Security audit

Onimi Pages Publish

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Onimi publishing integration with browser OAuth, scoped local task journals, and optional limited telemetry, without hidden persistence or credential collection.

Install only if you intend to let this skill connect to Onimi Pages and, after browser OAuth approval, save drafts, publish or activate releases, and manage project visibility or sharing. Review the requested scopes in the browser, use a trusted install channel, keep the exact project target clear, and revoke the connection from the Onimi dashboard when no longer needed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
md
session. Before the first write, initialize `scripts/task-state.mjs` with the artifact kind, exact

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 462)May include surrounding context.
md
with `.onimi-skill.json`. Resolve this Skill's directory and use `scripts/manage.mjs status` offline or

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 464)May include surrounding context.
md
with `.onimi-skill.json`. Resolve this Skill's directory and use `scripts/manage.mjs status` offline or

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill describes use of networked MCP tools, local scripts, filesystem state, and shell-driven helpers, but does not declare any explicit permission or allowed-tools boundary. That creates an under-scoped skill where a host or reviewer cannot easily enforce least privilege, increasing the chance of unintended shell, network, or environment access during sensitive publication flows.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
md
original task. Report only observed stages, never a percentage. Verify with the least sensitive safe read: call `onimi_get_connection` and compare its account and effective scopes. If an older deployed service does not expose it, `onimi_list_projects` is a compatibility fallback and an empty list is success. Do not read a private draft or create a project as a connection test. The connection tool's `installedModules: "client-local-check-required"` means inspect the actual local Skill directory; never infer installation from the server. If the user cancels, preserve the local artifact and these exact continuation identifiers when present: `resourceType`, `resourceKey`, `resourceVersion`, `locale`, and

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
md
Before any project or release write, establish the target intent from the whole conversation: update one existing project, or create one new project. A generic request to publish does not mean create a new project. Reuse an explicit earlier choice of target, project name or access; do not ask the user to confirm the same choice again. Call `onimi_list_projects` first. Resolve an explicit project UUID exactly; resolve a dashboard/editor

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
for an update, the existing project name/ID/URL; for a new project, its name and intended access (`public` means listed in Explore and open to anyone, `unlisted` means open to anyone with the link, or `private` means owner/grant access). Do not ask for new-project name or visibility on an update. An explicit controlled-sharing choice establishes `private`; explain that consequence without asking a redundant visibility question. Call `onimi_create_project` only after the user explicitly chooses a new project and its name and access

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The default prompt authorizes the agent to publish a selected draft and activate an approved revision, but it does not define who may trigger publication, what counts as selection or approval, or what confirmation gates must occur before making a public change. In a skill that can affect externally visible content through a browser-authorized remote MCP, this ambiguity can enable unintended or unauthorized publication if the agent infers user intent too broadly or acts on stale context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: 该安装说明在命令中直接要求使用 --lang zh-CN，并在后续替代命令中延续这一要求，但没有说明这是可选项或提供其他语言选择。根据规则，强制特定语言/区域设置而未取得用户选择或明确 opt-in，属于自然语言层面的语言/locale 政策问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The observer throws unless locale is exactly en or zh-CN, which enforces a narrow language/locale policy in code. This is a natural-language policy concern because the file does not offer a user choice or explain a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.