ECharts Master

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:29 AM UTC
• Version: 1.0.0

Overview

This charting skill appears purpose-aligned, but it can start an under-scoped local web server and may run an unpinned npm package to preview user data.

Review before installing. Use this only for data you are comfortable placing into a client-side HTML chart, prefer opening the HTML file directly or serving a dedicated chart-only folder, bind any preview server to `127.0.0.1`, stop it after previewing, and avoid the unpinned `npx` option unless the package source and version are controlled.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:63

Finding

Unpinned Third-Party Package Retrieval and Execution via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63-65
Vulnerability Type: Unpinned dependency execution
Risk Level: Medium

Vulnerable Code:

bash

# Or use node
npx http-server -p 8082

Technical Analysis

The documented workflow invokes http-server through npx without specifying a version, verifying package integrity, or requiring an existing local installation. If the package is not already installed, npx may retrieve it from the configured npm registry and execute it immediately.

This makes the effective executable dependency mutable after the Skill has been audited. A compromised package maintainer account, malicious package release, dependency-chain compromise, or attacker-controlled npm registry configuration could cause arbitrary JavaScript or package lifecycle code to execute.

The issue is a supply-chain weakness rather than evidence that the current http-server package is malicious.

Attack Path

1. An attacker compromises the relevant npm package, one of its dependencies, or the package registry configured on the host.
2. The attacker publishes or serves a malicious version containing lifecycle or runtime code.
3. A user asks the Agent to generate and preview a chart.
4. The Agent follows the documented Node.js workflow and runs npx http-server -p 8082.
5. npx resolves and downloads the unpinned package from the configured registry.
6. The malicious package code executes with the operating-system privileges of the Agent or user running the command.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user account. The attacker could access files, environment variables, credentials, chart data, and network resources available to that account. The issue does not directly provide elevated system privileges, but its scope includes all resources accessible to the Agent process and user.

Remediation

View remediation

Remediation Suggestions

1. Remove the implicit-download workflow and prefer an already installed, trusted server such as Python's standard-library HTTP server.
2. If Node.js support is necessary, vendor and audit the required package or declare it in a lockfile with an exact version and integrity metadata.
3. Use npx --no-install http-server when execution must be limited to a package that is already installed locally.
4. Configure npm to use an approved registry and enforce lockfile and integrity verification.
5. Avoid package lifecycle scripts where possible, and perform dependency vulnerability and provenance checks before distributing an updated Skill.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:58

Finding

Chart Preview Server May Be Exposed on All Network Interfaces

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58-68
Vulnerability Type: Insecure network service binding and unintended file exposure
Risk Level: Medium

Vulnerable Code:

bash

# Enter the directory containing the chart
cd /path/to/chart

# Start the Python HTTP server (port 8082)
python3 -m http.server 8082

# Or use node
npx http-server -p 8082

The workflow then instructs the user to visit:

text

http://localhost:8082/chart.html

Technical Analysis

Neither server command explicitly binds the preview service to the loopback interface. Under their common default configurations, these servers can listen on all available network interfaces rather than only 127.0.0.1.

Advertising a localhost URL does not restrict the listening socket. Consequently, systems on the same network—or any network able to reach port 8082—may access the service. The Python server also exposes the current working directory as its document root, so files other than chart.html may be retrievable if they are present in that directory.

Generated charts may embed user-provided business or analytical data directly in HTML and JavaScript. Network exposure can therefore result in unauthorized disclosure of chart data and neighboring files.

Attack Path

1. A user provides potentially sensitive data and requests a chart.
2. The Agent creates chart.html containing that data.
3. The Agent changes into the chart directory and runs one of the documented server commands.
4. The server listens on externally reachable interfaces because no loopback address is specified.
5. An attacker on a reachable network scans for or otherwise discovers port 8082.
6. The attacker requests /chart.html to obtain the embedded data or browses and requests other files exposed from the server's document root.

Impact Assessment

Exploitation can disclose the generated visualization, its underlying embed ...[truncated 356 chars]

Remediation

View remediation

Remediation Suggestions

1. Bind the preview server explicitly to the loopback interface:

   bash

   python3 -m http.server 8082 --bind 127.0.0.1 --directory /path/to/chart-only
   

2. Create a dedicated preview directory containing only chart.html and the required local ECharts asset. Do not serve a general workspace or directory containing unrelated files.

3. Apply an equivalent loopback binding and restricted document root if a Node.js server is retained.

4. Stop the server immediately after previewing and document how the Agent or user should terminate it.

5. Warn users not to embed secrets or unnecessary sensitive records in client-side chart files.

6. If remote access is intentionally required, use authentication, transport encryption, firewall restrictions, and an explicitly approved bind address instead of relying on the default server configuration.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md

1. 使用本地 `echarts.min.js` 文件

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises very broad trigger phrases such as general requests to 'make a chart', which can cause it to activate in many ordinary contexts without clearly signaling that it will create files and start a local service. Overbroad activation increases the chance of unexpected tool use and expands the attack surface for social engineering or unintended side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill name, description, and instructional content are written entirely in Chinese, and the file does not indicate that the user can choose another language or locale. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The workflow includes copying files and starting an HTTP server on port 8082, but the skill description does not warn users that local files will be created and a local network service may be exposed. This lack of disclosure can lead to consent issues and accidental exposure of sensitive chart data to other local-network users depending on bind settings.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The skill instructs use of npx http-server without pinning a version, which can fetch and execute whatever package version is current at runtime. In a skill context, this creates supply-chain and reproducibility risk because an unexpected or compromised upstream release could be executed on the user's machine.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document title and introductory description are entirely in Chinese, and the file provides no indication that other languages are supported or that Chinese is an opt-in choice. Under the policy, a skill that effectively imposes a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The HTML document declares lang="zh-CN" and the page title is written in Chinese, indicating the template is fixed to a specific language/locale. The policy for this category says to flag language or locale constraints when the skill forces a specific language without offering user choice or documenting a justified regional scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code uses toLocaleString('zh-CN'), which forces generated timestamps to the Chinese locale regardless of user preference. This is a natural-language/locale policy issue because no opt-in or fallback to the user's environment is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The minified code derives a default locale from document.documentElement.lang or browser language and switches between ZH and EN automatically. This is a natural-language locale policy concern because behavior is determined by environment locale rather than explicit user choice or skill-level opt-in.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: assets/echarts.min.js:45