Security audit

MBTI人格与职业测评

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs a local MBTI assessment, but generated quiz and report files include under-disclosed external promotional links and there are local data-handling hardening gaps.

Review this before installing if you need a strictly offline or institutionally neutral assessment tool. Avoid clicking generated footer badges unless you are comfortable leaving the local workflow, treat answer JSON/PDF files as sensitive personal data, clear browser-saved quiz progress on shared machines, and pin optional PDF dependencies in managed environments.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: scripts/build_quiz_page.py:23
Finding: Undisclosed Promotional Content Injected into Generated Assessment Artifacts
Content: View full analysis
%s' % (url, bg, fg, label) for label, bg, fg, url in FOOTER_BADGES), ``` The report generator contains the same hard-coded destinations and injects them into HTML/PDF report output. Its ReportLab fallback additionally draws the badges on report pages: ```python widths = [stringWidth(lbl, font, fs) + 2 * pad_h for lbl, _, _, _ in FOOTER_BADGES] total_w = sum(widths) + gap * (len(FOOTER_BADGES) - 1) x = (A4[0] - total_w) / 2.0 y = 4 * mm for (lbl, bg, fg, _url), w in zip(FOOTER_BADGES, widths): canvas.setFillColor(HexColor(bg)) canvas.roundRect(x, y, w, pill_h, pill_h / 2.0, stroke=0, fill=1) canvas.setFillColor(HexColor(fg)) canvas.setFont(font, fs) canvas.drawCentredString(x + w / 2.0, y + 1.6, lbl) x += w + gap ``` ### Technical Analysis The Skill's declared purpose is to conduct a local MBTI-style assessment, score answers, and generat ...[truncated 2285 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/team_pipeline.py:35
Finding: Race-Prone Temporary Result File in Team Scoring Pipeline
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:7
Finding: Optional PDF Dependencies Are Not Reproducibly Pinned
Content: View full analysis
=61.0 reportlab>=4.0 ``` ### Technical Analysis The project allows any future version of WeasyPrint at or above 61.0 and any future version of ReportLab at or above 4.0. No dependency lock file or package hashes were identified. These packages are imported directly into the report-generation process. Consequently, package code executes with the same permissions as the user running the Skill. An installation performed at a later date may resolve to releases that were not reviewed with this project version. This is a reproducibility and supply-chain-hardening weakness rather than evidence that the named packages are currently malicious. The package names use established public projects, and the audit did not identify dependency confusion, typosquatting, or a nonstandard package index. ### Attack Path 1. A user installs the dependencies from `requirements.txt`. 2. The package resolver selects the newest versions satisfying the lower bounds. 3. Those versions may differ from the versions originally tested by the project author. 4. A compromised upstream release, dependency, package-index response, or incompatible future release is downloaded. 5. `generate_report.py` imports the installed package. 6. Package initialization or report-rendering code executes with the invoking user's permissions. Successful exploitation requires compromise or unsafe behavior in the package supply chain; the requirement ranges alone do not constitute direct code execution. ### Impact Assessment If a resolved package or transitive dependency were compromised, it would execute with the permissions of the Skill process. That could theoretically permit access to files, environment variables, network resources, and report inputs available to that user. In the currently reviewed source, the ...[truncated 203 chars]
Remediation: View remediation
reportlab== ``` 2. Generate and commit a lock file that includes transitive dependencies. 3. Record package hashes and install with hash verification, such as `pip install --require-hashes -r requirements.txt`. 4. Use a trusted package index and document the expected index configuration. 5. Run dependency vulnerability scanning in continuous integration. 6. Periodically update pinned versions through a controlled review and testing process. 7. Clearly state that scoring and quiz generation use only the standard library while enhanced PDF generation loads optional third-party code. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (46)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code is clearly related to an MBTI quiz and does support several declared aspects: local/offline operation, zero external runtime dependencies for the quiz page itself, bilingual UI/content, and the three quiz depths (70/93/144). However, the declared description promises a complete MBTI career assessment that outputs a bilingual PDF personality/career report. This code does not perform that core reporting function. It only builds the questionnaire page, records answers, displays simple A/B counts by dimension, and exports/copies answers as JSON. In fact, the UI explicitly instructs the user to give the answers to an AI assistant to generate the PDF report, which materially differs from the claim of pure local execution for the overall described capability. The footer also includes several external links unrelated to the declared assessment functionality. Therefore the description materially overstates what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description mostly matches the report-generation domain: this code clearly produces bilingual MBTI personality/career PDF reports with dimensions, traits, strengths/blind spots, career recommendations, and interpersonal matching. However, there are several material mismatches. First, the declared description emphasizes a personal MBTI assessment, while the code also supports a separate team-report mode with aggregation, team heatmaps, collaboration tips, and complementary pair analysis—an undeclared capability. Second, the description claims 'pure local zero dependency,' but this script explicitly relies on a three-tier fallback using optional third-party libraries or external browser binaries; that is not zero-dependency. Third, it launches external Chromium-family executables through subprocess, which is a meaningful undeclared behavior. Finally, generated reports contain embedded external promotional links in footer badges, which is unrelated to the stated assessment/report purpose and not disclosed. Therefore the description does not accurately and fully represent the code behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The code is clearly MBTI-related, but its primary purpose is not an individual MBTI test/report flow as declared. Instead, this script performs team-oriented batch processing: it scans a directory, loads many JSON files, scores answer files through score.py, aggregates results, and calls generate_report.py with a --team flag to produce a team report. That is a materially different use case from the declared individual career-development assessment with question banks and personalized bilingual PDF output. While the functionality is adjacent to the MBTI domain, the team aggregation/reporting capability is undeclared and represents a meaningful mismatch in primary behavior.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · docs/index.html (reported line 139)May include surrounding context.
html
</head> <body>  <nav> <div class="nav-inner"> <div class="nav-logo" style="display:flex;align-items:baseline;gap:6px;">🎓 <span>mu-mbti-job</span><span style="font-size:1.05rem;font-weight:600;color:var(--text);opacity:.85;">· MBTI人格与职业测评</span></div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · docs/index.html (reported line 177)May include surrounding context.
html
</div> </section>  <section id="scenarios"> <div class="container"> <div class="section-header center fade-up">

