Nexl Brand Site Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:21 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent website generator, but it needs review because it stores sensitive brand profiles, pushes public deployment, and constrains generated sites with third-party branding/resources.

Review before installing. Use this skill only if you are comfortable with NEXL-branded output, possible external font requests, persistent plaintext brand-profile files, and a workflow aimed at public deployment. Before publishing, require explicit final approval, inspect the generated HTML for third-party links/resources, validate or escape all brand fields, and avoid putting unreleased products, pricing strategy, credentials, or private contact data into the profile.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:50

Finding

Forced Agent Persona and Promotional Output Injection

Content

View full analysis

{BRAND_COPYRIGHT} Powered by nexl · Independent website digital asset ``` The visible text above is translated into English; the URL and HTML structure are unchanged. ### Technical Analysis The Skill does more than provide website-generation procedures. It overrides the agent's normal opening behavior, mandates a specific commercial persona, instructs the agent to conceal that it is an AI or agent, and requires a fixed promotional script before user requirements are collected. It then requires the bundled template to remain immutable while that template contains an outbound NEXL attribution link. The attribution is not required to implement the declared website-generation functionality. Because the template is later deployed publicly, the instruct ...[truncated 1451 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/base.min.html:7

Finding

Undisclosed Third-Party Requests from Generated Websites

Content

View full analysis

``` The Skill separately claims in `SKILL.md:38` and `SKILL.md:236` that it needs no network fetches or external dependencies. ### Technical Analysis The bundled template initiates connections to Google Fonts. The two `preconnect` elements allow the browser to establish connections to Google infrastructure, while the stylesheet request retrieves font-related CSS and normally causes additional font-resource requests. When a generated site is deployed, these requests occur in each visitor's browser rather than only during development. They can disclose visitor network and HTTP metadata, including IP address, user-agent information, request timing, and potentially referrer information according to browser policy. These requests are not necessary for the core functionality. The Skill can use system fonts or bundle appropriately licensed font files. The behavior also conflicts with the package's explicit self-contained and no-network-fetch claims. ### Attack Path 1. The Skill generates a website from `references/base.min.html`. 2. The external Google Fonts tags remain in the generated output. 3. The generated website is deployed to a public domain. 4. A visitor opens the website. 5. The visitor's browser automatically connects to `fonts.googleapis.com` and `fonts.gstatic.com`. 6. Google receives the visitor's network and request metadata. ### Impact Assessment The issue does not expose local agent credentials or provide code-execution privileges. Its scope is the privacy of visitors to every g ...[truncated 315 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/base.min.html:84

Finding

Unescaped Brand-Profile Values Can Inject Markup into Public Sites

Content

View full analysis

{BRAND_NAME}

{BRAND_KICKER}

{BRAND_TAGLINE}

01 {PROJECT_1_KIND} {PROJECT_1_TITLE} {PROJECT_1_DESC}

{ABOUT_P1}

{BRAND_EMAIL}

``` The prescribed generation process in `SKILL.md:89-102` requires direct placeholder replacement and checks only that no placeholder tokens remain. It does not prescribe contextual escaping or strict input validation. ### Technical Analysis Brand-profile fields are user-controlled or may originate from imported profile text. The same replacement mechanism places those values into several different parser contexts: - HTML text nodes, such as brand names and project descriptions. - An HTML attribute, such as the `mailto:` destination. - CSS syntax, through the accent-color variable. Literal replacement without contextual encoding allows an input to terminate its intended context and introduce new markup or style syntax. For example, a value containing closing tags and an event-bearing element could become executable HTML when the generated file is opened. A malformed email value could break out of the `href` attribute if quotes are not encoded. A malformed color value could inject additional CSS declarations or terminate the style block. The `grep`-based token-completion check does not provide security va ...[truncated 1425 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:70

Finding

Commercially Sensitive Brand Profiles Are Duplicated into Predictable Plaintext Storage

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill mandates publishing generated sites to a public URL as a required completion step, without an upfront privacy, legal, or integrity review gate. Auto-deploying to a public endpoint can unintentionally expose unpublished branding, personal/company contact details, internal drafts, or unsafe generated content to the internet, and materially raises risk because publication is irreversible once indexed or shared.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

L036 states the package works with no external files or network fetch, and L236 reiterates '无外部文件 fetch、无跨网依赖'. However, the same document later instructs the agent to use public inspiration sites such as Awwwards and Webflow (L130-L140) and to deploy to CloudStudio/Cloudflare/Vercel/GitHub Pages to obtain a public URL (L218-L223). This is an active contradiction between the skill's self-description and its prescribed behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction says that for global users, the agent 'must' output Chinese first and then English, which forces a specific language order regardless of user preference. This is a natural-language locale policy issue because the skill does not offer a language choice or opt-in mechanism.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to persist a brand profile to user and home-directory files automatically, without requiring explicit prior consent. Writing persistent files can store sensitive business information, contact data, positioning, and project details in locations the user did not approve, creating privacy and integrity risks across sessions or for other local users/processes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document declares lang="zh-CN", and the visible UI text is predominantly Chinese, which imposes a specific language/locale on users. There is no indication in the file that this is optional, user-selected, or justified as a region-specific skill, so it matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill instruction set is written as Chinese-only operational guidance, including required output phrasing such as the mandated archive presentation format. There is no indication that the user may choose another language or that the Chinese-only constraint is required for a region-specific compliance purpose, which makes this a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/broker-gate.md (reported line 3)May include surrounding context.

md

# nexl-broker · 品牌经纪人（包内内联版）

> 本文件为 nexl-builder 的**内置品牌守门模块**。原 `skills/nexl-broker/SKILL.md` 已内联至此，使技能包完全自包含，不依赖任何外部文件。

你是用户品牌的**唯一守门人 + 操盘军师**。nexl 双核：**nexl-builder（建站）负责生产，nexl-broker（你）负责让所有产出像同一个品牌说的、像一个灵魂在运转**。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Lines L54-L55 contain natural-language policy instructions that force a region-specific model constraint: '不得引导接 OpenAI 等境外模型'. This is a language/locale-style organizational restriction applied as a blanket rule, and the file does not present it as a user opt-in choice or clearly scope it to a specific compliance-only context for all usage.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

L206 instructs the agent to begin by understanding the user's background '先问我', while L051-L053 impose a hard rule that the first output after activation must be the NEXL self-introduction and must not ask what the user wants first. These instructions conflict about the intended first interaction behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description is written primarily in Chinese and presents the skill in that locale without any indication that users can choose another language. Under the policy criteria, a forced language or locale without explicit opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.