UTF-8发布基础设施

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:34 AM UTC
• Version: 2.0.1

Overview

The skill is mostly aligned with UTF-8 publishing, but it ships live-looking fallback credentials and handles posting credentials/content in ways users should review before installing.

Review before installing. Use only your own least-privilege Discord webhook, GitHub token, and Reddit credentials; avoid passing secrets on the command line; do not run integration-test.js unless the embedded credentials have been removed; and avoid publishing sensitive content unless you accept that failed posts may be saved locally as plaintext backups.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: integration-test.js:11

Finding

Hardcoded Live-Looking Discord and GitHub Credentials

Content

View full analysis

Vulnerability Details

File Location: integration-test.js:11-12
Vulnerability Type: Hardcoded external-service credentials
Risk Level: High

javascript

// Configuration - obtained from environment variables
const DISCORD_WEBHOOK = process.env.DISCORD_WEBHOOK_URL || 'https://discord.com/api/webhooks/1482573744688857109/tD4x8oDKD539koQEeBauFe12N-K2fI1Iydh2Sjvyl23_3JYO08qgXbpBcRFRemKsPUq6';
const GITHUB_TOKEN = process.env.GITHUB_TOKEN || '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';

Technical Analysis

The integration test includes a Discord webhook credential and a GitHub personal access token as default fallback values. These credentials are available to anyone who can download or inspect the project, including package consumers and source repository visitors.

When the corresponding environment variables are absent, npm run integration-test automatically uses these embedded values and makes live network requests. The Discord credential is used to post a message, while the GitHub credential is used to create a private Gist.

Even if the credentials have already expired or been revoked, committing secrets to source code is an insecure credential-management practice. Their historical exposure must be treated as a potential compromise.

Attack Path

1. An attacker downloads or inspects the project source.
2. The attacker extracts the Discord webhook URL and GitHub token from integration-test.js.
3. The attacker tests whether either credential remains valid.
4. If the webhook is active, the attacker submits arbitrary messages through it.
5. If the GitHub token is active, the attacker performs any API operations allowed by its scopes.
6. The attacker may continue using the credentials independently of this Skill until they are revoked.

Impact Assessment

The Discord credential may permit unauthorized posting, impersonation of the webhook identity, spam, phishing, or quota abuse in the as ...[truncated 429 chars]

Remediation

View remediation

Remediation Suggestions

1. Revoke and rotate the exposed Discord webhook and GitHub token immediately.
2. Remove all fallback credential literals from the source.
3. Require credentials to be supplied explicitly through protected environment variables or a secret manager.
4. Fail closed and skip live integration tests when required credentials are absent.
5. Purge the credentials from repository history where feasible; deleting them only from the latest revision is insufficient.
6. Add automated secret scanning to pre-commit hooks and CI.
7. Use dedicated, short-lived, least-privilege test credentials for integration testing.
8. Isolate live integration tests from default test execution and require an explicit opt-in flag.

T09 · Insecure Skill Coding Practices

Warning

• Location: cli.js:187

Finding

Sensitive Credentials Accepted Through Process Arguments and Partially Logged

Content

View full analysis

Vulnerability Details

File Location: cli.js:187-203, cli.js:249-266, and cli.js:282-297
Vulnerability Type: Insecure credential input and disclosure
Risk Level: Medium

javascript

case 'test-github': {
  let token, content;
  
  if (args.length >= 3) {
    token = args[1];
    content = args.slice(2).join(' ');
  } else if (args.length === 2) {
    token = process.env.GITHUB_TOKEN;
    content = args[1];
  } else if (args.length === 1) {
    token = process.env.GITHUB_TOKEN;
    content = `# UTF-8 encoding test Gist
...
`;
  }
  
  if (!token) {
    console.error('GitHub Token is required');
    process.exit(1);
  }
  
  console.log(`Token: ${token.substring(0, 10)}...`);

javascript

case 'test-reddit': {
  let clientId, clientSecret, username, password, subreddit, title, content;
  
  if (args.length >= 8) {
    clientId = args[1];
    clientSecret = args[2];
    username = args[3];
    password = args[4];
    subreddit = args[5];
    title = args[6];
    content = args.slice(7).join(' ');
  } else if (args.length === 1) {
    clientId = process.env.REDDIT_CLIENT_ID;
    clientSecret = process.env.REDDIT_CLIENT_SECRET;
    username = process.env.REDDIT_USERNAME;
    password = process.env.REDDIT_PASSWORD;
    subreddit = process.env.REDDIT_SUBREDDIT || 'r/test';
    title = process.env.REDDIT_TITLE || 'UTF-8 encoding test post';
  }

  console.log(`Username: ${username}`);
  console.log(`Client ID: ${clientId.substring(0, 10)}...`);