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file contains contributor-facing instructions primarily in Chinese, including the main guidance sections and policy acknowledgement text. Under the policy rule, forcing a specific language without offering user choice can be a natural-language locale violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented trigger for personal assessment includes very broad phrases like "MBTI" and "测一下MBTI," which are likely to appear in ordinary conversation and can cause accidental skill activation. In an agent environment, this can lead to unintended invocation, context switching, or collection/processing of sensitive personal assessment inputs when the user did not explicitly intend to launch this skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documented trigger phrases are broad enough that ordinary user requests about MBTI or personality testing could automatically invoke this skill without clear intent. In an agent ecosystem, this can cause unintended routing, disclosure of sensitive personal answers to the wrong skill context, or unexpected generation of assessment artifacts when the user only wanted general discussion.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs use of file read/write and shell execution (python3 ..., open ...) but declares no permissions or allowed-tools scope. That creates an authorization gap where a host may grant broader capabilities than necessary or reviewers cannot accurately reason about what the skill is permitted to do. In a skill that processes local files and executes scripts, missing tool scoping increases the chance of unintended file access or command execution beyond the intended workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown skill description explicitly lists activation phrases, and one of them is a generic term for personality testing rather than a narrow MBTI-specific invocation. Because the trigger list is used for skill activation, this broad phrase could cause unintended invocation for other personality or self-assessment requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Both phrases are broad category labels that can refer to many frameworks or assessment tools beyond this MBTI job-personality skill. The file includes one exclusion sentence, but it does not provide enough trigger-boundary guidance to prevent accidental activation on adjacent domains.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This JSON consistently embeds Chinese fields and Chinese-language career/growth text alongside English, but the schema itself privileges a fixed bilingual locale format without any indication that users can choose or opt into a language/locale. Under the policy, forcing a specific language or locale without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This JSON dataset includes extensive Chinese text fields alongside English text, but the file itself provides no natural-language indication that Chinese output is optional, user-selected, or justified by a documented region-specific scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The page repeatedly claims 'offline/zero upload/zero telemetry', but it still fetches external resources and points users to remote URLs. Examples include remote badge images from shields.io, fallback image loading from muippt.github.io via onerror, and outbound links to GitHub and social/media sites. This creates a trust mismatch: viewing the documentation can still contact third-party servers, leak IP/user-agent/referrer data, and undermine the privacy guarantees advertised by the skill.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document title and instructions are written in Chinese and the data contract sets "language": "zh" as the default. Under the policy rule, forcing a specific language without explicit user opt-in can be a locale-policy violation unless clearly justified; this file does not justify why Chinese must be the default.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation instructs the agent to invoke local GUI/browser actions such as opening quiz.html/PDF and to use headless Chrome during report generation. Spawning browser processes and automatically opening local files expands the skill's execution surface beyond simple MBTI scoring, and can expose users to unintended code execution paths, privacy leakage, or unsafe file handling if inputs or generated content are ever influenced.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generated page embeds external promotional links even though the skill description emphasizes offline, local-only operation. This creates undisclosed network egress and a trust-boundary mismatch: users opening the page may click links that send them to third-party sites, enabling tracking, phishing substitution, or privacy leakage inconsistent with the stated behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Injecting unrelated marketing links into a personality quiz generator is not necessary for the stated function and broadens the page's behavior beyond user expectations. In a security review, this is risky because it introduces covert promotion and possible redirection to external properties, which can be abused for traffic diversion, reputation laundering, or later content swaps on linked destinations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The quiz persists users' answers in localStorage without an explicit privacy notice or consent flow. Personality-test responses may be sensitive personal data, and storing them silently on a shared or managed browser can expose prior responses to other local users, browser forensics, or extensions with access to page storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The download feature exports a JSON file containing answers and an optional nickname without clearly informing the user that this file contains potentially sensitive personal assessment data. Saved files may persist indefinitely, be synchronized to cloud storage, or be shared with third parties, creating avoidable privacy exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The page copies answer data to the system clipboard for sharing with an AI assistant without a clear warning about data sensitivity or downstream sharing. Clipboard contents can be read or overwritten by other applications and may later be pasted into unintended destinations, increasing the chance of accidental disclosure of personality-profile data and nickname metadata.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code is explicitly designed to generate a bilingual Chinese/English report and later hard-codes Chinese and English labels, headings, and disclaimers throughout the output. Because the skill forces a specific language/locale presentation rather than offering a user-selectable language option or documenting a justified locale restriction, it violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The generated reports embed hard-coded external promotional links on every page, which expands the skill's behavior beyond local MBTI assessment/report generation and can drive users to third-party destinations without clear consent. In a privacy-sensitive personality-report context, undisclosed outbound links create trust, tracking, and scope-creep concerns even if no automatic network access occurs during generation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill executes external browser binaries to render PDFs, which materially broadens the execution surface compared with a claimed 'pure local zero-dependency' report generator. Launching Chromium-family executables on attacker-influenced HTML can expose users to browser-engine vulnerabilities, unexpected network-capable processing, or policy bypass concerns if the environment trusts this skill as simple local formatting logic.
Content: No source excerpt is available for this finding.