T09 · Insecure Skill Coding Practices
Error
- Location
assets/server.py:134- Finding
Directory Traversal in the Logs API Allows Reading Log Files Outside the Workspace
- Content
View full analysis
- Remediation
View remediation
Security audit
Super Deep Coding
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly coherent for multi-agent coding, but its local dashboard exposes project files and logs too broadly for a sensitive development workspace.
Install only in a dedicated workspace that contains no secrets, tokens, private keys, or unrelated source. Treat the dashboard as a local file viewer for the workspace, keep it bound to localhost, stop it when done, and prefer pinning/vendoring frontend and npx dependencies before using it on sensitive projects.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
assets/server.py:216- Finding
Unauthenticated Static Handler Exposes All Regular Files in the Project Workspace
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
assets/dashboard.html:7- Finding
Dashboard Executes Unpinned Third-Party JavaScript from External CDNs
- Content
View full analysis
``` ### Technical Analysis The dashboard loads and executes JavaScript directly from three third-party CDN services. The Tailwind URL is unversioned, while the other dependencies use broad major-version selectors rather than immutable, exact artifacts. None of the script elements provides a Subresource Integrity hash. Therefore, the browser has no cryptographic mechanism to verify that the downloaded script is the exact version reviewed with this project. If a CDN account, package publication, DNS path, or upstream distribution artifact is compromised or unexpectedly changed, modified JavaScript will execute in the dashboard's `http://localhost:8765` origin. The absence of a restrictive Content Security Policy further increases reliance on the external providers. ### Attack Path 1. A referenced CDN resource or upstream package distribution is compromised, replaced, or changed under the mutable version selector. 2. A user starts the dashboard and opens it in a browser with network access. 3. The browser downloads the changed script from the external CDN. 4. Because no integrity hash is present, the browser accepts and executes it. 5. The script runs with access to the dashboard origin. 6. It can issue same-origin requests to project and log APIs, inspect data rendered by the dashboard, manipulate review information, or send accessible data to an external destination subject to browser controls. ### Impact Assessment A successful supply-chain compromise ...[truncated 459 chars]- Remediation
View remediation
``` 4. Add a restrictive Content Security Policy that permits scripts only from the dashboard origin or an explicit minimal allowlist. 5. Avoid Tailwind's runtime CDN build in production-like use; compile required CSS during packaging and serve the resulting static stylesheet locally. 6. Maintain a dependency inventory and periodically review pinned versions for known vulnerabilities. 7. Package all required frontend resources with the Skill so that the audited artifact fully determines the code executed at runtime. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (27)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description frames the skill as a multi-agent coding workflow, but the content also instructs users to deploy a dashboard server, scan project directories, expose APIs, and serve logs and archived project data. This mismatch is security-relevant because users may approve the skill expecting only development orchestration, while it also introduces local service exposure and broad filesystem visibility that can leak sensitive project information.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Dashboard is included in `assets/server.py` and `assets/dashboard.html`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Dashboard is included in `assets/server.py` and `assets/dashboard.html`.
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </head> <body class="bg-gray-50 min-h-screen"> <div id="app" v-cloak> <!-- Header --> <header class="bg-white shadow-sm border-b"> <div class="max-w-7xl mx-auto px-4 py-4"> <div class="flex items-center justify-between">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </div> </div> <!-- Pending Request Banner --> <div v-if="currentProject && currentProject.is_request" class="bg-gradient-to-r from-yellow-500 to-orange-500 rounded-lg shadow-lg p-6 mb-6 text-white"> <div> <h2 class="text-2xl font-bold">⏳ {{ currentProject.name.replace('[待启动] ', '') }}</h2>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </div> </div> <!-- Task List --> <div v-if="currentProject && !currentProject.is_request" class="bg-white rounded-lg shadow"> <div class="px-4 py-3 border-b border-gray-200"> <h2 class="text-lg font-bold text-gray-900">任务列表</h2>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </div> </div> <!-- Progress Info --> <div v-if="module.progress" class="flex items-center gap-4 text-xs text-gray-500"> <span>迭代：{{ module.progress.review_iterations || 0 }} 轮</span> <span v-if="module.progress.started_at">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </div> </div> <!-- Progress Info --> <div v-if="module.progress" class="flex items-center gap-4 text-xs text-gray-500"> <span>迭代:{{ module.progress.review_iterations || 0 }} 轮</span> <span v-if="module.progress.started_at">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <div v-for="(it, index) in module.review_history" :key="index" class="rounded-lg overflow-hidden border" :class="getIterationBorderClass(it.status)"> <!-- Header bar --> <div class="flex items-center justify-between px-3 py-2" :class="getIterationBgClass(it.status)"> <div class="flex items-center gap-2">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <!-- Detail panel --> <div v-if="isIterationExpanded(module.module_id, it.iteration)" class="px-3 py-3 bg-white space-y-3"> <!-- Parsed checklist --> <div v-if="getParsedChecks(it.summary).length > 0"> <p class="text-xs font-medium text-gray-500 mb-1.5">检查项：</p> <div class="space-y-1">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <div v-for="(line, li) in getNonCheckLines(it.summary)" :key="li">{{ line }}</div> </div> <!-- Feedback (only if different from summary) --> <div v-if="it.feedback && !isSameAsSummary(it.summary, it.feedback)" class="pt-3 border-t border-gray-100"> <p class="text-xs font-medium text-gray-500 mb-1">反馈：</p> <div class="text-xs text-gray-600 space-y-1 leading-relaxed" v-html="renderMarkdown(it.feedback)"></div>
