Security audit

DrawIO 图表技能

Security checks for vulnerabilities and agentic risk

Overview

This DrawIO skill is mostly local and purpose-related, but its package includes a report that exposes internal infrastructure details and it can place untrusted diagram text into AI-read reports.

Review before installing. The main risk is not hidden execution, but included source-diagram content: remove or regenerate style_report.json with only style attributes before publishing or sharing, and avoid analyzing untrusted DrawIO files unless labels are escaped or treated strictly as data. Run the scripts only on files you trust or inside a resource-limited workspace.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: style_report.json:2475
Finding: Packaged Report Exposes Internal Infrastructure Information
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: scripts/ref_analyze.py:112
Finding: Untrusted DrawIO Labels Are Embedded in Agent-Consumed Markdown
Content: View full analysis
]+>', '', v).strip() if text and len(text) <= 40: label = text break if is_swimlane or is_group: containers.append({ 'label': label, 'type': 'swimlane' if is_swimlane else 'group', }) ``` ```python for i, c in enumerate(cons, 1): cn = 'swimlane' if c['type'] == 'swimlane' else 'group' lbl = c['label'] or '(unnamed)' L.append(f' {i}. [{cn}] {lbl}') ``` ```python md = render_markdown(filename, style, structure) if not out: out = os.path.join(os.getcwd(), 'ref_report.md') out = os.path.abspath(out) os.makedirs(os.path.dirname(out), exist_ok=True) with open(out, 'w', encoding='utf-8') as fp: fp.write(md) ``` ### Technical Analysis Diagram labels are attacker-controlled when a reference `.drawio` file comes from an untrusted source. The script copies those labels into a Markdown report without Markdown escaping, structured quoting, trust-boundary markers, or a warning that extracted text must not be interpreted as instructions. The documented workflow directs an AI Agent to generate and read this report as guidance for creating a new diagram. Consequently, instruction-like content placed in a group or swimlane label can be presented inside an Agent-consumed artifact. Removing HTML tags does not address this risk because plain text and Markdown are sufficient to express adversarial instructions. Th ...[truncated 1505 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/extract_style.py:32
Finding: Unbounded DrawIO Decompression Enables Resource-Exhaustion Attacks
Content: View full analysis
Remediation: View remediation
MAX_COMPRESSED: raise ValueError("Compressed diagram exceeds the size limit") decoder = zlib.decompressobj(-15) inflated = decoder.decompress(data, MAX_INFLATED + 1) if len(inflated) > MAX_INFLATED or decoder.unconsumed_tail: raise ValueError("Decompressed diagram exceeds the size limit") ``` 3. Enforce a maximum compression ratio and reject anomalously dense payloads. 4. Limit the number of diagrams, XML elements, graph cells, and nesting depth. 5. Use a hardened XML parser and disable unnecessary XML features. 6. Catch decoding, decompression, Unicode, and XML exceptions and fail safely with a concise error. 7. Run analysis in a sandbox with memory, CPU, execution-time, and file-system quotas. 8. Apply the same shared, hardened loader to all three scripts to avoid inconsistent protections. 9. Add regression tests using oversized XML, invalid Base64, malformed deflate streams, deeply nested XML, and compression-bomb fixtures. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: 代码行为与声明仅部分一致。它确实实现了“从已有 .drawio 文件中提取个人绘制风格特征”的一部分能力：读取本地目录下的 .drawio 文件、解析并解码图内容、统计样式属性、输出 JSON 报告。但声明将技能描述为一个完整的 DrawIO 绘图与导出工具，而当前代码片段没有任何图表生成、应用 preset 生成新图、或导出 PNG/SVG/PDF 的实现。因此，若以整个技能声明对照该代码片段，代码的实际能力明显更窄，不能支撑声明中的主要功能，属于描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The code accurately supports one declared sub-capability: deterministic extraction of drawing style presets from existing .drawio files. It parses and decompresses draw.io XML, extracts palette/roles/shapes/font/edge defaults, and saves a preset JSON. However, the broader declared description presents the skill primarily as a full DrawIO diagram generation and export tool, including generating many diagram types, applying a named visual style, and exporting rendered outputs. None of those behaviors appear in this code chunk. There are no suspicious undeclared external accesses or unrelated triggers, but the implemented functionality is materially narrower than the declared capability set, so this chunk does not accurately represent the full declared description.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This section exposes sensitive infrastructure descriptors including domain names, internal network ranges, server roles, databases, gateways, monitoring systems, security components, and workflow details, none of which are required to extract a visual style preset. Such disclosure materially lowers the cost of reconnaissance for attackers and may reveal security controls, trust boundaries, and high-value targets for phishing, intrusion, or lateral movement.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation describes capabilities that imply file reads, file writes, and possible network access, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, missing scope declarations can cause overbroad tool access, making it easier for the skill to read unrelated local files, overwrite workspace content, or fetch untrusted remote data without clear operator review.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest description and title are written entirely in Chinese, and the document frames the skill around Chinese-specific usage such as added Chinese role vocabulary. This creates a natural-language locale constraint without any explicit user choice, opt-in, or justification that the skill is intended only for a Chinese-language environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module description is written only in Chinese and the script's user-facing output is likewise Chinese, indicating the skill is designed to operate in a fixed language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code's natural-language interface is written entirely in Chinese, including the main module description and usage text shown to users. The file does not offer a language choice or explain that the skill is intentionally limited to a Chinese-speaking context, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The artifact contains far more than style metadata: it embeds full diagram labels, business process text, internal architecture descriptions, hostnames, internal IP addresses, domains, and environment details. For a style-preset extraction artifact, this is unnecessary data retention and creates a sensitive information disclosure risk because anyone with access to the skill package can reconstruct internal systems and organizational workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code creates or overwrites style_report.json, which is a file write affecting the local filesystem. Although the script prints the saved path afterward, there is no prior warning, confirmation, or explanatory comment at the write site informing the user that running the skill will persist a report file.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module docstring states that --style is optional and that the default behavior is to extract style from the reference image itself, but the implementation instead prefers a bundled styles/linlan.json preset when present and only falls back to self-extraction if that preset is missing. This is an intent/documentation mismatch that changes the semantic meaning of the analysis output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This JSON file contains natural-language labels in both English and Chinese, suggesting the underlying skills or artifacts may assume a specific locale presentation. Because there is no accompanying note in this file that the locale is user-selectable or explicitly constrained to a region-specific use case, it may conflict with language/locale choice expectations.
Content: No source excerpt is available for this finding.