Harmonyos Moblink Integration

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:07 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent MobLink integration helper, but it asks users to store an app secret in a plaintext project spreadsheet and defaults several sensitive data-collection options to enabled.

Review this skill before installing. Use only on a trusted HarmonyOS MobLink project, pin and verify SDK versions, avoid committing MobLink_Config.xlsx, prefer environment variables or a secret manager for appSecret, and change optional privacy-sensitive data collection settings to opt-in values that match your app's privacy notice and user consent flow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:171
• Finding: Unpinned Third-Party SDK Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:171-181` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash ohpm install @zztsdk/zztcore ohpm install @zztsdk/moblink ``` The workflow subsequently validates that dependencies were added using unconstrained placeholder versions: ```json5 "dependencies": { "@zztsdk/zztcore": "^x.x.x", "@zztsdk/moblink": "^x.x.x" } ``` ### Technical Analysis The integration workflow installs the current registry versions of `@zztsdk/zztcore` and `@zztsdk/moblink` without requiring an exact, previously reviewed version. It also does not require checksum validation, package provenance verification, lockfile review, or inspection of package lifecycle scripts. As a result, the effective code installed by the Skill can change after the Skill itself has been audited. Even when a legitimate package is currently safe, a compromised publisher account, registry compromise, or malicious future release could introduce hostile build-time or runtime behavior. Caret version ranges can also allow later compatible releases to be selected during subsequent installations, causing non-reproducible builds and bypassing the security assumptions of the original review. ### Attack Path 1. An attacker compromises the publisher account, package registry, or SDK release process. 2. The attacker publishes a malicious version under one of the expected package names. 3. A user invokes the Skill and approves dependency installation. 4. The Agent executes the unpinned `ohpm install` commands. 5. The malicious package is added to the HarmonyOS project. 6. Package-controlled code may execute during installation or build, or become part of the resulting application. 7. The payload operates with the privileges available to the developer's build process or, at runtime, with the permissions granted to the application. ### Impact Assessmen ...[truncated 561 chars]
• Remediation: ## Remediation Suggestions - Require exact, reviewed package versions rather than installing the current release. - Avoid permissive caret ranges for security-sensitive SDK dependencies. - Commit and verify the ohpm lockfile to make installations reproducible. - Review package provenance, publisher identity, release signatures, and package lifecycle scripts before installation. - Record approved package versions and checksums in the Skill documentation. - Require explicit user approval before changing an already approved dependency version. - Run dependency installation and builds in a restricted environment without unnecessary credentials or filesystem access. - Incorporate dependency vulnerability and integrity scanning into CI.

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/generate_excel_template.py:42
• Finding: MobTech Application Secret Is Collected in a Plaintext Project-Root Spreadsheet## Vulnerability Details **File Locations**: `SKILL.md:108-151`, `assets/generate_excel_template.py:42-49`, and `README.md:45-61` **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: Medium ### Vulnerable Code The generated spreadsheet explicitly includes an application-secret field: ```python def create_basic_info_sheet(wb): headers = ["配置项", "说明", "您的信息（必填）"] data = [ ["appKey", "MobTech 应用 Key，从 MobTech 官网注册应用获取", ""], ["appSecret", "MobTech 应用密钥，与 appKey 一同获取", ""], ["bundleName", "鸿蒙应用包名（bundleName），例如 com.example.app", ""] ] ws = create_sheet_with_header(wb, "基础信息", headers, data) for row in range(2, 6): ws.cell(row=row, column=1).font = Font(bold=True, color="FF0000") return ws ``` The workflow instructs the Agent to place that spreadsheet in the target project's root directory and later read it: ```text 1. Execute assets/generate_excel_template.py to generate assets/MobLink_Config_Template.xlsx 2. Copy assets/MobLink_Config_Template.xlsx into {path} 3. Name it MobLink_Config.xlsx under {path} ``` ### Technical Analysis The workflow asks the user to enter `appSecret` into an unencrypted `.xlsx` file located at the root of the application project. An XLSX file is a ZIP-based document format and does not provide confidentiality unless separate encryption is explicitly applied. The Skill does not instruct the Agent to: - add `MobLink_Config.xlsx` to `.gitignore`; - restrict filesystem permissions; - redact the secret from logs or generated output; - remove the secret from the spreadsheet after integration; - securely delete the spreadsheet; or - retrieve the value from a dedicated secret manager. Project-root files are commonly included in source-control commits, workspace synchronization, backups, CI build contexts, support bundles, and repository indexing. The template documentation avoids printing the se ...[truncated 1423 chars]
• Remediation: ## Remediation Suggestions - Remove `appSecret` from the Excel configuration template. - Retrieve the secret only when required from an environment variable, operating-system credential store, CI secret facility, or dedicated secret manager. - Ensure generated source code does not embed a long-lived secret where it can be extracted from the application package. - If temporary local storage is unavoidable: - create the file outside the repository; - apply owner-only filesystem permissions; - add the filename to `.gitignore` before generation; - prevent logging and diagnostic output from containing the value; - clear the sensitive cell immediately after use; and - securely remove the temporary file when the workflow completes. - Add automated secret scanning and a pre-commit rule that rejects `MobLink_Config.xlsx`. - Document credential rotation procedures and instruct users to rotate any secret that may already have been committed or shared.

