Security audit

AppDev Skill - 通用应用软件开发工作流

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real HarmonyOS development workflow skill, but several user-run commands can persist Git hooks, start an exposed mock server, install mutable npm packages, or overwrite project files without enough safeguards.

Install only if you are comfortable reviewing and running these scripts manually. Avoid running hooks install in repositories with existing hooks, bind or firewall the mock server before use, do not place real personal or production data in mock data files, pin npm dependencies before mock-server init/start, and use simple trusted identifiers for generated file names. Also note that lint.sh and visualize.sh failed shell syntax checks during inspection, so some advertised tooling may not work as documented.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (8)

T08 · Insecure Dependencies

Error

Location: scripts/mock-server.sh:66
Finding: Unpinned npm Dependencies Allow Mutable Third-Party Code Execution
Content: View full analysis
"$MOCK_DIR/package.json" << 'EOF' { "name": "appdev-mock-server", "version": "1.0.0", "dependencies": { "express": "^4.18.2", "cors": "^2.8.5", "body-parser": "^1.20.2" }, "devDependencies": { "nodemon": "^3.0.1" } } EOF cd "$MOCK_DIR" npm install cd .. ``` ### Technical Analysis The script dynamically creates a dependency manifest containing semver ranges and then invokes `npm install`. No reviewed lockfile or integrity-pinned installation is supplied with the project. The versions actually installed therefore depend on registry state at execution time. npm also permits package lifecycle scripts to execute during installation. A compromised direct or transitive dependency could run arbitrary commands with the privileges of the user invoking the script. Although this is not an explicit malicious payload embedded in the project, it creates a mutable code-execution path through third-party package infrastructure. ### Attack Path 1. An attacker compromises an allowed direct or transitive npm package version, or the corresponding registry account. 2. The malicious version remains compatible with one of the declared semver ranges. 3. A user runs: ```bash bash scripts/mock-server.sh init ``` or starts the server before the `mock` directory exists. 4. The script invokes `npm install`. 5. npm resolves the compromised package and executes any associated lifecycle scripts. 6. The dependency code runs with the developer account's filesystem and process privileges. ### Impact Assessment Successful exploitation could provide arbitrary code execution as the invoking user. This could expose source code, environment variables, development credentials, SSH material readable by that user, and writable project or ...[truncated 113 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/mock-server.sh:91
Finding: Mock Server Listens on External Interfaces with Permissive CORS and Unauthenticated Endpoints
Content: View full analysis
{ console.log(` Mock Server started at http://localhost:${PORT} `); }); ``` The generated routes include unauthenticated data-changing operations: ```javascript app.post('/api/users', (req, res) => { const data = loadData(); const newUser = { id: Date.now().toString(), ...req.body, createdAt: new Date().toISOString() }; data.push(newUser); saveData(data); res.status(201).json({ code: 0, data: newUser }); }); app.delete('/api/users/:id', (req, res) => { // ... }); ``` The server is launched as a detached process: ```bash MOCK_PORT=$PORT MOCK_DELAY=${DELAY:-0} \ nohup node server.js > ../mock-server.log 2>&1 & ``` ### Technical Analysis Calling `app.listen(PORT)` without a host does not restrict the listener to the loopback interface. Depending on the runtime and operating system, Express/Node.js can accept connections through wildcard IPv4 or IPv6 interfaces. The generated application also enables unrestricted CORS through `cors()` and exposes unauthenticated CRUD and mock authentication endpoints. The displayed `localhost` URL does not enforce local-only network access. The server accepts arbitrary JSON request bodies and persists user records to `mock/data/users.json`. Consequently, any host that can reach the listening port may be able to read or alter the mock data. ### Attack Path 1. A developer starts the mock server on a workstation connected to a shared or untrusted network. 2. Node.js binds the server to wildcard network interfaces. 3. A remote network peer sca ...[truncated 876 chars]
Remediation: View remediation
{ // ... }); ``` - Require an explicit, prominently documented option before allowing external binding. - Replace unrestricted `cors()` with an allowlist, or disable CORS unless it is needed. - Add a random per-run bearer token or another lightweight access-control mechanism. - Validate request schemas and reject unknown fields. - Set body-size limits: ```javascript app.use(express.json({ limit: '100kb' })); ``` - Warn users that the server is for synthetic data only and must not contain production credentials or personal information. - Display and verify the actual bound address rather than merely printing a localhost URL. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/mock-server.sh:421
Finding: Untrusted PID File Can Cause Termination of an Unrelated Process
Content: View full analysis
/dev/null; then kill "$pid" rm -f "$PID_FILE" success "Mock Server 已停止" else warn "服务未在运行" rm -f "$PID_FILE" fi else warn "未找到 PID 文件" fi ``` ### Technical Analysis The stop operation trusts the content of `.mock-server.pid` without: - Ensuring that it contains only a valid positive integer. - Verifying ownership and permissions of the PID file. - Confirming that the process is the mock server started by this project. - Detecting PID reuse after a previously launched server has exited. A stale PID may refer to a new, unrelated process. A modified PID file can deliberately point to another process owned by the developer. `kill -0` verifies only that the process exists and can be signaled; it does not verify its identity. ### Attack Path 1. An attacker with write access to the project directory changes `.mock-server.pid` to the PID of another process owned by the victim. 2. Alternatively, the mock server exits and the operating system later reuses its PID. 3. The user runs: ```bash bash scripts/mock-server.sh stop ``` or: ```bash bash scripts/mock-server.sh restart ``` 4. `kill -0` succeeds for the unrelated process. 5. The script sends `SIGTERM` to that process. ### Impact Assessment The script can terminate another process that the invoking user is permitted to signal. It does not directly escalate privileges, but it can interrupt development tools, user applications, local services, builds, or other workloads. The scope is limited by the invoking account's signal permissions. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate.sh:67