Technical Analysis

The CLI supports passing GitHub tokens, Reddit client secrets, Reddit passwords, and Discord webhook URLs as positional command-line arguments. Process arguments are not an appropriate channel for secrets because they may be exposed through:

• Shell command history.
• Process inspection facilities.
• CI/CD command logs.
• Terminal session recordings.
• Monitori ...[truncated 1409 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all secret-bearing positional command-line parameters.
2. Accept secrets only through protected environment variables, a secret manager, protected configuration files, or non-echoing interactive input.
3. Prefer short-lived access tokens with the minimum required scopes.
4. Never print token prefixes, webhook URL fragments, passwords, or client secrets.
5. Log only whether a credential was supplied, without revealing any part of its value.
6. Update help text and examples so they never encourage placing secrets on the command line.
7. Add automated tests that verify secrets do not appear in standard output, standard error, or thrown errors.
8. Document shell-history and CI-log risks for users upgrading from the current interface.

T09 · Insecure Skill Coding Practices

Warning

• Location: utf8-encoder.js:185

Finding

Discord Adapter Allows Posting Content to Arbitrary HTTPS Hosts

Content

View full analysis

Vulnerability Details

File Location: utf8-encoder.js:185-193
Vulnerability Type: Missing outbound destination validation
Risk Level: Medium

javascript

const postData = this.createUTF8JSONPayload(payload);
const headers = this.createUTF8Headers(postData);

const url = new URL(webhookUrl);

const httpsOptions = {
  hostname: url.hostname,
  path: url.pathname + url.search,
  method: 'POST',
  headers: headers
};

Technical Analysis

The method is presented as a Discord-specific adapter, but it does not verify that the supplied URL belongs to Discord. Any syntactically valid URL accepted by Node.js and usable by https.request can control the request hostname and path.

Consequently, a caller or configuration source that can influence the webhook value can redirect publication content to an arbitrary HTTPS service. The CLI’s infrastructure publishing command can read a user-selected file and pass its contents to this method, increasing the consequence of destination manipulation.

This behavior is not covert exfiltration by itself because publication is an explicit feature and the caller supplies the destination. Nevertheless, it violates least privilege for a Discord-specific method and creates an outbound request and data-disclosure primitive when embedded in a higher-trust application.

Attack Path

1. An attacker gains control over DISCORD_WEBHOOK_URL, a platform configuration object, or the webhookUrl method argument.
2. The attacker replaces the Discord endpoint with an attacker-controlled HTTPS endpoint or a reachable internal HTTPS service.
3. A user invokes the publishing command with content or a file believed to be destined for Discord.
4. The adapter serializes the content and sends it to the attacker-selected hostname.
5. The attacker receives the publication content or uses the request to interact with a network service reachable from the execution environment.

...[truncated 544 chars]

Remediation

View remediation

Remediation Suggestions

1. Require the URL protocol to be exactly https:.
2. Enforce an exact allowlist of approved Discord webhook hostnames.
3. Validate the expected Discord webhook path format.
4. Reject URLs containing embedded credentials, unexpected ports, malformed hostnames, or unsupported query parameters.
5. Avoid suffix-only hostname checks that can be bypassed by domains such as discord.com.attacker.example.
6. Where internal-network exposure is relevant, resolve and reject private, loopback, link-local, and reserved destination addresses.
7. Do not automatically follow redirects to unapproved hosts.
8. If arbitrary HTTP publication is intentional, place it in a separately named generic adapter and require explicit caller authorization.

