Security audit

Interactive Infographic

Security checks for vulnerabilities and agentic risk

Overview

This is a functional remote infographic client, but it needs Review because it uploads local file contents to a third-party service and has concrete path-safety and credential-management issues.

Review before installing. Use this skill only with content you are willing to send to the ContextWeave backend, avoid passing sensitive or symlinked files as input, and set your own CONTEXTWEAVE_MCP_API_KEY rather than relying on the embedded anonymous credential. The package does not show persistence or destructive behavior, but the path-boundary bug and hardcoded credential should be fixed before broad use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/cw_client.cjs:66
Finding: Workspace Path Restriction Can Be Bypassed Through Symbolic Links
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cw_client.cjs:17
Finding: Reusable API Credential Is Hardcoded in Distributed Source Code
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.
md
- `scripts/cw_client.cjs`：用于统一后端请求与响应适配；承载鉴权、错误归一和返回结构解析

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown skill forces a specific language/locale in its natural-language description and operating instructions. The file does not indicate that users may choose another language or that the Chinese-only constraint is optional or justified by a region-specific requirement.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The client loads an API key from the environment but silently falls back to a hardcoded key embedded in source. Hardcoded credentials are a real secret-management flaw because anyone with code access can reuse the key against the remote service, and users may unknowingly operate under the author's shared credential rather than their own account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The client loads an API key from CONTEXTWEAVE_MCP_API_KEY and automatically attaches it as the X-API-Key header on every request. Although this is functionally expected for authentication, the file provides no user-facing warning, logging, or documentation in-code that credentials from the environment will be used and transmitted to the external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: When an input file is supplied, the client reads its full contents and sends them to a remote endpoint as user_request and initial_cw_code. Even with path restrictions, this can expose proprietary or sensitive local data to a third-party service without any explicit warning or consent flow in this code path.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: Beyond generating infographics from text, the code implements session asset export plus remote code import/export workflows that read local files and write diagram code to disk. Those artifact-management operations are broader than the manifest's stated one-click visualization purpose and are not presented as part of the skill description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The error message and recovery hint are hard-coded in Chinese, and a required-argument error later in the file is also presented only in Chinese. This imposes a specific language on users without opt-in or documented locale justification, which matches the natural-language policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The CLI returns required-argument guidance only in Chinese, with no indication that the tool is region-specific or that users can choose their language. For a general-purpose script, this is a language policy violation under the stated rules.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script emits all user-facing error messages and recovery hints in Chinese only, such as "必须提供 session_id 和 format" and "format 仅支持 svg 或 pptx". This imposes a specific language on all users without opt-in or a documented locale constraint, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code emits user-facing error text in Chinese, and similar Chinese-only messages also appear elsewhere in the file. For a general-purpose CLI skill, forcing a specific language without user opt-in is a natural-language policy violation under the locale/language rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code emits user-facing error text only in Chinese in the message and recovery_hint fields. For a general CLI script with no documented locale selection or opt-in, forcing a specific language can violate organizational language/locale policy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The exportCode method creates a directory and writes diagram.cw to disk, modifying the user's filesystem. The code has error handling, but it does not include a confirmation prompt, user-visible log, or explanatory comment/docstring disclosing that a local file will be created or overwritten.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The user-facing error message and recovery hint are hard-coded in Chinese ("必须提供 session_id", "补充参数后重试"). This imposes a specific language choice on all users without offering a locale option or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.