Security audit

Briefing-pro

Security checks for vulnerabilities and agentic risk

Overview

The skill does the advertised briefing job, but unsafe slide templates could let hostile content from a webpage or file run code inside the generated briefing.

Review before installing. Use this skill only with trusted source pages and documents until the templates escape all user-derived fields, avoid innerHTML for untrusted content, and render previews/PDFs in a restricted browser environment. Be careful with private URLs or sensitive files because the workflow fetches and parses them to build the briefing.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: templates/minimal.html:45
Finding: Unescaped briefing data enables DOM-based cross-site scripting in the minimal template
Content: View full analysis
const stats = {{stats}}; document.getElementById('stats').innerHTML = stats.map(s => `
${s.num}
${s.label}
`).join(''); const points = {{points}}; document.getElementById('points').innerHTML = points.map((p, i) => `
${i+1}${p.text}
`).join(''); ``` ### Technical Analysis The Skill accepts content from arbitrary URLs, files, images, and text. Values derived from those inputs are embedded directly into JavaScript and subsequently interpolated into strings assigned to `innerHTML`. Fields such as `s.num`, `s.label`, and `p.text` are not HTML-escaped or sanitized. An attacker-controlled value containing active markup, such as an element with an event handler, will be parsed as HTML rather than displayed as text. The raw `{{stats}}` and `{{points}}` substitutions also enter a JavaScript context; if implemented as ordinary string replacement rather than safe serialization, crafted content could terminate the intended data structure and inject JavaScript directly. The template also places scalar placeholders such as `{{title}}`, `{{subtitle}}`, and `{{footer}}` into HTML contexts without evidence of contextual escaping. ### Attack Path 1. An attacker creates a webpage, document, image, or text input containing a crafted HTML or JavaScript payload. 2. A user asks the Skill to generate a briefing from that attacker-controlled content. 3. The extraction workflow places the payload into a statistic or briefing point. 4. The template engine substitutes the data into `{{stats}}` or `{{points}}`. 5. The page assigns the constructed str ...[truncated 858 chars]
Remediation: View remediation
`, `&`, U+2028, and U+2029 when embedding serialized data in an inline script. 4. Apply context-specific HTML escaping to `title`, `subtitle`, and `footer`. 5. If rich text is required, sanitize it with a strict allowlist that excludes scripts, event attributes, dangerous URLs, and active embedded content. 6. Add a restrictive Content Security Policy and disable unnecessary network and local-file access in the rendering browser. 7. Add regression tests using payloads such as `` and ``. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: templates/professional.html:62
Finding: Unescaped briefing and agent data enables DOM-based cross-site scripting in the professional template
Content: View full analysis
const stats = {{stats}}; document.getElementById('stats').innerHTML = stats.map(s => `
${s.num}
${s.label}
`).join(''); const points = {{points}}; document.getElementById('points').innerHTML = points.map(p => `
${p.icon}${p.text}
`).join(''); const agents = {{agents}}; if (agents.length > 0) { const agentsDiv = document.getElementById('agents'); agentsDiv.style.display = 'block'; agentsDiv.innerHTML = `
团队成员
${agents.map(a => `${a.emoji}${a.name}`).join('')}
`; } ``` ### Technical Analysis The template inserts untrusted statistics, points, icons, agent names, and emoji values into markup assigned to `innerHTML`. No encoding or sanitization is performed before the browser parses these strings. Consequently, malicious HTML elements and event-handler attributes can become executable DOM content. The raw substitutions for `{{stats}}`, `{{points}}`, and `{{agents}}` also occur inside JavaScript. Without a safe serializer, specially crafted values could escape the intended JavaScript structure. Other scalar placeholders in the template, including `{{tag}}`, `{{title}}`, `{{subtitle}}`, `{{footer}}`, and `{{badge}}`, are likewise inserted into HTML without demonstrated contextual escaping. ### Attack Path 1. An attacker places a payload in source content that will be extracted as a point, statistic, icon, agent name, or related field. 2. A user generates a professional-style briefing from the conte ...[truncated 879 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: templates/tech.html:58
Finding: Unescaped briefing data enables DOM-based cross-site scripting in the tech template
Content: View full analysis
const stats = {{stats}}; document.getElementById('stats').innerHTML = stats.map(s => `
${s.num}
${s.label}
`).join(''); const points = {{points}}; document.getElementById('points').innerHTML = points.map(p => `
>${p.text}