T09 · Insecure Skill Coding Practices

Note

• Location: utf8-encoder.js:652

Finding

Failed Publications Create Unprotected Plaintext Backups

Content

View full analysis

Vulnerability Details

File Location: utf8-encoder.js:652-654 and utf8-encoder.js:710-712
Vulnerability Type: Insecure local storage of publication content
Risk Level: Low

javascript

// Fallback: save to a local file
const fs = require('fs');
const backupPath = `./backup-${Date.now()}.md`;
fs.writeFileSync(backupPath, content, 'utf8');
console.debug(`Content backed up to local file: ${backupPath}`);

javascript

// Fallback: save to a local file
const fs = require('fs');
const backupPath = `./backup-reddit-${Date.now()}.md`;
fs.writeFileSync(backupPath, content, 'utf8');
console.debug(`Content backed up to local file: ${backupPath}`);

Technical Analysis

After all GitHub or Reddit publication attempts fail, the middleware automatically writes the complete content to the current working directory. The backup operation does not:

• Obtain explicit consent at the point of persistence.
• Use a caller-approved storage directory.
• Specify restrictive file permissions.
• Use exclusive, collision-resistant file creation.
• Encrypt sensitive content.
• Define retention or cleanup behavior.

File permissions are therefore affected by the process umask and environment. In shared workspaces, containers, CI runners, or multi-user systems, the resulting Markdown files may be visible to unintended principals or collected by unrelated backup and artifact systems.

The documentation mentions automatic local backup, so the behavior is not hidden. The weakness is the insecure implementation and lack of data-sensitivity controls.

Attack Path

1. Sensitive content is submitted through the resilient GitHub Gist or Reddit publishing method.
2. Publication repeatedly fails because of invalid credentials, rate limiting, network errors, or an attacker-induced failure.
3. The middleware writes the full plaintext content into the current working directory.
4. The file remains after th ...[truncated 713 chars]

