Security audit

Webflow 中国加速

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for Webflow acceleration, but its Worker template grants overly broad public proxying and caching behavior that could expose private pages or be abused.

Review carefully before installing. Only use this template after adding an exact allowlist for Webflow asset hosts, disabling public caching for requests with cookies or authorization headers, honoring private/no-store origin headers, limiting R2 writes by size and content type, and removing the badge-hiding behavior unless the site owner has explicitly accepted that change.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: references/worker-template.js:38
Finding: Attacker-Controlled Upstream Host Creates an Open Proxy and SSRF Primitive
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/worker-template.js:157
Finding: Personalized Requests Are Forwarded into Shared Public Caching
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.
md
完整的可直接部署的 Worker 代码见 `references/worker-template.js`。

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill description is written to require this specialized skill whenever the user wants to optimize Webflow access speed in mainland China, and the file consistently presents responses/content only in Chinese. There is no indication that the user may choose another language or locale, which can violate language-choice policy when applied broadly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code file contains prominent natural-language documentation and usage examples exclusively in Chinese, including the top-level description and inline explanatory comments. Under the stated policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The worker deliberately removes and visually hides the Webflow badge, which is unrelated to China-mainland performance optimization and changes site branding/compliance behavior. Even if not directly exploitable for code execution, this is a risky overreach because it can violate platform terms, misrepresent authorship, and create trust/compliance issues outside the stated purpose of the skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: Serving robots.txt and sitemap.xml from an R2 public endpoint is a content-hosting and SEO-related behavior rather than a direct implementation of Webflow China speed optimization. While adjacent to deployment architecture, this capability is not clearly justified by the manifest's focus on mainland access acceleration and resource proxying.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.