Finding: Generator Names Permit Path Traversal and Generated-Source Injection
Content: View full analysis
"$output_file" << EOF // models/${name}.ts // ${name}数据模型 export interface ${name} { id: string; createdAt: number; updatedAt?: number; } export interface ${name}Request { id: string; } EOF } ``` The same pattern is used for services, pages, view models, and tests: ```bash local output_file="src/services/${name}.ts" local output_file="src/pages/${name}Page.ets" local output_file="src/viewmodels/${vmName}.ts" local output_file="test/unittest/${name}.test.ts" ``` ### Technical Analysis The `name` parameter is not constrained to a valid TypeScript/ArkTS identifier. It may contain path separators, `..` segments, quotes, line breaks, or source-language syntax. Because the value is embedded in output paths, traversal sequences can select writable files outside the intended generation directory when the resulting parent path exists. Because the value is also inserted verbatim into unquoted heredoc-generated source, it can break out of identifiers or string literals and introduce attacker-controlled TypeScript/ArkTS content. The heredoc itself does not recursively execute shell syntax supplied through the variable, but the generated payload may execute later when the application, test suite, or build t ...[truncated 1085 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/init-project.sh:35
Finding: Project Initializer Silently Overwrites Existing Project Files
Content: View full analysis
PROJECT.md << EOF # $APP_NAME 项目配置 # ... EOF cat > version.json << EOF { "name": "$APP_NAME", "version": "1.0.0" } EOF cat > .gitignore << 'EOF' # ... EOF cat > README.md << EOF # $APP_NAME # ... EOF ``` ### Technical Analysis The script accepts any project directory, creates it if necessary, and then writes core files using truncating redirection. It does not verify that the directory is new or empty, prompt before replacing existing files, create backups, or require a force option. The application name is also inserted directly into JSON and Markdown. Quotes, backslashes, or line breaks in `APP_NAME` can produce malformed JSON or inject unintended document content, although the primary issue is destructive overwrite. ### Attack Path 1. A user or agent supplies an existing repository path, an incorrect relative path, or the current directory. 2. `mkdir -p` succeeds even if the directory already exists. 3. The script enters the directory without checking its contents. 4. `PROJECT.md`, `version.json`, `.gitignore`, and `README.md` are truncated and replaced. 5. Existing project configuration and documentation are lost unless recoverable from version control or backups. ### Impact Assessment The initializer can destroy existing user-owned project files and alter repository behavior through replacement of `.gitignore`. The scope is the selected writable directory. It does not provide privilege escalation, but accidental execution against a valuable project can cause substantial data loss and development disruption. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/build-check.sh:64
Finding: Predictable Shared Temporary Log Files Permit Symlink Clobbering
Content: View full analysis
&1 | tee /tmp/build.log; then echo "✅ DevEco编译通过" else echo "❌ DevEco编译失败" if [ "$VERBOSE" = true ]; then cat /tmp/build.log fi fi ``` From `scripts/tdd.sh`: ```bash npm test -- "$test_file" 2>&1 | tee /tmp/tdd-test.log || true if grep -q "FAIL\|failed" /tmp/tdd-test.log 2>/dev/null; then # ... elif grep -q "PASS\|passed" /tmp/tdd-test.log 2>/dev/null; then # ... fi ``` ### Technical Analysis Both scripts use fixed, globally predictable names in the shared `/tmp` directory. They do not securely create the files, verify ownership, reject symbolic links, set restrictive permissions, or remove the logs after use. A local attacker can pre-create one of these paths as a symbolic link to another file writable by the victim. When `tee` opens the path, it follows the symbolic link and truncates or writes to the target. Concurrent invocations can also overwrite one another's logs and cause incorrect test-result interpretation. ### Attack Path 1. A local attacker predicts `/tmp/build.log` or `/tmp/tdd-test.log`. 2. The attacker creates a symbolic link from that path to a file writable by the victim. 3. The victim runs the build or TDD script. 4. `tee` follows the link and writes build/test output to the selected target. 5. The target file is corrupted or replaced with log content. 6. Alternatively, an attacker races or pre-populates the TDD log to influence PASS/FAIL detection. ### Impact Assessment The attacker may overwrite files writable by the invoking account, disrupt builds, corrupt configuration, or manipulate test status. This does not bypass operating-system file permissions, so the scope is limited to files the victim acc ...[truncated 29 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/visualize.sh:392
Finding: Generated HTML Executes Mutable CDN JavaScript Without Version or Integrity Pinning
Content: View full analysis
"$html_file" << 'EOF' 项目架构图 ``` ### Technical Analysis The generated local report loads Mermaid from an unversioned jsDelivr URL. The effective JavaScript can change after the Skill has been reviewed because neither an exact package version nor a Subresource Integrity hash is supplied. Opening the report therefore executes code controlled by the current CDN/package response. No restrictive Content Security Policy is generated. The report also embeds generated Mermaid content derived from local project information, which is then processed in the same page as the remote script. ### Attack Path 1. The Mermaid package distribution, npm account, CDN, or delivery path is compromised. 2. The unversioned URL begins serving modified JavaScript. 3. A developer generates and opens `docs/architecture/index.html`. 4. The browser retrieves and executes the changed remote script. 5. The malicious script can inspect or modify the report DOM and initiate network requests from the report page. ### Impact Assessment The direct scope is the browser context of the generated report. A malicious script could read architecture information embedded in the page, alter the displayed diagrams, track the user, or exfiltrate report contents over the network. Access to arbitrary local files is normally restricted by browser security controls, but the risk may increase in permissive embedded browser or IDE preview environments. ]]>
Remediation: View remediation
/dist/mermaid.min.js" integrity="sha384-..." crossorigin="anonymous"> ``` - Generate a restrictive Content Security Policy that permits only the required script and blocks unexpected connections. - Avoid automatically opening the report. - Escape or sanitize project-derived content before embedding it into HTML. - Document that opening the report may make an external network request. ]]>