Remediation

View remediation

Remediation Suggestions

1. Make local backup behavior opt-in rather than automatic.
2. Allow the caller to provide an approved backup directory.
3. Create backup files with restrictive permissions such as mode 0o600.
4. Use exclusive creation and cryptographically random filenames to avoid collisions and unsafe pre-existing paths.
5. Warn the caller before persisting content and return the backup path explicitly.
6. Provide configurable retention and secure cleanup behavior.
7. Avoid writing content classified as sensitive unless the caller explicitly authorizes it.
8. Consider authenticated encryption where backups must persist on shared storage.
9. Ensure backup files are excluded from source control, build artifacts, and automated publication workflows.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (28)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The English mismatch finding correctly identifies undeclared outbound network access, external resource creation, credential handling, and local backup writes as broader behavior than 'encoding infrastructure'. In agent settings, this context is more dangerous because a skill framed as harmless text processing may be auto-selected and then gain access to secrets or transmit user content to third-party services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The English mismatch finding correctly identifies undeclared outbound network access, external resource creation, credential handling, and local backup writes as broader behavior than 'encoding infrastructure'. In agent settings, this context is more dangerous because a skill framed as harmless text processing may be auto-selected and then gain access to secrets or transmit user content to third-party services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The English mismatch finding correctly identifies undeclared outbound network access, external resource creation, credential handling, and local backup writes as broader behavior than 'encoding infrastructure'. In agent settings, this context is more dangerous because a skill framed as harmless text processing may be auto-selected and then gain access to secrets or transmit user content to third-party services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The English mismatch finding correctly identifies undeclared outbound network access, external resource creation, credential handling, and local backup writes as broader behavior than 'encoding infrastructure'. In agent settings, this context is more dangerous because a skill framed as harmless text processing may be auto-selected and then gain access to secrets or transmit user content to third-party services.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The CLI accesses environment variables containing Discord, GitHub, and Reddit secrets, but the skill is presented as UTF-8 infrastructure rather than a credentialed publishing tool. In an agent setting, undeclared secret access increases the risk of unexpected credential use and silent exfiltration or posting to external services.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The Reddit command collects full account credentials, including username and password, to create posts, which is far beyond what a UTF-8 utility should require. In an agent environment this can lead to credential harvesting, misuse of a real user account, and unauthorized posting or account compromise if logs, history, or process listings expose the values.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file embeds a fallback Discord webhook and GitHub personal access token directly in source code, which is a direct secret exposure. Anyone with access to the code can reuse these credentials to post to Discord or access GitHub Gist capabilities, and public leakage can lead to account abuse, spam, data exposure, and token revocation incidents.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Using hardcoded fallback secrets means the script will silently use embedded credentials when environment variables are absent, which removes operator control and encourages unsafe execution. This creates immediate secret compromise risk and can trigger unauthorized actions from any environment where the script is run.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module is presented as UTF-8 encoding infrastructure, but it includes full outbound publishing features to Discord, GitHub, and Reddit. That capability expansion materially changes the trust boundary: content and credentials can be transmitted to third-party services under the guise of a text-encoding helper, which is dangerous in an agent skill because callers may grant it broader access than intended.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code accepts Reddit client credentials and a username/password, performs OAuth, and posts content externally, which is unrelated to mere UTF-8 handling. In an agent context, hidden credential-handling and publication logic increases the risk of unauthorized posting, secret misuse, and data exfiltration because the declared purpose does not prepare operators for that behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation promotes automatic multi-platform publishing and local backup/recovery behaviors without prominent warnings that user content may be transmitted to third parties and written to disk. In an agent ecosystem, hidden side effects materially increase the risk of accidental disclosure of sensitive text, credentials, or regulated data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code's help text, usage instructions, and operational messages are presented in Chinese only, which imposes a specific language on all users. The file does not offer any user opt-in, locale selection, or documented justification for a Chinese-only interface.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description frames the tool as encoding/publishing infrastructure, but the CLI exposes direct posting actions to Discord, GitHub, and Reddit. This mismatch is dangerous because users or agents may grant trust appropriate for text processing while unintentionally enabling outbound network actions to third-party platforms.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Reading Discord, GitHub, and Reddit secrets from environment variables is sensitive behavior that is not justified by the stated encoding-focused purpose. In context, the danger is amplified because a seemingly harmless text utility can unexpectedly consume high-value secrets and interact with external services.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The comments present this as a UTF-8 encoding integration test, but the implementation performs authenticated publishing actions against real external services. This mismatch can mislead reviewers or operators into running code they believe is harmless, increasing the chance of unintended credentialed network activity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Nearly all user-facing strings and console output in the file are in Chinese, and the script does not provide any language selection or indicate that it is intentionally limited to a Chinese-speaking audience. This creates a language/locale policy concern because it imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The integration test performs real outbound requests to Discord and GitHub, causing the script to publish externally rather than only validate UTF-8 handling. In a skill described as encoding/publishing infrastructure, undisclosed live transmissions expand the trust boundary and can leak test content, consume third-party resources, or be abused during execution in automated environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script transmits test content to Discord and GitHub without a clear upfront disclosure of the exact payloads and destinations before execution. In agent or automation contexts, this can cause users to unknowingly send internal text, timestamps, metadata, or future modified content to third-party services.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill can create GitHub Gists using API tokens, a privileged network action that goes beyond text encoding. In practice, this can publish user content externally and use sensitive tokens in a component whose advertised purpose does not justify that level of authority, creating avoidable exposure and confusion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

On GitHub publication failure, the code silently writes the content to a local backup file without prior warning or consent. This can persist sensitive user data to disk unexpectedly, increasing the risk of local disclosure through backups, shared workspaces, or later collection by other processes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Reddit fallback path also silently stores user content to a local file when posting fails. In an agent or automation environment, this can create unauthorized data retention and expose sensitive content outside the user's expectations or data-handling policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The skill name, description, examples, and usage guidance are entirely presented in Chinese-centric form, including repeated emphasis on Chinese text handling, without indicating whether other languages are supported or whether the locale focus is intentional and limited. Because policy violations here concern forced language or locale without opt-in, this is a mild but noticeable documentation issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This manifest includes user-facing natural language entirely in Chinese in the description and author metadata, but does not indicate that the skill is region-specific or that users can choose a language/locale. Under the policy provided, forcing a specific language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The file header at L002-L005 states this is a core functionality test script that does not rely on external APIs. However, the closing message at L256 explicitly recommends running real API tests, which creates an intent-level inconsistency in the script's documentation about its testing scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.