Security audit

AntV Skills

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only AntV G2 chart-generation skill, with some code-quality and web-safety caveats but no hidden execution, persistence, or data theft behavior found.

Install only if you want a G2 v5 chart-code reference skill. Review generated code before using it with private data, untrusted tooltip values, or third-party URLs, because copied examples may need escaping, endpoint allowlisting, or proxying.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (134)

Ae1

High

Category: analysis-evasion
Content: > **详细文档**: [蜂群图](references/marks/g2-mark-beeswarm.md) | [打包图](references/marks/g2-mark-pack.md)
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: > **详细文档**: [tooltip](references/interactions/g2-interaction-tooltip.md) | [poptip](references/interactions/g2-interaction-poptip.md) | [drilldown](references/i
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: > **详细文档**: [坐标轴配置](references/components/g2-comp-axis-config.md) | [雷达图坐标轴](references/components/g2-comp-axis-radar.md)
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: > **详细文档**: [Tooltip 配置](references/components/g2-comp-tooltip-config.md)
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: /scales/g2-scale-point.md) | [time](references/scales/g2-scale-time.md) | [log](references/scales/g2-scale-log.md) | [pow/sqrt](references/scales/g2-scale-pow-s
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The manifest description says to use the skill when a user asks for "bar charts, line charts, pie charts, scatter plots, area charts, or any data visualization with G2 library." This trigger scope is very broad and lacks exclusion conditions or narrower activation context, which could cause the skill to activate for many generic chart requests rather than clearly scoped G2-specific requests.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The file presents core instructions under a bilingual heading but then primarily mandates and explains behavior in Chinese, without stating that the user may choose their preferred language. This can violate language/locale policy by implicitly forcing a specific language style without opt-in.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The file explicitly states that `transpose` is not a coordinate system type and must instead be expressed as a transform under `coordinate.transform` (L0020-L0023). Later, the coordinates reference table lists `transpose` as a coordinate type in its own right (L0941), which actively contradicts the earlier guidance and could cause the skill to generate invalid G2 code.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The title, description, tags, and use cases are presented entirely in Chinese, which imposes a specific language on users. The file does not indicate that this skill is region-specific or provide any opt-in or alternative language option, so it appears to violate the language/locale policy criterion.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The title and description are entirely in Chinese, and the file provides no indication that language choice is optional or that the skill is intentionally restricted to a Chinese-speaking or region-specific audience. This can violate language/locale policy when users are not given a choice or clear justification for the enforced locale.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The custom tooltip `render` example interpolates `title`, `name`, `value`, and `color` directly into an HTML string without any escaping or sanitization guidance. If those fields can contain user-controlled or untrusted data, this can lead to DOM-based XSS in applications that copy the example verbatim, especially because the example encourages fully custom HTML rendering.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The title and description are presented only in Chinese, and the rest of the document continues in that language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This markdown file’s title, description, examples, and explanatory text are all presented in Chinese, and there is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. The policy requires flagging language or locale constraints when they are imposed without user opt-in or clear justification.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document’s top-level description claims a radial coordinate mapping opposite to what its own runnable examples and later guidance imply. In a code-generation skill, this can systematically cause the agent to produce incorrect chart configurations, misleading users and breaking visualizations in ways that are hard to diagnose.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The core concept table contradicts the later example code and error-correction section, creating internally inconsistent instructions in a skill meant to guide code generation. This inconsistency can propagate into generated chart code, causing wrong visual encodings and undermining trust in the skill’s outputs.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The file title and description are entirely in Chinese and include prescriptive wording such as '必须使用' and '禁止使用', presenting the skill in a single language/locale without offering any user choice. Under the language/locale policy, forcing one language without opt-in is a natural-language policy concern unless clearly justified as region-specific.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The title, description, tags, use cases, anti-patterns, and instructional content are written in Chinese, which imposes a specific language on users. The file does not indicate that Chinese is optional, nor does it offer an alternative language or explicit locale justification.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The document claims as a hard rule that every `children` element must be a Mark and explicitly says G2 does not support nested `view` inside `children`. However, the front matter and description position `view + children` as the mechanism for broader composition including facets, which can require more than simple Mark-only child usage depending on G2 composition semantics. This is an intent/documentation contradiction within the skill content rather than just an omitted detail.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This markdown skill description presents its title and core instructions only in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when the skill offers user choice or clearly documents and justifies the restriction, which is not present here.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The section title at L050 says this is a '最小可运行示例' (minimal runnable example), but the object literals under the line marks are malformed at L071-L082 and L088, where a standalone object appears without a property name such as `data:`. This is not merely incomplete documentation: it directly contradicts the claim that the example is runnable and that EMA should be configured in `data.transform`.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: This section documents a finance smoothing use case, but at L114-L125 and L131 the `fetch` data source objects are again inserted without a `data:` key, making the sample invalid JavaScript/G2 configuration. Because the file is instructional reference material, this contradicts its own guidance about how EMA should be configured in `data.transform`.

Natural-Language Policy Violations

Medium

Confidence: 74% confidence
Finding: The title and description are written in Chinese and the file provides no indication that language is selectable or that the skill is intentionally restricted to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document encourages remote data fetching from third-party endpoints but does not warn that client-side requests reveal the user's IP address, user agent, timing, and possibly internal network reachability to those endpoints. In a charting skill, users may copy these examples directly into browser-based apps, causing unintended external disclosures or requests to untrusted infrastructure.

External Transmission

Medium

Category: Data Exfiltration
Content: // ❌ 错误：G2 fetch 不支持鉴权 data: { type: 'fetch', value: 'https://api.example.com/private-data', // 需要 token } // ✅ 正确：使用公开的 API 或在服务端代理
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The title and description are entirely in Chinese, and the file provides no indication that language choice is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Static analysis

No suspicious patterns detected.