T07 · Tool Hijacking and Spoofing

Warning

Location: scripts/setup-hooks.sh:24
Finding: Git Hook Installer Overwrites Existing Hooks and Uses an Undefined Destination Variable
Content: View full analysis
"$HOOKS_DIR/pre-commit" << 'HOOK_EOF' #!/bin/bash # ... HOOK_EOF chmod +x "$HOOKS_DIR/pre-commit" } ``` The commit-message hook uses an undefined variable: ```bash create_commitmsg_hook() { cat > "$HOOK_DIR/commit-msg" << 'HOOK_EOF' #!/bin/bash # ... HOOK_EOF chmod +x "$HOOKS_DIR/commit-msg" } ``` Installation is sequential: ```bash create_precommit_hook create_commitmsg_hook create_prepush_hook ``` ### Technical Analysis The installer truncates `.git/hooks/pre-commit` if it already exists. It does not back up, preserve, chain, or request approval for existing repository automation. More critically, `create_commitmsg_hook` writes through `$HOOK_DIR`, while only `$HOOKS_DIR` is defined. In normal Bash execution, the destination becomes `/commit-msg`. With `set -e`, an unprivileged run will usually fail after the pre-commit hook has already been replaced, leaving a partial installation. If run with sufficient privileges, it can create or replace `/commit-msg` at the filesystem root and then apply execute permissions to a different path. The installer also assumes `.git` is a directory, which does not support common worktree arrangements where `.git` is a file. ### Attack Path 1. A repository already contains a custom `.git/hooks/pre-commit`. 2. The user invokes the documented hook installation command. 3. The installer truncates and replaces the existing pre-commit hook. 4. It then attempts to write `/commit-msg` because `$HOOK_DIR` is empty. 5. Under normal privileges, installation aborts and leaves t ...[truncated 639 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (82)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: 声明描述强调“完整工作流”“从需求到部署”的全流程开发管理，但提供的代码块只实现了较窄范围的代码生成辅助：根据 PRD 生成 service/page/tests 模板，以及生成方法实现建议文档。虽然这与‘生成代码’、部分‘TDD 开发’相关，但并没有看到调试、诊断、编译检查、版本控制、部署、进度管理等核心能力。因此该描述明显夸大了实际功能范围，属于声明与实际行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 该代码片段的主要功能是“编译验证/构建检查”，属于声明中的一个子能力，但远未实现所宣称的完整开发工作流。描述强调从需求到部署的全流程管理，以及产品设计、代码生成、TDD、调试、版本管理等多项能力；而代码只做项目结构校验、环境检查、lint尝试和编译/关键文件检查，没有体现需求管理、设计、代码生成、测试驱动开发、调试诊断、部署或版本控制相关行为。因此描述明显夸大了该代码实际能力，属于目的与行为的实质性不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个通用的 HarmonyOS 应用开发全流程能力集合，但提供的代码只是一个用于“豆因项目”日常验收的 shell 检查脚本。它通过检查构建产物、特定源码文件是否存在、grep 某些函数名或关键词来判断开发进度，并输出手工核对清单。代码没有实现需求管理、功能设计、代码生成、TDD执行、调试诊断、编译控制或版本管理等核心能力，且明显绑定到某个具体项目结构与文件名，因此其实际行为与声明的主要用途存在显著不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description claims a comprehensive HarmonyOS development workflow manager spanning design, code generation, TDD, debugging, compile validation, and version management for various apps. However, the provided code only implements a debugging/inspection script. Its functions are limited to reading logs via hdc, checking existence/content of specific project