundary. In a workflow engine that discusses verification, delivery, storage, and device-side actions, missing scope constraints increases the chance of unintended access to environment-backed capabilities or future privilege creep.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says to prefer this skill over generic chat whenever the user's intent touches broad categories like teaching, generation, assessment, recommendation, or collaboration. That preference rule is overly expansive and can preempt safer or simpler handling, especially because this skill also claims automation, delivery, and scheduled operations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger matrix contains very broad phrases such as lesson prep, documents, sharing, reminders, and workflow automation that overlap with ordinary user requests. This can cause the skill to activate when the user did not intend to invoke an automation-heavy workflow, leading to misrouting, over-collection of context, or unexpected downstream actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file states '注释中文', and the overall skill instructions and trigger design are written to operate in Chinese without any indication that users may choose another language. This can violate language/locale policy when a skill imposes a specific language without opt-in or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code embeds its primary description, usage context, and operational guidance entirely in Chinese, and later emits user-facing errors and reports in Chinese as well. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's interactive/runtime text such as installation errors, usage output, status summaries, and generated markdown is all fixed to Chinese. Because the file does not offer a language selection mechanism or clearly justify a Chinese-only locale, this conflicts with the language/locale policy.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The template sets
audienceto the Chinese value大学生, which imposes a specific language/locale assumption in a reusable workflow-state template. Because this file does not indicate that the locale is optional, user-selectable, or limited to a region-specific use case, it can conflict with language/locale policy expectations.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The
notesfield contains only Chinese instructional text, which effectively forces a specific language in a general-purpose template. There is no nearby documentation indicating that this asset is region-specific or that language selection is configurable, so it may violate language/locale policy.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The page declares
lang="zh-CN", and all visible UI text is presented only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- assets/playwright-control-test-harness.js:29