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill requests or implies powerful capabilities like file access, session messaging, agent spawning, code execution, and a local HTTP dashboard, but it does not declare an explicit tool scope or permission boundary in the skill manifest. That makes the operational trust model opaque and increases the risk that users or hosting platforms enable broader access than intended, especially for a skill that orchestrates multiple agents and runs project code.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation text uses broad triggers like requests for complex software projects, deep coding, or multi-agent collaboration, which can cause the skill to activate in many ordinary development contexts. Because this skill encourages code execution, agent spawning, session communication, and optional local server use, over-broad activation increases the chance of these higher-risk behaviors being invoked unintentionally.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 77% confidence
- Finding
Referencing Playwright through
npx playwrightwithout pinning an exact package version creates a supply-chain risk, because execution may resolve to a newer or unexpected package version at runtime. In a skill that already executes arbitrary project code and uses browser automation, an unpinned tool increases exposure to malicious or compromised upstream releases.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document declares
lang="zh-CN", and the visible interface text throughout the page is exclusively in Simplified Chinese. For a general-purpose dashboard, this imposes a specific language/locale without any opt-in, selection mechanism, or documented regional constraint, which matches the language-policy violation criteria.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The dashboard renders agent-controlled Markdown via markdown-it and injects the output with Vue's v-html, which allows untrusted content to become active HTML in the browser. In this skill, review feedback and handoff summaries appear to come from agents/logged project data, so a malicious or compromised agent can inject script gadgets, event handlers, javascript: URLs, or other XSS payloads depending on parser/browser behavior.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
A deep-coding skill would reasonably coordinate coding tasks and project state, but running an HTTP server that serves files and exposes logs is an additional capability not mentioned in the manifest. The ability to browse project files and archived JSON over HTTP is broader than the stated multi-agent collaboration role.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a multi-agent development workflow skill focused on orchestration, building, reviewing, and complex project development. This file instead implements a local HTTP dashboard and generic static file server that can return any file under BASE_DIR via /projects/, /archive/, or direct path handling, which is a materially different behavior than the stated coding workflow purpose.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill metadata presents this as a coding orchestration workflow, but the rules expand it into launching HTTP services and browser-driven E2E activity. That capability expansion increases attack surface because a user invoking a development helper may unknowingly trigger process creation, network-exposed services, and active browser automation on local artifacts.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The guidance permits starting HTTP servers as part of review even though the skill is described as an orchestrator for collaborative coding. Hidden process-execution behavior is risky because it can expose local files or application content over a network interface and creates capabilities beyond user expectations.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
The skill instructs use of
npx servewithout pinning a package version, which can pull the latest package at execution time. That creates a supply-chain risk and makes behavior non-reproducible; if the upstream package is compromised or changed unexpectedly, the orchestrator or reviewer could execute untrusted code.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The delivery flow requires starting and later killing a web server, which is operational system management outside the declared coding-orchestration scope. This mismatch is dangerous because it grants the skill authority to create long-lived processes and exposed endpoints that users may not anticipate when enabling the skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The instructions direct the agent to start a local web server, keep it running, and later kill it, but do not require a prominent user-facing warning or opt-in about process creation and service exposure. That is risky because users may unknowingly expose project content on a port, leave background processes running, or create a reachable local service without informed consent.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
This delivery workflow again relies on unpinned
npx serve, exposing the system to transient dependency resolution and possible execution of altered upstream code. Because this step occurs during delivery, it may be triggered on real projects and can expose the host to avoidable supply-chain compromise.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The file-level docstring presents this component as an "OpenClaw Harness Dashboard Server," while the manifest claims the skill is a deep-coding multi-agent development system. This documentation indicates a different apparent intent than the skill's declared purpose, suggesting the file belongs to a dashboard/harness utility rather than the described coding workflow itself.
- Content