`).join(''); ``` ### Technical Analysis Statistics and point text derived from potentially attacker-controlled source material are concatenated into HTML and assigned to `innerHTML`. The browser therefore interprets injected markup rather than rendering it as plain text. Additionally, `{{stats}}` and `{{points}}` are raw placeholders in a JavaScript context. Unless the unspecified rendering stage uses secure JSON serialization and inline-script escaping, malicious input could break out of the intended JavaScript value. The HTML placeholders for the title, tag, subtitle, and footer also lack visible contextual escaping. ### Attack Path 1. An attacker supplies source material containing malicious markup in a value likely to be extracted as a point or statistic. 2. The user selects the tech template and generates a briefing. 3. The attacker-controlled value is substituted into `stats` or `points`. 4. The value is interpolated into the generated markup. 5. Assignment to `innerHTML` parses the payload as active HTML. 6. The payload executes when the browser opens the generated briefing for display, screenshot capture, or PDF printing. ### Impact Assessment Exploitation permits script execution in the generated page, enabling content manipulation, report spoofing, browser-originated requests, and access to ...[truncated 307 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: templates/vibrant.html:67
Finding: Unescaped briefing and agent data enables DOM-based cross-site scripting in the vibrant template
Content: View full analysis
const stats = {{stats}}; document.getElementById('stats').innerHTML = stats.map(s => `
${s.num}
${s.label}
`).join(''); const points = {{points}}; document.getElementById('points').innerHTML = points.map(p => `
${p.icon}${p.text}
`).join(''); const agents = {{agents}}; if (agents.length > 0) { const agentsDiv = document.getElementById('agents'); agentsDiv.style.display = 'block'; agentsDiv.innerHTML = `
团队成员
${agents.map(a => `${a.emoji}${a.name}`).join('')}
`; } ``` ### Technical Analysis This template directly interpolates statistics, point icons, point text, agent emoji, and agent names into HTML strings assigned to `innerHTML`. Since no sanitization or output encoding is present, an attacker can cause supplied markup to be interpreted as DOM content. The data placeholders are also embedded directly in inline JavaScript. If the rendering pipeline performs plain textual substitution, crafted content can escape the intended arrays or objects and inject script syntax. Scalar values such as `{{tag}}`, `{{title}}`, `{{subtitle}}`, `{{footer}}`, and `{{badge}}` are inserted into HTML without visible contextual escaping. ### Attack Path 1. An attacker prepares input content containing an HTML or JavaScript payload in an extractable field. 2. A user asks the Skill to generate a vibrant-style briefing from that content. 3. The extraction and templating process carries the payload into a stati ...[truncated 831 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger conditions include very broad everyday terms such as “摘要”, which can cause the skill to activate in contexts far beyond a user's clear intent to generate a briefing. Overbroad activation increases the chance that unrelated user content, uploaded files, or URLs are processed unexpectedly, which can lead to unintended data handling and external fetches.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly supports fetching external URLs and processing uploaded documents, but it does not warn users that their content will be retrieved, parsed, and transformed. This reduces informed consent and makes accidental exposure of sensitive internal URLs, private documents, or embedded data more likely, especially because the workflow normalizes automatic extraction from multiple file types.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The HTML root element is hard-coded to lang="zh-CN", which imposes a specific language/locale on all rendered output. The file also contains fixed Chinese UI text, and there is no indication that users can opt into another locale or that the template is limited to a justified region-specific use case.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template sets lang="zh-CN" and uses Chinese labels such as "核心亮点" and "团队成员", which forces a specific language/locale in the generated output. The policy allows this only when the skill offers language choice or clearly documents a justified region-specific constraint, neither of which appears in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The HTML root sets lang="zh-CN", which hard-codes a specific language/locale. Under the policy, forcing a locale without user opt-in or a clearly documented region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML document declares lang="zh-CN", and the visible UI text is also hard-coded in Chinese, which indicates the template is fixed to a specific language/locale. Under the policy, forcing a locale without user opt-in or a documented region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The natural-language instructions, prompts, and questions are written only in Chinese, including fixed user-facing prompt text such as style and output questions. There is no indication that the skill can adapt to the user's preferred language or request consent for Chinese-only interaction.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.