files, scanning for simple performance smells, printing guidance text, and doing a small health check. It does not design features, generate code, manage tests, perform actual compilation, or handle version control. Additionally, it is tailored to a particular coffee-themed project structure (e.g., DIYCoffeeService, CoffeeAgent, coffeeShops.mock.ts), which materially conflicts with the claimed broad applicability to all HarmonyOS apps. Therefore the declared description materially overstates and misrepresents the actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个广泛的HarmonyOS应用开发全流程技能，但提供的代码块仅实现了“Demo模式准备”相关功能。它创建开发/演示模式配置文件、生成固定演示数据、创建演示入口组件、检查项目文件是否存在，并对某个服务文件插入DevMode导入。这与“产品功能设计、代码生成、TDD、调试、编译验证、版本管理、部署管理”等核心宣称能力不一致。虽然代码确实作用于HarmonyOS项目，属于开发辅助范畴，但其主要目的明显更狭窄：为咖啡主题应用配置演示环境和Mock数据，而不是通用应用开发完整工作流。因此描述与实际行为存在实质性不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: 该代码块的主要功能是脚手架式代码生成：接收 type 和 name 参数后，在 src/ 或 test/ 目录下写入模板文件，生成基础代码骨架。虽然它与声明中的“代码生成”部分一致，也面向 HarmonyOS 场景，但并没有实现“从需求到部署的完整工作流”，也没有看到产品设计、开发进度管理、TDD 流程编排、调试诊断、编译验证或版本管理能力。脚本仅在最后打印一条建议去运行 build-check.sh，并不实际执行编译检查。因而声明明显夸大了能力范围，实际行为只是其中一个子能力（代码生成），构成描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个覆盖 HarmonyOS 应用开发全生命周期的综合开发技能，但实际代码只是一个辅助性的健康检查脚本。它主要读取本地项目结构、源码/测试数量、TODO、文档、编译结果和 Git 状态，属于项目状态审计工具，而不是通用应用软件开发完整工作流。虽然脚本中包含编译检查和 Git 状态检查，这与声明中的“编译验证、版本管理”有部分弱相关，但远不足以支撑其核心宣称的代码生成、TDD 开发、调试、需求设计、部署管理等能力。因此描述与实际行为存在明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 该代码块的核心功能是 lint/静态规则检查：读取指定文件，检测 HarmonyOS/TypeScript 相关规范、性能、安全和错误处理问题，生成报告，并更新 PROJECT.md 中的分数。这与声明的“通用应用软件开发完整工作流（HarmonyOS版）”存在明显范围和目的不一致。声明描述的是一个从需求到部署的全流程开发管理与多项开发能力集合，而代码仅实现了其中很小的一部分——代码规范检查，且并未体现需求管理、设计、代码生成、TDD、调试、编译、部署或版本管理能力。另有一个未声明但实际存在的行为：修改 PROJECT.md 文件以写入检查结果，属于附带文件更新能力。综上，描述显著夸大了实际能力，应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个覆盖软件开发全流程的 HarmonyOS 应用开发管理能力，但代码仅实现了本地 API Mock 服务的脚本化管理。它会创建 mock 目录、写入 package.json 和 server.js、生成示例路由与 JSON 数据、安装 npm 依赖，并支持 start/stop/restart/status/init/add 等命令。这与“完整开发工作流”“HarmonyOS 应用快速开发”“TDD/编译/版本管理”等核心声明能力存在明显偏差。尽管生成模板路由可被视为有限的辅助开发能力，但其主要目的仍是接口模拟，而非所声明的完整 HarmonyOS 开发流程。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description promises a broad HarmonyOS software development workflow tool, including requirement-to-deployment management, code generation, TDD, debugging, compilation checking, and version management. The supplied code is narrowly focused on performance reporting: it traverses src for .ts/.ets files, counts async/await/loops/ifs, assigns simple risk scores, writes reports, compares against a baseline, and optionally monitors repeatedly. This is a materially different primary purpose and introduces an undeclared capability (performance monitoring/reporting) while lacking nearly all of the declared core capabilities. Although it targets TypeScript/ArkTS source files that could belong to a HarmonyOS project, that limited overlap is insufficient to make the description accurate.