Security audit

AntV Skills

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only AntV G2 chart helper, with some code-quality and copy-paste safety caveats but no hidden execution, persistence, or exfiltration behavior.

Reasonable to install for AntV G2 chart help. Review generated code before production, prefer trusted or same-origin data and image URLs, and avoid raw HTML tooltip renderers with untrusted chart labels or values unless you sanitize them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (97)

Ae1

High

Category: analysis-evasion
Content: > **详细文档**: [蜂群图](references/marks/g2-mark-beeswarm.md) | [打包图](references/marks/g2-mark-pack.md)
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: > **详细文档**: [tooltip](references/interactions/g2-interaction-tooltip.md) | [poptip](references/interactions/g2-interaction-poptip.md) | [drilldown](references/i
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: > **详细文档**: [坐标轴配置](references/components/g2-comp-axis-config.md) | [雷达图坐标轴](references/components/g2-comp-axis-radar.md)
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: > **详细文档**: [Tooltip 配置](references/components/g2-comp-tooltip-config.md)
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: /scales/g2-scale-point.md) | [time](references/scales/g2-scale-time.md) | [log](references/scales/g2-scale-log.md) | [pow/sqrt](references/scales/g2-scale-pow-s
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger description is broad enough to activate this skill for many generic visualization requests, even when the user did not explicitly ask for AntV G2. Over-broad routing can cause the agent to select a tool with assumptions or constraints mismatched to the user's intent, increasing the risk of wrong-library code generation, prompt collision with other skills, or unintended handling of requests.

Natural-Language Policy Violations

Medium

Confidence: 81% confidence
Finding: The section heading and subsequent content establish bilingual Chinese/English instructions, with many constraints written primarily in Chinese, but the skill does not state that language should follow the user's preference or offer a locale choice. This can violate language/locale policy when users expect responses in their own language unless they opt into Chinese or bilingual output.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The constraints state that `transpose` is not a coordinate-system type and must instead be expressed as a transform under `coordinate.transform`. Later in the same file, the coordinates table lists `transpose` as a coordinate type, which actively contradicts the earlier rule and can cause the skill to generate code that violates its own stated constraints.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The documentation explicitly demonstrates an image annotation that loads a remote URL, which can cause clients rendering generated chart code to make outbound requests to a third-party host. In a chart-generation skill, this is not strictly necessary for core functionality and creates privacy, tracking, and supply-chain exposure if downstream users copy the example without understanding the network implications.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The custom tooltip `render` example builds HTML with unescaped `${title}`, `${name}`, `${value}`, and `${color}` values interpolated directly into the returned string. If chart data or labels can be influenced by untrusted input, this can lead to DOM-based XSS in the consuming application because the example encourages a dangerous pattern without any warning or sanitization guidance.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The frontmatter description says radial maps x to radius and y to angle, but the runnable examples and comments later consistently use x as angle/category and y as radius/value. This is an active contradiction in the file’s own documentation, not merely missing detail, and could cause the skill to generate incorrect G2 code despite claiming to teach radial coordinates.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: This table says radial maps x to radius and y to angle, but the examples immediately below and later comments describe x as the angular/category channel and y as the radial/numeric channel. Because the table is presented as core conceptual guidance, it directly conflicts with the operational examples users would follow.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The title and description are written in Chinese, and the description explicitly says '必须使用' for the prescribed style without any indication that language choice is optional. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The title, description, examples, and instructional text are entirely in Chinese, which imposes a specific language on users. The file does not offer a language choice or explain that the skill is intentionally restricted to a Chinese-speaking or region-specific audience.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The document explicitly instructs users to fetch remote data from third-party URLs but does not warn that doing so causes client-side network requests that may disclose user IP address, browser metadata, referrer/origin context, and potentially sensitive query parameters. In a charting skill, this is contextually more dangerous because users may copy these examples into production dashboards and unknowingly connect browsers to untrusted or privacy-sensitive endpoints.

External Transmission

Medium

Category: Data Exfiltration
Content: // ❌ 错误：G2 fetch 不支持鉴权 data: { type: 'fetch', value: 'https://api.example.com/private-data', // 需要 token } // ✅ 正确：使用公开的 API 或在服务端代理
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The title and description are written entirely in Chinese, and the file provides no indication that language selection is optional or that this skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The title, description, tags, and examples are written entirely in Chinese, which imposes a specific language on users. The file does not state that the skill is region-specific or provide any opt-in or alternative language, so this is a natural-language locale policy issue.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The title, description, tags, and all instructional content are written in Chinese, which effectively constrains the skill to a specific language/locale. There is no indication that the language choice is optional, configurable, or justified as region-specific, so this appears to violate the language/locale policy criterion.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The title and descriptive content are presented entirely in Chinese, and the file does not indicate that language is selectable or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The title, description, examples, and comments are entirely in Chinese, which imposes a specific language on users. The file does not offer an alternative language choice or explain that the skill is intentionally region- or locale-specific, so it violates the language/locale policy criterion.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The example custom tooltip renderer interpolates dynamic values such as title, item.name, item.value, and item.color directly into an HTML string. If chart data can contain untrusted input, this pattern can lead to DOM-based XSS when the generated tooltip HTML is inserted into the page, and the documentation provides no warning or safer alternative despite teaching a risky usage pattern.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The title/description are presented in Chinese and the rest of the document continues in Chinese, with no indication that language selection is optional or that the skill is intentionally restricted to a Chinese-speaking audience. This can violate a language/locale policy when users are not given an opt-in or alternative locale.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The heading '使用 beeswarm mark（独立类型）' and the comment on L076 claim this example demonstrates direct use of a beeswarm mark/type. However, the actual configuration sets `type: 'point'` on L080 and applies `layout: { type: 'beeswarm' }` on L089-L092 instead of using `type: 'beeswarm'`. This is an active contradiction between documentation and code behavior.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: In L158-L165, the document presents tooltip channels 'y', 'y1', 'y2', 'y3', and 'y4' as the correct configuration for box marks. But in L307-L318 it labels 'y1' through 'y4' as '不存在的 channel 名称' and says they are wrong, while L323-L334 then repeats the same channel pattern as the corrected version. This is an active contradiction in the documentation rather than a mere omission.

Static analysis

No suspicious patterns detected.