Security audit
Security checks for vulnerabilities and agentic risk
This skill is coherent as a Magicflu page builder, but its live proxy and credentialed scripts can expose or change real account data if used as written.
Review this skill carefully before installing. Use mock or offline import mode when possible, avoid production credentials, require HTTPS and a trusted BASE_URL, do not run proxy mode on shared networks, and fix the proxy binding/CORS and innerHTML rendering issues before using it with live Magicflu data.
scripts/mock-jsonv2.mjs:90Unauthenticated Credentialed Read/Write Proxy Exposed on All Network Interfaces
scripts/lib/magicflu-session.mjs:74Passwords, Cookies, and Bearer Tokens Can Be Sent over Plaintext HTTP or to an Unvalidated Destination
examples/vanilla/list-page.html:87Stored Cross-Site Scripting in Generated Same-Origin List Pages
scripts/fetch-form-spec.mjs:244Form Identifier Allows Filesystem Path Traversal Outside the Selected Output Directory
The skill is described as a page builder for Magicflu/Mofang CRUD pages, but the documented behavior includes broader site/file-management capabilities such as upload, edit, create, rename, delete, and editor integration. That scope expansion is dangerous because an agent or user may invoke the skill expecting code generation, while it can actually modify website content and file repositories in a live environment.
Referenced artifact was not completely inspected
Copy the whole `mofang-page-builder/` folder, not only `SKILL.md`.
Referenced artifact was not completely inspected
2. Run `scripts/fetch-form-spec.mjs`, or ask the user for an exported fielddef JSON and import it.
Referenced artifact was not completely inspected
2. Run `scripts/fetch-form-spec.mjs`, or ask the user for an exported fielddef JSON and import it.
Referenced artifact was not completely inspected
2. Run `scripts/fetch-form-spec.mjs`, or ask the user for an exported fielddef JSON and import it.
Referenced artifact was not completely inspected
2. Run `scripts/fetch-form-spec.mjs`, or ask the user for an exported fielddef JSON and import it.
Referenced artifact was not completely inspected
2. Run `scripts/fetch-form-spec.mjs`, or ask the user for an exported fielddef JSON and import it.
Referenced artifact was not completely inspected
node scripts/mock-jsonv2.mjs --port 3847 --dir ./mock-data
Referenced artifact was not completely inspected
node scripts/mock-jsonv2.mjs --port 3847 --dir ./mock-data
Referenced artifact was not completely inspected
node scripts/deploy.mjs \
Referenced artifact was not completely inspected
Read `references/design.md`, `references/requirements.md`, and `references/filemanager.js` only when debugging implementation details.
Referenced artifact was not completely inspected
| Vanilla HTML+JS | `examples/vanilla/list-page.html` | Same-origin list page |
Referenced artifact was not completely inspected
| Vanilla HTML+JS | `examples/vanilla/list-page-with-apibase.html` | List page wired to local mock |
Referenced artifact was not completely inspected
| Vanilla HTML+JS | `examples/vanilla/form-page.html` | Create-record form |
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
// Prompts for confirmation, then deletes the current item.
// Called by clicking the "Delete" button in detail views
// or choosing the "Delete contextual menu item in list views.
var deleteItem = function(data){
var isDeleted = false;
var msg = lg.confirmation_delete;
The code builds HTML by concatenating untrusted file/folder metadata from the connector response, then injects it with .html(result). If an attacker can control filenames, preview URLs, properties, or other returned fields, they can inject HTML/JavaScript and trigger DOM-based or stored XSS in the file manager UI, which is especially dangerous in an administrative file-management context.
}
// Add the new markup to the DOM.
$('#fileinfo').html(result);
// Bind click events to create detail views and add
// contextual menu options.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const tmpZip = join(tmpdir(), `mofang-skill-pack-${name}-${version}-${process.pid}.zip`);
const excludedDirs = new Set(['.git', 'node_modules', 'docs', 'publish', 'skillsbackup']);
const excludedFiles = new Set(['.env', '.DS_Store', 'tsconfig.json']);
function toZipPath(absPath) {
return relative(skillRoot, absPath).split(sep).join('/');
The skill instructs use of environment variables containing usernames/passwords and multiple networked scripts, but it declares no explicit tool scope or permission boundaries. In an agent setting, that makes credential use and outbound requests implicit rather than user-gated, increasing the chance of unintended secret access or network actions.
The README explicitly suggests using a script to pull form specifications from a real environment, but provides no warning about handling production-like metadata, credentials, tenant-specific schema details, or downstream reuse in local debugging. Even if only field definitions are fetched, this can normalize copying sensitive configuration out of a live environment into local files, increasing the risk of unintended disclosure or misuse.
This HTML/JS file submits user-entered form fields to a backend using fetch(), which transmits potentially sensitive user data over the network. Although the page has success/error messages, there is no visible disclosure before submission that clicking the button will send the data to a remote API.
This markdown file provides a Vue component that posts user-entered form fields to an API endpoint via fetch, but the surrounding skill description only says to copy the component into a project and does not warn that submitting the form will transmit entered data to a backend service. For markdown files, omissions of warnings about behaviors affecting user data or privacy should be flagged.
The document instructs users to obtain JWTs and cookies via a login endpoint and to reuse them in scripts, but it provides no guidance on secret handling, storage, redaction, or transport hygiene. In the context of a code-generation skill, this omission can lead generated code or operator workflows to hardcode credentials, log tokens, or mishandle session cookies, increasing the chance of credential theft and account compromise.
这是一个 markdown 文件，适用 SQP-2 的文档告警要求。该文档列出了创建、修改和删除记录等会直接影响用户数据的操作，尤其 DELETE 接口会造成数据变更或删除，但附近没有任何关于数据丢失、谨慎执行、确认机制或生产环境影响的提醒。
This markdown file defines the skill activation using a wide set of generic terms such as '表单', '记录', '列表', 'CRUD', and '发布等需求'. Those terms are common across many software tasks and the document does not provide exclusions or negative examples, making unintended invocation more likely.
The design explicitly supports a proxy mode that forwards real traffic and preserves live write behavior, yet it does not require a clear warning or consent step before operations that can mutate production data. In a page-builder/debugging skill, this context makes the issue more dangerous because users may assume 'local debugging' is safe while the proxy can still create, modify, or delete real records.
Detected: suspicious.dangerous_exec