Security audit

AntV Skills

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only AntV G2 chart-generation skill, with some code-quality and web-safety caveats but no hidden execution, persistence, or data theft behavior found.

Install only if you want a G2 v5 chart-code reference skill. Review generated code before using it with private data, untrusted tooltip values, or third-party URLs, because copied examples may need escaping, endpoint allowlisting, or proxying.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (134)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 576)May include surrounding context.
md
> **详细文档**: [蜂群图](references/marks/g2-mark-beeswarm.md) | [打包图](references/marks/g2-mark-pack.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 822)May include surrounding context.
md
> **详细文档**: [tooltip](references/interactions/g2-interaction-tooltip.md) | [poptip](references/interactions/g2-interaction-poptip.md) | [drilldown](references/i

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 834)May include surrounding context.
md
> **详细文档**: [坐标轴配置](references/components/g2-comp-axis-config.md) | [雷达图坐标轴](references/components/g2-comp-axis-radar.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 851)May include surrounding context.
md
> **详细文档**: [Tooltip 配置](references/components/g2-comp-tooltip-config.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 927)May include surrounding context.
md
/scales/g2-scale-point.md) | [time](references/scales/g2-scale-time.md) | [log](references/scales/g2-scale-log.md) | [pow/sqrt](references/scales/g2-scale-pow-s

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description says to use the skill when a user asks for "bar charts, line charts, pie charts, scatter plots, area charts, or any data visualization with G2 library." This trigger scope is very broad and lacks exclusion conditions or narrower activation context, which could cause the skill to activate for many generic chart requests rather than clearly scoped G2-specific requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file presents core instructions under a bilingual heading but then primarily mandates and explains behavior in Chinese, without stating that the user may choose their preferred language. This can violate language/locale policy by implicitly forcing a specific language style without opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file explicitly states that transpose is not a coordinate system type and must instead be expressed as a transform under coordinate.transform (L0020-L0023). Later, the coordinates reference table lists transpose as a coordinate type in its own right (L0941), which actively contradicts the earlier guidance and could cause the skill to generate invalid G2 code.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The title, description, tags, and use cases are presented entirely in Chinese, which imposes a specific language on users. The file does not indicate that this skill is region-specific or provide any opt-in or alternative language option, so it appears to violate the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The title and description are entirely in Chinese, and the file provides no indication that language choice is optional or that the skill is intentionally restricted to a Chinese-speaking or region-specific audience. This can violate language/locale policy when users are not given a choice or clear justification for the enforced locale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The custom tooltip render example interpolates title, name, value, and color directly into an HTML string without any escaping or sanitization guidance. If those fields can contain user-controlled or untrusted data, this can lead to DOM-based XSS in applications that copy the example verbatim, especially because the example encourages fully custom HTML rendering.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The title and description are presented only in Chinese, and the rest of the document continues in that language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file’s title, description, examples, and explanatory text are all presented in Chinese, and there is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. The policy requires flagging language or locale constraints when they are imposed without user opt-in or clear justification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document’s top-level description claims a radial coordinate mapping opposite to what its own runnable examples and later guidance imply. In a code-generation skill, this can systematically cause the agent to produce incorrect chart configurations, misleading users and breaking visualizations in ways that are hard to diagnose.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The core concept table contradicts the later example code and error-correction section, creating internally inconsistent instructions in a skill meant to guide code generation. This inconsistency can propagate into generated chart code, causing wrong visual encodings and undermining trust in the skill’s outputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file title and description are entirely in Chinese and include prescriptive wording such as '必须使用' and '禁止使用', presenting the skill in a single language/locale without offering any user choice. Under the language/locale policy, forcing one language without opt-in is a natural-language policy concern unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The title, description, tags, use cases, anti-patterns, and instructional content are written in Chinese, which imposes a specific language on users. The file does not indicate that Chinese is optional, nor does it offer an alternative language or explicit locale justification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The document claims as a hard rule that every children element must be a Mark and explicitly says G2 does not support nested view inside children. However, the front matter and description position view + children as the mechanism for broader composition including facets, which can require more than simple Mark-only child usage depending on G2 composition semantics. This is an intent/documentation contradiction within the skill content rather than just an omitted detail.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown skill description presents its title and core instructions only in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when the skill offers user choice or clearly documents and justifies the restriction, which is not present here.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The section title at L050 says this is a '最小可运行示例' (minimal runnable example), but the object literals under the line marks are malformed at L071-L082 and L088, where a standalone object appears without a property name such as data:. This is not merely incomplete documentation: it directly contradicts the claim that the example is runnable and that EMA should be configured in data.transform.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This section documents a finance smoothing use case, but at L114-L125 and L131 the fetch data source objects are again inserted without a data: key, making the sample invalid JavaScript/G2 configuration. Because the file is instructional reference material, this contradicts its own guidance about how EMA should be configured in data.transform.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 74% confidence
Finding: The title and description are written in Chinese and the file provides no indication that language is selectable or that the skill is intentionally restricted to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document encourages remote data fetching from third-party endpoints but does not warn that client-side requests reveal the user's IP address, user agent, timing, and possibly internal network reachability to those endpoints. In a charting skill, users may copy these examples directly into browser-based apps, causing unintended external disclosures or requests to untrusted infrastructure.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/data/g2-data-fetch.md (reported line 122)May include surrounding context.
md
// ❌ 错误：G2 fetch 不支持鉴权 data: { type: 'fetch', value: 'https://api.example.com/private-data', // 需要 token } // ✅ 正确：使用公开的 API 或在服务端代理

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The title and description are entirely in Chinese, and the file provides no indication that language choice is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.