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 该脚本的实际功能范围较窄，主要是文档模板生成工具：在 docs/prd/ 下创建 PRD、流程图 markdown、埋点设计 markdown，并打印验收清单。虽然内容中提到 HarmonyOS 兼容性验收项，但代码本身并未与 HarmonyOS SDK、构建系统、测试框架、调试工具、代码仓库或部署流程交互。声明将其描述为“通用应用软件开发完整工作流（HarmonyOS版）”且包含代码生成、TDD、调试、编译、版本管理等能力，明显超出了此代码片段的实际行为。未见危险的额外未声明资源访问，但主要用途与宣称能力存在实质性不符。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 声明描述的是一个覆盖 HarmonyOS 应用从需求到部署的全流程开发管理技能，核心能力应包括开发辅助、代码生成、测试驱动开发、调试、编译检查和版本管理等。实际提供的代码仅实现了质量报告工具：统计 src/test 文件、计算代码行数、搜索 TODO/CRITICAL、检查 README/PRD/API/架构图、读取 Git 提交/分支/贡献者信息、调用 lint 检查并生成报告。虽然它与“开发管理”中的质量评估有一定相关性，也涉及少量版本库统计和 lint 检查，但这只是狭窄的辅助子功能，远不足以支撑“完整工作流”这一主要声明。因此该描述明显夸大并偏离了代码的实际主要用途，应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broad HarmonyOS application development workflow tool focused on building apps from requirements through deployment, including code generation, TDD, debugging, and development management. The supplied code does not implement those core capabilities. Instead, it is a Git hooks setup utility that writes executable scripts into .git/hooks and manages commit-time/push-time repository checks. While some checks loosely relate to development quality (lint, build, tests, version control hygiene), the primary purpose is repository hook automation and commit policy enforcement, which is much narrower and materially different from the declared end-to-end HarmonyOS development workflow. This constitutes a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: 该代码块的核心用途是多开发者 Git 协作支持，而不是声明中的“通用应用软件开发完整工作流（HarmonyOS版）”。它没有体现 HarmonyOS 特定开发逻辑，也没有实现需求管理、产品设计、代码生成、测试驱动开发、调试诊断或编译检查等关键声明能力。虽然声明中提到版本管理，和脚本中的 Git 状态/同步分析有一定相关性，但这只能覆盖声明中的很小一部分。相反，代码实际集中在协作同步、冲突预警、文件锁定和报告生成，属于更窄且不同的主要目的，因此构成描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个覆盖HarmonyOS应用从需求到部署的完整开发工作流工具，范围非常广，包含设计、代码生成、TDD、调试、编译、版本管理等多个子能力。但实际代码只是一个shell脚本，用于辅助TDD流程：start生成测试骨架并记录状态，run调用npm test并解析结果，impl仅输出手工实现提示，refactor做非常基础的lint/文件行数检查，status显示当前阶段。它没有实现需求管理、产品设计、部署、版本控制、调试诊断、编译验证等声明中的关键能力，也没有明显的HarmonyOS专属处理逻辑。因此描述显著夸大了代码实际功能，属于明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 该代码块的主要用途是项目版本管理与发布辅助，属于声明中“版本管理”的一个很小子集。它没有体现“从需求到部署的全流程开发管理”，也未实现描述中列出的多数关键能力，如产品设计、代码生成、TDD、调试、编译检查。虽然脚本包含代码统计、调用lint脚本、备份版本等辅助功能，但整体与“通用应用软件开发完整工作流（HarmonyOS版）”这一宽泛声明存在明显描述与行为不一致，属于夸大声明。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该脚本的核心功能是文档化与可视化：读取项目目录中的 src/services、src/pages、src/viewmodels 等文件，提取部分导入和类/方法信息，生成 .mmd 图表和 index.html 预览。虽然其中包含一个“开发流程图”的静态示意，但并未实现需求管理、代码生成、测试驱动开发、调试、编译检查、版本控制或部署等声明中的主要能力。其实际用途更接近“项目架构可视化工具”，而不是“通用应用软件开发完整工作流”。因此声明与实际行为存在明显的实质性不匹配。
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.
md
| `mock-server.sh` | Mock API 服务 | 实现 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.
md
| `ai-generate.sh` | AI辅助代码生成 | 生成/实现 |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/mock-server.sh (reported line 529)May include surrounding context.
sh
}); }); // DELETE /api/$path/:id app.delete('/api/$path/:id', (req, res) => { res.json({ code: 0, message: '删除成功' }); });

