html-report

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:47 AM UTC
• Version: 1.0.0

Overview

This Chinese-language skill appears to generate HTML report pages as advertised, with disclosed but noteworthy web search and remote font behavior.

Install only if you are comfortable with a Chinese-first report generator that may use web search for unfamiliar diagram types and may generate HTML that loads Google Fonts. Avoid using it with confidential material unless you control or disable those network-dependent parts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (21)

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The skill is configured to trigger immediately on broad phrases like '生成报告', '做成HTML', and '内容可视化', and says to use it without confirmation. Overbroad auto-invocation can hijack unrelated user intents, cause unintended processing of arbitrary input, and, combined with the WebSearch fallback, may lead to unexpected external actions without informed consent.

Hidden Instructions

High

• Category: Prompt Injection

Content

<path d="M0,0 L0,6 L6,3 z" fill="#64748b"/>
    </marker>
  </defs>
  <!-- 层1：表现层 -->
  <rect x="0" y="0" width="940" height="52" rx="4" fill="rgba(59,130,246,0.1)" stroke="rgba(59,130,246,0.3)" stroke-width="1"/>
  <text x="10" y="14" font-size="9" font-weight="700" fill="#3b82f6" text-transform="uppercase" letter-spacing="1">PRESENTATION</text>
  <rect x="120" y="8" width="140" height="34" rx="4" fill="rgba(59,130,246,0.2)" stroke="rgba(59,130,246,0.4)" stroke-width="1"/>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<path d="M0,0 L0,6 L6,3 z" fill="#64748b"/>
    </marker>
  </defs>
  <!-- 层1:表现层 -->
  <rect x="0" y="0" width="940" height="52" rx="4" fill="rgba(59,130,246,0.1)" stroke="rgba(59,130,246,0.3)" stroke-width="1"/>
  <text x="10" y="14" font-size="9" font-weight="700" fill="#3b82f6" text-transform="uppercase" letter-spacing="1">PRESENTATION</text>
  <rect x="120" y="8" width="140" height="34" rx="4" fill="rgba(59,130,246,0.2)" stroke="rgba(59,130,246,0.4)" stroke-width="1"/>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<line x1="510" y1="42" x2="510" y2="66" stroke="#64748b" stroke-width="1.5" marker-end="url(#la-arr)"/>
  <line x1="190" y1="100" x2="190" y2="124" stroke="#64748b" stroke-width="1.5" marker-end="url(#la-arr)"/>
  <line x1="350" y1="100" x2="350" y2="124" stroke="#64748b" stroke-width="1.5" marker-end="url(#la-arr)"/>
  <!-- 图例 -->
  <rect x="750" y="10" width="10" height="10" rx="2" fill="rgba(59,130,246,0.4)"/>
  <text x="764" y="19" font-size="8.5" fill="#64748b">表现层</text>
  <rect x="750" y="28" width="10" height="10" rx="2" fill="rgba(139,92,246,0.4)"/>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The natural-language description is written to require output in Chinese (for example, the content-length requirements are specified in Chinese text) without offering the user a language choice or noting that the skill is region-specific. This can violate language/locale policy because it imposes a locale preference by default rather than allowing user opt-in.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs the agent to perform WebSearch when requested diagram types are not covered by the local library, which expands a presentation-generation skill into external network access. That creates data-exposure and prompt-injection risk because arbitrary user content or derived queries may be sent to external sources during a task that otherwise should remain local.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This second WebSearch instruction reinforces that unsupported chart requests should trigger outbound querying, making the network behavior a built-in part of the skill rather than an edge case. In context, that is more dangerous because the skill is configured for automatic activation, so a simple visualization request could unexpectedly cause external data transmission.

Natural-Language Policy Violations

Medium

• Confidence: 76% confidence
• Finding: The title and all instructions in this skill reference are written exclusively in Chinese, and the wording uses absolute requirements such as '所有页面统一使用' and '禁止使用其他值' without indicating any language choice or opt-in. Under the policy rule for natural-language violations, forcing a specific language or locale without user choice can be a violation unless clearly justified as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The title and the surrounding instructions consistently prescribe Chinese-language content, and the file does not provide any option for the user to choose another language or locale. This is a natural-language policy issue because it forces a specific language behavior rather than making language selection explicit or user-driven.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The design spec explicitly instructs the generated HTML to load Google Fonts from a remote third party. For a report generator, this introduces unnecessary outbound network access, which can leak viewer IP/user-agent and creates a supply-chain/dependency risk that is outside the core local rendering purpose.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The template guidance includes external <link> tags to Google Fonts, causing generated reports to contact a third-party service when opened. In environments expecting self-contained HTML output, this can violate privacy expectations, break offline use, and expand the attack surface through external dependency fetching.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The entire skill file is written as mandatory Chinese-language instructions, including imperative requirements to generate page layouts, but it provides no indication that language choice is optional or limited to a region-specific use case. This can violate organizational language/locale policy because it effectively constrains agent behavior to a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This markdown file contains user-facing instructions exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only context. Under the language/locale policy rule, forcing a specific language without opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The title and all instructions are written as prescriptive Chinese-only content rules, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only regional context. This creates a natural-language locale policy concern because the file appears to enforce a specific language by default rather than through user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file contains operational instructions exclusively in Chinese, and nowhere indicates that users may choose another language or that the skill is intended only for a Chinese-language audience. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This markdown file is written entirely in Chinese and includes fixed Chinese UI/content text such as page labels and ending-page copy, but it does not indicate that language selection is optional or that the skill is intended only for a Chinese-language context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire skill document is written in Chinese and does not offer any language choice, fallback, or note that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale violation.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file hard-codes Chinese-first numeric and spacing conventions as normative output rules without indicating they apply only to Chinese-language reports or only when the user requests that locale. In a skill that auto-generates reports without confirmation, this can silently override user intent, mislocalize outputs, and produce misleading formatting in English or mixed-language contexts.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The file explicitly instructs the agent to perform network web searches when a requested diagram type is not found locally. That materially expands the skill from offline HTML/SVG report generation into external data retrieval, which increases prompt-injection, data exfiltration, and scope-creep risk. In the context of an auto-triggering report generator, this is more dangerous because users may invoke it without an explicit consent step for network access.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: These lines direct use of WebSearch despite the skill's stated purpose being HTML page generation and visualization. Unjustified external search introduces unnecessary exposure to untrusted content and can cause the agent to ingest attacker-controlled instructions from the web, especially when the skill is designed to act immediately without confirmation.

Context-Inappropriate Capability

Low

• Confidence: 86% confidence
• Finding: The documentation instructs generated HTML to load Google Fonts from external domains, which introduces an unnecessary network dependency for a local report generator. This can leak user IP/addressing metadata, break in offline or restricted environments, and create a supply-chain/privacy concern that is not required for the core function of rendering reports.

Static analysis

No suspicious patterns detected.