MBTI人格与职业测评

• Outcome: Pass
• Latest audit: Aug 27, 2026 · 9:54 AM UTC
• Version: 1.1.1

Overview

This is a coherent local MBTI assessment and PDF-report skill, with privacy and dependency caveats but no artifact-backed malicious behavior.

Install only if you are comfortable running local Python scripts that process personality-test answers and produce local JSON/PDF files. For team use, get consent from members, avoid using reports for hiring or performance decisions, and be aware that docs pages may contact remote sites while the core scoring workflow is local.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

with os.fdopen(fd, "w") as f:
            json.dump(doc, f)
        out_path = tempfile.mktemp(suffix=".json")
        subprocess.run(
            [sys.executable, os.path.join(os.path.dirname(__file__), "score.py"), path, "-o", out_path],
            check=True,
            capture_output=True,

• Confidence: 87% confidence
• Finding: This subprocess call itself is not shell-injection prone because it uses an argument list and no shell, but it writes the scored output to a path created with tempfile.mktemp(), which is insecure due to a race condition. An attacker on the same system could pre-create or replace that path with a symlink before score.py writes to it, potentially causing unintended file overwrite or disclosure depending on the privileges of the process.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs the agent to read local files, write temporary JSON files, and execute shell commands, but no explicit permissions are declared. That creates a trust and containment gap: a host may expose more capability than users expect, and the skill can process sensitive local data or invoke local programs without clear authorization boundaries. In this context the risk is moderated because the described operations are related to the assessment workflow, but shell and file access still materially expand the attack surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill's declared description understates its actual behavior: it supports team-level aggregation, may depend on external rendering engines, and reportedly includes outbound hyperlinks in generated artifacts. Description-behavior mismatch is dangerous because users and platform policy may grant trust based on the declared purpose, while the actual behavior broadens data handling and introduces external touchpoints, especially problematic for a skill processing personality and team assessment data. The hidden team-analysis capability increases sensitivity because it aggregates multiple individuals' results, raising privacy and misuse concerns.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The page repeatedly claims 'offline', 'zero telemetry', and 'zero upload', but it still references external resources and fallbacks to third-party domains. If those paths are triggered, a user's browser will make outbound requests that disclose metadata such as IP address, user agent, referrer, and access timing, which contradicts the privacy claim and can mislead users handling sensitive assessment data.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The script automatically discovers and launches external Chromium-family executables, including ones resolved from PATH. In adversarial or multi-user environments, a trojaned browser binary or PATH hijack could cause arbitrary local code execution when report generation falls back to the headless browser tier.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrase "MBTI" is so broad that it can activate on ordinary conversation about personality tests rather than an explicit user request to run this skill. In an agent setting, overly generic triggers can cause unintended skill invocation, leading to surprise collection/processing of user responses and misrouting away from more appropriate tools.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The team-analysis trigger phrase (e.g. "team MBTI" / "团队分析") is ambiguous and could match casual discussion about teams rather than consent to aggregate member personality data. In a multi-user or workplace context, accidental activation is more sensitive because it may prompt handling of multiple individuals' assessment results and produce group-level inferences.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The documented trigger phrases are broad everyday terms such as “MBTI” and “团队分析”, which can easily appear in ordinary conversation and cause unintended skill activation. In an agent setting, this can lead to surprise execution, unnecessary collection or processing of user inputs, and accidental invocation of workflows the user did not explicitly request.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger list includes broad phrases such as MBTI, personality test, and career assessment terms that can appear in ordinary conversation, making unintended activation plausible. Accidental invocation can cause the agent to start collecting answers, reading files, or steering users into a structured workflow they did not explicitly request; in a team-analysis context it could also prompt submission of sensitive personality data without sufficiently deliberate consent.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The main trigger section repeats ambiguous everyday phrases without stronger contextual constraints, reinforcing the chance of false activation. Repetition across metadata and instructions can make hosts more likely to route unrelated prompts into this skill, which is risky because the skill then requests structured user input and may eventually process local files or generate reports containing sensitive personal information.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The report preview images use onerror handlers to load from https://muippt.github.io when local assets are unavailable. This creates unexpected network requests on a page marketed as offline and zero-upload, undermining user trust and leaking browsing metadata to a remote host without an explicit warning.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The page stores quiz progress in localStorage and provides one-click copy/download of answers, including an optional nickname, without an explicit privacy notice or retention disclosure at the point of collection/export. In shared-device or enterprise-browser contexts, users may not realize their personal assessment data persists locally or is easy to transfer onward, increasing privacy leakage risk.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The page automatically persists quiz progress and answers in localStorage via saveProgress() without presenting a clear up-front notice or consent flow. While this is client-side only and offline, stored personality-test answers and optional nickname are still personal data that could be exposed to other users of the same browser profile, shared devices, or local inspection.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The page stores quiz progress, including sensitive personality-test answers, in localStorage automatically and advertises persistence only in footer text rather than through an explicit just-in-time notice or consent flow. In this context, MBTI responses and the optional nickname can reveal personal traits and become accessible to other users of the same browser profile, extensions, or scripts running in the same origin.

Unvalidated Output Injection

High

• Category: Output Handling

Content

"--print-to-pdf=%s" % out_path,
                   "file://%s" % html_path]
            try:
                proc = subprocess.run(cmd, capture_output=True, timeout=120)
                if proc.returncode == 0 and os.path.isfile(out_path) \
                        and os.path.getsize(out_path) > 0:
                    return True, exe

• Confidence: 68% confidence
• Finding: The output path is user-controlled and passed directly to Chromium's --print-to-pdf argument without restriction. While this is not shell injection, it can still enable unintended file overwrite or writing PDFs to sensitive locations the current user can access, which is more concerning because the script is a local file-generation tool likely run on a user's workstation.

Known Vulnerable Dependency: weasyprint==61.0 — 6 advisory(ies): CVE-2024-28184 (WeasyPrint allows the attachment of arbitrary files and URLs to a PDF); CVE-2025-68616 (WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP R); CVE-2026-49452 (WeasyPrint has CSS Injection via Presentational Hints) +3 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The dependency specification allows installation of WeasyPrint 61.0, which is identified as having multiple published advisories, including arbitrary file/URL attachment to PDFs and SSRF-related issues. In this skill, WeasyPrint is used for PDF generation from potentially user-influenced content, which increases the risk that crafted HTML/CSS or asset references could trigger vulnerable behavior during report rendering.

Static analysis

No suspicious patterns detected.