海报PPT页面设计师

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:42 AM UTC
• Version: 1.3.0

Overview

This skill performs the advertised design-generation task through a third-party service, but it handles passwords, tokens, and SMS verification codes in ways users should review carefully before installing.

Install only if you are comfortable giving this skill your Lingque AI credentials and sending prompts, text, logo/image URLs, and generated-design requests to server.pinza.com.cn. Do not share SMS verification codes with the agent; complete login or registration directly on the official service instead. Treat any saved config.json as sensitive because the stored password can be recovered from the included code, and rotate the password/token if they were exposed in logs or command history.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:58

Finding

Unconditional Skill-Priority Instruction Overrides Normal Agent Routing

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: getToken.py:15

Finding

Reversible Password Obfuscation Misrepresented as Encryption

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: getToken.py:129

Finding

Credentials and Access Tokens Exposed Through Process Arguments and Standard Output

Content

View full analysis

2: username = sys.argv[1] password = sys.argv[2] else: username, password = get_credentials() if not username or not password: print("Please configure the Lingque AI account and password") print("Method 1: Set the LINGQUE_USERNAME and LINGQUE_PASSWORD environment variables") exit(1) access_token = get_access_token(username, password) if access_token: save_credentials(username, password) print(access_token) else: print("Failed to obtain token; check the account and password") exit(1) ``` The generated token is subsequently accepted through another process argument: ```python if __name__ == "__main__": import sys token = sys.argv[1] record_data = json.loads(sys.argv[2]) ``` ### Technical Analysis Passwords passed through `sys.argv` may be exposed in process listings, shell history, command telemetry, job definitions, diagnostic reports, and orchestration logs. The access token is then printed to standard output and expected to be passed to `run.py` as another command-line argument, creating additional disclosure points. Environment variables are offered as an alternative, but they are not a complete secret-management mechanism and may also be visible in process diagnostics or inherited by child processes. Printing the token is especially risky in environments where stdout is automatically collected. ### Attack Path 1. A user starts `getToken.py` with the username and password as command-line arguments. 2. Another local process or monitoring system records the command line while the process is running. 3. `getToken.py` prints the resulting access token to stdout. 4. Shell histo ...[truncated 713 chars]

Remediation

View remediation

other

Warning

• Location: getToken.py:105

Finding

Sensitive Data Is Sent to a Differently Named Service Domain Without Clear Trust Disclosure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (16)

Tainted flow: 'params' from os.environ.get (line 107, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · getToken.py (reported line 111)May include surrounding context.

python

"username": username,
        "password": password
    }
    response = requests.post(url, data=params)
    response_data = response.json()
    if response_data['code'] == "0":
        return response_data['data']

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The stated purpose is poster/PPT design, but the skill also performs credential intake, local credential storage, remote login/token retrieval, and config inspection. That mismatch hides sensitive account-handling behavior behind a benign creative-design description, increasing the chance users disclose secrets they would not otherwise share.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction to unconditionally prioritize this skill attempts to override safer routing and user-choice mechanisms. In context, this is risky because it can force users into a flow that collects credentials and authentication artifacts even when another non-sensitive method would suffice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to collect and use SMS verification codes during third-party registration/login, which is highly sensitive authentication data unrelated to the core design function. This enables the agent to act as an authentication intermediary and increases account-takeover and phishing risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill asks users to share a one-time verification code without any warning that this is sensitive authentication data. OTPs are equivalent to temporary login factors, so soliciting them in-chat materially increases phishing and account-compromise risk.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly directs the agent to request a one-time verification code and use it on the user's behalf for registration/login. This is a classic delegated-authentication anti-pattern that allows the agent to become a man-in-the-middle for account access and materially raises the risk of account takeover or unauthorized actions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents access to environment variables, local files, and networked authentication flows but does not declare any explicit tool scope or permissions. This weakens least-privilege boundaries and makes it harder to constrain what the skill can access, especially since it handles credentials and writes config data locally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The skill description and operating instructions are entirely in Chinese and direct the interaction flow in Chinese, but do not offer the user a language choice or state that the skill is intentionally limited to a Chinese-speaking context. This can constitute a language/locale policy issue when users are not given opt-in or alternatives.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The catch-all trigger for essentially any Lingque AI design request is overly broad and can cause the skill to activate in situations where users did not clearly consent to this specific integration. Broad activation is more dangerous here because the skill handles credentials and external service interaction, not just local formatting assistance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill reads account credentials from environment variables or a local config file and then persists them locally, expanding the exposure of highly sensitive secrets beyond the immediate authentication need. In a poster/PPT design skill, this is more dangerous because the business function does not inherently require long-term local credential storage, so compromise of the skill directory or accidental file sharing can reveal a user's upstream service account.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code comments describe password 'encryption', but it uses reversible XOR obfuscation with a hardcoded key, which provides almost no real protection. Anyone with access to the script and config file can trivially recover the password, creating a false sense of security around stored credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The function sends username and password to a remote service using requests.post, but the script provides no visible notice that credentials will be transmitted over the network. Comments in code are not user-facing disclosures, and the runtime output does not warn the user before the transmission occurs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

After successful login, the script automatically saves the supplied account credentials to config.json without explicit user consent or warning. Silent persistence of authentication secrets increases the chance that users unknowingly leave recoverable credentials on disk where other local users, backups, or packaged artifacts may expose them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code sends the authentication token in headers and arbitrary record_data in the POST body to a remote server, which can affect user privacy or data handling. There is no confirmation prompt, logging, or explanatory warning in the file to disclose that local inputs and credentials are being sent over the network.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language placeholder values for all configuration fields are written only in Chinese, which imposes a specific language on users without any opt-in or alternative locale. This matches the policy category for language or locale constraints expressed in natural-language content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script's user-facing console messages are hard-coded in Chinese, with no option for the user to select another language or locale. This is a natural-language policy concern because it enforces a specific language without opt-in or documented justification.

Content

No source excerpt is available for this finding.