T08 · Insecure Dependencies
Error
- Location
SKILL.md:40- Finding
Unpinned Dependencies and Unverified Third-Party Model Downloads
- Content
View full analysis
- Remediation
View remediation
Security audit
英语笔记出题机
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its English-learning purpose, but it asks users to store credentials in a skill file and runs a local speech server with weak safety controls.
Install only if you are comfortable managing local API credentials, microphone audio, and a localhost speech server. Use throwaway or quota-limited Baidu credentials, avoid putting secrets in shared or synced folders, review any notes you import, and stop the speech server when finished.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/baidu_credentials.md:10- Finding
Plaintext API Credential Storage in the Skill Directory
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/speak_template.html:138- Finding
HTML Injection Through Unescaped Note and Transcription Content
- Content
View full analysis
Sentence 1 / 3📖 Please read: [SENTENCE_1]Sentence 2 / 3📖 Please read: [SENTENCE_2]``` Transcription output is also concatenated into `innerHTML`: ```javascript function showResult(num, text, success) { const div = document.getElementById('result-' + num); const btn = document.getElementById('btn-' + num); const status = document.getElementById('status-' + num); const card = document.getElementById('card-' + num); div.innerHTML = 'Sentence 3 / 3📖 Please read: [SENTENCE_3]' + 'Recognition result:' + (text || '(No content recognized)') + ''; ``` ### Technical Analysis The Skill does not require HTML escaping when replacing `[SENTENCE_1]`, `[SENTENCE_2]`, and `[SENTENCE_3]`. The source sentences come from a user-maintained notes file and may also originate from copied or imported content. If a sen ...[truncated 2112 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:119- Finding
Unauthenticated Local Transcription Server Permits Request Forgery and Resource Exhaustion
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README instructs users to place Baidu TTS credentials into a markdown file under the skill directory without any warning about secrets handling, file permissions, or exclusion from source control. Storing API credentials in plaintext documentation-managed files increases the risk of accidental disclosure through backups, screenshots, repo commits, or local compromise.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README says the skill activates when the user says phrases like “练英语”, “英语练习”, or even broad module names such as “默写 / 听力 / 口语 / 阅读”. These are common utterances in an English-learning context and the document does not provide negative examples or boundary conditions clarifying when the skill should or should not activate.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include very common terms such as '听力', '口语', '阅读', and '默写', which are likely to appear in ordinary conversation and can cause unintended activation. Because this skill can create files, launch a local server, and guide users into multi-step workflows, accidental invocation increases the chance of unexpected local actions and privacy-affecting behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The speaking module writes user speech content to a local file ('speech_results.json') but the skill description does not clearly disclose this storage behavior or obtain explicit user consent. Spoken responses may contain personal data or sensitive content, so silent persistence creates a privacy risk and may surprise users who think the data is processed only transiently.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all instructions and warnings exclusively in Chinese, which can amount to a language/locale policy violation when no user opt-in or alternative language is offered. The content does not indicate that the skill is region-specific or that Chinese is required for compliance or functionality.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file presents the skill output entirely in Chinese, including the title and column labels, with no indication that the user can choose another language or locale. This is a natural-language policy concern because it imposes a specific language by default rather than offering an explicit opt-in or documented locale constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The page captures microphone audio and sends it to a local backend for transcription, but the UI does not clearly disclose that recorded speech leaves the browser and is transmitted to another service. Voice data is sensitive personal data, and lack of explicit notice/consent can lead to privacy violations or unexpected exposure if the local service is misconfigured, proxied, or accessible beyond localhost.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The page submits recognized speech results together with the target sentences to a backend without an explicit disclosure or consent step. While the target text is less sensitive, the recognized speech may contain personal or incidental information, and silent submission creates a privacy and transparency issue for users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The README is entirely in Chinese and the usage examples instruct the user to invoke the skill with Chinese phrases only, with no indication that other languages are supported or that Chinese is a deliberate locale limitation. This can constitute a language/locale policy issue because the skill appears to enforce a specific language without explicit opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The embedded server template hard-codes
language="en"for transcription, which forces a specific language setting. The skill does not present this as a user-selectable option or explicitly justify the fixed locale, so it may violate language/locale choice expectations.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The markdown text requires a specific locale format by directing users to record vocabulary with Chinese definitions (e.g. '中文释义'). This imposes a language preference without indicating that other languages are allowed or optional.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document declares zh-CN as the page language and all visible UI text is Chinese, with no indication that users can opt into another language. This can violate language/locale policy when a skill mandates a specific language without user choice or clear regional justification.
- Content
Static analysis
No suspicious patterns detected.