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/generate_excel_template.py:68
• Finding: Optional Privacy-Sensitive Data Collection Is Enabled by Default## Vulnerability Details **File Location**: `assets/generate_excel_template.py:68-77` **Vulnerability Type**: Privacy-insecure default configuration **Risk Level**: Medium ### Vulnerable Code ```python def create_privacy_sheet(wb): headers = ["配置项", "说明", "您的信息"] data = [ ["privacyPolicyReady", "是否已有隐私政策并在首次冷启动弹窗征得用户同意：是/否", "否"], ["privacyCallbackLocation", "用户点击隐私政策同意按钮后的代码位置，如 EntryAbility.ts:onPrivacyAgreed", ""], ["useZztCustomController", "是否使用 App 数据采集主动控制器（ZztCustomController）：是/否", "否"], ["allowLocationData", "是否允许 MobLink 主动采集地理位置信息：是/否", "是"], ["allowDeviceIdData", "是否允许 MobLink 主动采集设备标识信息：是/否", "是"], ["allowAppListData", "是否允许 MobLink 主动采集应用列表信息：是/否", "是"], ["allowNetworkData", "是否允许 MobLink 主动采集网络状态信息：是/否", "是"], ] return create_sheet_with_header(wb, "隐私合规", headers, data) ``` ### Technical Analysis The generated configuration enables location data, device identifiers, installed-application list data, and network-state data by default. These are privacy-sensitive categories, and some may not be necessary for the core deep-link and scene-restoration functionality. Secure and privacy-preserving defaults should deny optional collection until the application owner documents a specific purpose and the user provides informed consent. A preselected affirmative value can be overlooked during configuration and does not demonstrate an intentional, category-specific decision. The same template defaults `useZztCustomController` to disabled. If that controller is the mechanism used to enforce the individual collection choices, disabling it by default may further weaken the practical effect of those choices. The repository does not contain the eventual controller implementation, so the exact runtime enforcement cannot be verified. ### Attack Path 1. The Agent generates the configuration workbook. 2. The four sensitive collection settin ...[truncated 1187 chars]
• Remediation: ## Remediation Suggestions - Default every optional collection setting to `false`. - Require a separate, explicit opt-in for each privacy-sensitive data category. - Enable a category only after documenting its purpose, necessity, retention period, recipients, and legal basis. - Default the custom data-collection controller to enabled when it is needed to technically enforce denied categories. - Validate that user consent occurs before any SDK initialization or collection. - Separate consent for location, identifiers, application-list data, and network data rather than using one blanket decision. - Add an integration check that rejects affirmative defaults that were not explicitly reviewed. - Verify the generated application behavior through runtime network and privacy testing. - Ensure the application's privacy notice accurately describes every enabled data category and provides a withdrawal mechanism.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The declared description presents the skill as an interactive guide/workflow for answering MobLink integration questions in HarmonyOS NEXT. The supplied code does not implement an interactive guide, triggering logic, conversational workflow, or question-answer behavior. Instead, it programmatically creates a formatted Excel template with predefined sheets and saves it to the local filesystem. While the content of the spreadsheet is related to MobLink integration topics, the primary behavior is materially different: document/template generation rather than interactive guidance. Therefore, the description does not accurately represent the actual code behavior.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill lists "场景还原" alone as a trigger topic without constraining it to MobLink or HarmonyOS integration. Because this phrase can describe a broad class of app features, it risks unintended invocation for unrelated scene-restoration requests.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: This invocation example refers to configuring HarmonyOS scene restoration generally, not specifically MobLink. Users asking about native HarmonyOS scene restoration could unintentionally activate this skill even when MobLink is irrelevant.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This Python file contains user-facing natural-language content entirely in Chinese, including the module docstring, worksheet labels, instructions, and console output. That imposes a specific language on users without any opt-in or documented locale constraint, which matches the language/locale policy violation criteria.

Session Persistence

Medium

• Category: Rogue Agent

Content

["useZztCustomController", "是否使用 App 数据采集主动控制器（ZztCustomController）：是/否", "否"],
        ["allowLocationData", "是否允许 MobLink 主动采集地理位置信息：是/否", "是"],
        ["allowDeviceIdData", "是否允许 MobLink 主动采集设备标识信息：是/否", "是"],
        ["allowAppListData", "是否允许 MobLink 主动采集应用列表信息：是/否", "是"],
        ["allowNetworkData", "是否允许 MobLink 主动采集网络状态信息：是/否", "是"],
    ]
    return create_sheet_with_header(wb, "隐私合规", headers, data)

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

["useZztCustomController", "是否使用 App 数据采集主动控制器（ZztCustomController）：是/否", "否"],
        ["allowLocationData", "是否允许 MobLink 主动采集地理位置信息：是/否", "是"],
        ["allowDeviceIdData", "是否允许 MobLink 主动采集设备标识信息：是/否", "是"],
        ["allowAppListData", "是否允许 MobLink 主动采集应用列表信息：是/否", "是"],
        ["allowNetworkData", "是否允许 MobLink 主动采集网络状态信息：是/否", "是"],
    ]
    return create_sheet_with_header(wb, "隐私合规", headers, data)

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: All user-facing natural-language examples in this markdown file are exclusively in Chinese, and the file provides no indication that other languages are supported or that Chinese is a required locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: 该 README 全文均以中文呈现，包括标题、说明和操作指引，但没有说明这是面向特定中文用户群体，亦未提供其他语言或用户可选语言方案。根据规则，若技能强制使用特定语言且无用户 opt-in，属于自然语言层面的政策风险。

Static analysis

No suspicious patterns detected.