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/quick.sh (reported line 227)May include surrounding context.
sh
step "清理构建缓存" # 清理常见缓存目录 rm -rf build/ 2>/dev/null || true rm -rf .cache/ 2>/dev/null || true rm -rf node_modules/.cache/ 2>/dev/null || true

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/quick.sh (reported line 228)May include surrounding context.
sh
# 清理常见缓存目录 rm -rf build/ 2>/dev/null || true rm -rf .cache/ 2>/dev/null || true rm -rf node_modules/.cache/ 2>/dev/null || true success "清理完成"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/quick.sh (reported line 229)May include surrounding context.
sh
# 清理常见缓存目录 rm -rf build/ 2>/dev/null || true rm -rf .cache/ 2>/dev/null || true rm -rf node_modules/.cache/ 2>/dev/null || true success "清理完成" }

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/setup-hooks.sh (reported line 322)May include surrounding context.
sh
step "卸载 Git Hooks..." check_git_repo rm -f "$HOOKS_DIR/pre-commit" rm -f "$HOOKS_DIR/commit-msg" rm -f "$HOOKS_DIR/pre-push"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/setup-hooks.sh (reported line 323)May include surrounding context.
sh
check_git_repo rm -f "$HOOKS_DIR/pre-commit" rm -f "$HOOKS_DIR/commit-msg" rm -f "$HOOKS_DIR/pre-push" success "Hooks 已卸载"

Static analysis

No suspicious patterns detected.