Security audit

mofang-records

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated Magicflu/Mofang purpose, but it uses business credentials for powerful record and workflow actions and allows insecure HTTP endpoints that could expose those credentials.

Review before installing. Use this only with a Magicflu/Mofang server and account you trust, prefer a narrowly scoped non-admin account, configure an HTTPS BASE_URL, and require explicit human confirmation before deletes or BPM workflow changes. Be aware it stores recent space/form aliases locally under ~/.mofang-skills.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: dist/utils/http-client.js:40
Finding: Credentials and bearer tokens may be transmitted over unencrypted HTTP
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: package-lock.json:92
Finding: Installation retrieves executable dependencies from a third-party registry mirror
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
md
Copy the whole `mofang-records/` folder, not only `SKILL.md`.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · cli.mjs (reported line 13)May include surrounding context.
js
* MOFANG_USERNAME / USERNAME * MOFANG_PASSWORD / PASSWORD * * Or from a .env file in the same directory as this script. */ import { readFileSync } from 'fs';

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · cli.mjs (reported line 23)May include surrounding context.
js
* MOFANG_USERNAME / USERNAME * MOFANG_PASSWORD / PASSWORD * * Or from a .env file in the same directory as this script. */ import { readFileSync } from 'fs';

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · cli.mjs (reported line 44)May include surrounding context.
js
* MOFANG_USERNAME / USERNAME * MOFANG_PASSWORD / PASSWORD * * Or from a .env file in the same directory as this script. */ import { readFileSync } from 'fs';

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · cli.mjs (reported line 172)May include surrounding context.
js
* MOFANG_USERNAME / USERNAME * MOFANG_PASSWORD / PASSWORD * * Or from a .env file in the same directory as this script. */ import { readFileSync } from 'fs';

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · dist/health.js (reported line 25)May include surrounding context.
js
* MOFANG_USERNAME / USERNAME * MOFANG_PASSWORD / PASSWORD * * Or from a .env file in the same directory as this script. */ import { readFileSync } from 'fs';

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · cli.mjs (reported line 27)May include surrounding context.
js
function loadDotEnv() { try { const envPath = join(__dirname, '.env'); const content = readFileSync(envPath, 'utf-8'); for (const line of content.split('\n')) { const trimmed = line.trim();

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The jump handler exposes abort, rollback, and recovery operations that directly manipulate workflow execution state and can terminate or rewind tasks based on task IDs and inferred BPMN targets, with no safety interlocks in the skill itself. Even if backend authorization exists, the absence of user-facing warnings, confirmation, or policy checks increases the risk of accidental or abusive state changes that can disrupt approvals, bypass intended process steps, or invalidate audit expectations. In a BPM/workflow administration skill, these operations are especially sensitive because they affect live business processes.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes a bundled CLI that consumes environment variables containing credentials and performs network operations against a remote Magicflu/Mofang instance, but the manifest declares no explicit tool scope or permission boundaries. In agents that honor skill-declared scopes, this can lead to overbroad ambient access and make it harder for users or policy layers to understand that the skill needs secrets and outbound network access before it is used.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code file declares jump operations including 'abort', 'rollback', and 'recovery', which are potentially destructive or irreversible workflow actions. Although there is a brief technical comment, there is no visible confirmation prompt, user-facing disclosure, or explicit warning about the impact of these actions in the file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The non-simple task completion path unconditionally deletes all existing task variables before writing back only a curated subset plus caller-supplied variables. If the original task contained additional workflow-critical variables not captured by KEEP_COMPLETE_VAR_NAMES, this can silently alter process behavior, drop approvals/context, or corrupt downstream automation. In a BPM skill that performs real workflow actions, this is more dangerous because callers may trigger irreversible business-state changes without realizing variables are being discarded.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code uses USERNAME and PASSWORD to obtain a token and then sends an authenticated HTTP request to list spaces. While the comments describe a health check, there is no confirmation prompt, user-facing log, or explicit warning in the code that credentials will be used to contact a remote server and retrieve account data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The delete handler performs an irreversible record deletion immediately from supplied parameters, with no explicit confirmation, dry-run, safeguard, or higher-friction check in this layer. In a CLI/agent skill context, this is more dangerous because LLMs or users can issue mistaken or ambiguous commands, turning a misunderstanding into destructive data loss.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code reads BASE_URL, USERNAME, and PASSWORD from the execution context and uses them to make remote API requests, but the file contains no user-facing log, comment, or other disclosure explaining that credentials are being used. For a code file, accessing sensitive credentials and transmitting them to a server should include some visible warning or documentation unless clearly disclosed elsewhere.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code persists cached data under ~/.mofang-skills, including recent space/form selections and learned aliases derived from user input. The file performs these writes silently and contains no confirmation, logging, or user-facing disclosure beyond internal comments, so users may be unaware that their activity-derived data is being stored locally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file's natural-language documentation is written exclusively in Chinese, including the main interface description and request behavior comments. If this skill is intended for general use, that creates a language policy concern because the user is not offered any language choice or opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This module sends username and password to /magicflu/jwt and later attaches bearer tokens and cookies to outbound HTTP requests, but the file provides no user-facing warning, confirmation, or visible log about these network transmissions. The existing comments are implementation-focused and do not disclose to users that authentication data and identity-related headers/cookies will be sent over the network.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This manifest uses Chinese-only natural language in the description and config field descriptions, but does not state that the skill is intended only for Chinese-speaking users or offer any language choice. That can violate language/locale policy because it implicitly forces a specific language without documented opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Multiple tool descriptions require inputs such as space names and form names in Chinese, for example 空间名称（中文） and 表单名称（中文）. This imposes a specific language expectation in the skill interface without offering a language choice or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: mofang_bpm_close_transaction is described as a state-changing BPM operation, but unlike other write actions in this skill it lacks an explicit 'confirm with the user before executing' warning. In a workflow system, closing a transaction can finalize or alter process state, so an agent may execute it without an extra confirmation step and cause unintended workflow changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code presents multiple user-facing descriptions and environment help text in Chinese string literals, which imposes a specific language on users without any visible opt-in or locale-selection mechanism. Under the stated policy, forcing a language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file-level comment describes the skill entirely in Chinese ('获取表单字段结构定义', '接受 formHint + spaceHint，内部自动解析为 spaceId + formId') with no indication that language is selectable or intentionally region-specific. Under the policy for natural-language violations, forcing a specific language without opt-in can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language description and parameter notes are written only in Chinese, indicating a language-specific interaction pattern without documenting user choice or opt-in. This can violate language/locale policy when a skill implicitly constrains usage to a specific language for general audiences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The handler performs an HTTP request via apiRequest after building config from BASE_URL, USERNAME, and PASSWORD. While listing forms is the skill's apparent purpose, this file itself provides no user-facing warning, confirmation, or disclosure that configured credentials will be used to query a remote service and return workspace metadata.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file’s user-facing description strings are written only in Chinese ("健康检查" and "验证配置是否正确：获取 Token + 列出空间") with no indication that the skill supports other languages or allows user language selection. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/bpm.js:23

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/fields.js:11

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/forms.js:11

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/health.js:10

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/records.js:17

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/spaces.js:9