Security audit

FuncPulse

Security checks for vulnerabilities and agentic risk

Overview

FuncPulse is a coherent QA/reporting skill, but it automatically uploads potentially sensitive validation reports and repository metadata over plain HTTP without a clear consent gate.

Review before installing or using in a real project. Only run it on data you are allowed to send to ai-testcase.jd.com, assume the full report and repository metadata may be logged and transmitted without encryption, and prefer a local-only or HTTPS/consent-gated version before using it with proprietary, regulated, or internal financial AI materials.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill mandates automatic upload of generated reports to a remote endpoint, which creates an exfiltration path for potentially sensitive business requirements, test evidence, defects, repository addresses, and internal project metadata. This is especially risky because the core stated purpose is QA analysis, so outbound transmission is not strictly necessary and may occur without informed approval.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest advertises analysis and traceability, but the documented workflow also performs remote submission and post-upload modification of local report files. This hidden expansion of capability undermines user trust boundaries and can lead to unanticipated leakage or integrity changes to project artifacts.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script is designed to upload the full validation report plus repository metadata to a remote platform, and the report body may contain sensitive business requirements, defects, traceability details, and internal repository information. In the context of a financial AI validation skill, this materially increases data exposure risk because the transmitted content can include proprietary or regulated information that exceeds the minimum needed for local analysis.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code collects tester identity from local git config and repository origin/path information, then includes it in the upload payload. In enterprise and financial environments, these fields can reveal employee identity, internal repository topology, hostnames, or filesystem layout, increasing privacy and reconnaissance risk if exposed or intercepted.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: When git remote lookup fails, the implementation falls back to process.cwd(), which can disclose the local absolute filesystem path and then include it in the upload payload. In a corporate environment, local paths can expose usernames, project structure, mount points, or internal naming conventions that aid reconnaissance and violate least-disclosure expectations.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill requires automatic upload without warning users about data transmission, creating a consent and privacy failure. In a financial/AI testing context, reports may contain regulated business logic, defects, coverage gaps, repository information, and operational details, so silent transfer materially increases confidentiality risk.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The upload design exposes a remote HTTP API and detailed extraction of report contents without meaningful privacy or integrity safeguards. Because the endpoint is plain HTTP rather than HTTPS, transmitted testing data and metadata could be intercepted or altered in transit, further increasing the risk beyond simple undisclosed sharing.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The API endpoint uses plain HTTP, so full validation reports, defect details, tester identity, and repository metadata are transmitted without transport encryption. In a financial AI testing context, this is especially dangerous because sensitive business, compliance, and codebase information could be intercepted or modified by any party on the network path.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script logs the entire serialized request payload, which includes the full report content and repository metadata. This can leak sensitive data into terminal scrollback, CI logs, shell history capture, or centralized logging systems, creating secondary exposure even if the network path were secured.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/generate-validation-report.js:28