T08 · Insecure Dependencies
Warning
- Location
README.md:88- Finding
Unpinned Third-Party Installer Executed Through npx
- Content
View full analysis
- Remediation
View remediation
Security audit
mba-thesis-writing-guidance
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent Chinese MBA thesis-writing guide, but it needs review because its documentation tells an agent to run an unpinned npx installer and it automatically writes project configuration files.
Install only inside the intended thesis project, not globally. Prefer a pinned or manually reviewed installer path instead of letting an agent run the unpinned npx command automatically, and review the generated YAML files before committing them because they may contain school, thesis, or company metadata.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (47)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text Thumbs.db Desktop.ini .env .env.* !.env.example
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents an end-user academic writing guidance skill for MBA/EMBA thesis support. The supplied code does not implement any thesis-writing, outline generation, review assistance, defense preparation, or content-safety logic related to academic writing. Instead, it is a repository validation utility that verifies SKILL.md frontmatter and required folders for packaging/discovery with
npx skills add. This is a materially different primary purpose and an unrelated capability, so it is a clear description-behavior mismatch.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
README 明确说明 Agent 会自动扫描项目并写入项目根目录配置，但缺少醒目的写入前告知、权限范围、文件覆盖策略和敏感信息处理警示。对于可能包含企业内部材料、学生论文、学校要求等敏感内容的项目，这会造成未经充分知情的本地文件修改与元数据落盘风险。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
README 将技能适用触发语扩展到较宽泛的论文相关表达，且文中多次强调可在多种 Agent 环境中项目级常驻加载。这样的触发面可能导致在非预期场景下误触发论文辅助流程，进而读取项目材料、生成配置或介入不该处理的学术内容，属于权限/作用域边界过宽问题。
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
该处使用说明再次要求 Agent 运行 intake 流程并自动写入
school-format.yaml与thesis-config.yaml，但没有明确的数据写入警告、字段清单或确认步骤。由于论文项目可能含个人、学校及企业数据，这种默认写盘行为在多 Agent 环境下更容易造成误修改、信息固化或将敏感元数据持久化到版本控制中。- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation phrases include broad prompts like '帮我写论文' and general thesis-related requests, which can cause the skill to trigger in contexts broader than intended. Over-triggering can route ordinary conversations into a highly prescriptive workflow that reads project files and steers user behavior, increasing the chance of unintended file access, context hijacking, or irrelevant instruction injection.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This file contains user-facing natural-language instructions entirely in Chinese and does not indicate that language selection is optional. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file presents all instructions in Chinese and does not indicate that the user can choose another language or that the checklist is intentionally limited to a Chinese-speaking context. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file presents all instructions and checklist items in Chinese and does not indicate that the user can choose another language. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable unless the locale constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill file is written as prescriptive guidance in Chinese and does not indicate that another language may be used or that Chinese is required for a specific regional or compliance reason. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file contains natural-language instructions that prescribe Chinese-language writing conventions and specific narrative style, including '中文摘要四要素' and a requirement to use third person and formal written language. Under the policy rule, forcing a specific language or locale without user opt-in is a violation unless the restriction is explicitly justified as region-specific; while the file references Chinese MBA norms, it does not clearly state that assistance is limited to users who opted into Chinese-language output.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire instruction file is written in Chinese and provides no indication that other languages are supported or that the user can opt into this locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire rubric is written in Chinese and provides instructions solely in that language, with no indication that users may choose another language or locale. This is a natural-language policy concern because it effectively imposes a language constraint without documented opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The file instructs that in a '中文语境' specific formatting rules must be followed and the entire skill content is written as a mandatory standard in Chinese. Under the policy, language or locale constraints should either be optional for the user or clearly documented as a justified region-specific requirement; that justification is not explicit here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instruction says the user must be able to explain abnormal results '用普通话' (in Mandarin), which imposes a specific language requirement in natural-language guidance. There is no indication that users may choose another language or that this locale constraint is limited to a justified region-specific context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The entire skill is written in Chinese and includes an explicit requirement at L43 to explain concepts in Mandarin (普通话), which imposes a language constraint. There is no indication that users may choose another language or that the locale restriction is optional or justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file presents all instructions in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-language audience. The policy requires flagging language or locale constraints when they are imposed without user opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
Line L01 explicitly frames the skill guidance as '中国 MBA 论文写作原则', and the entire file is written only in Chinese with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire guidance is written as prescriptive Chinese-only writing instruction and does not offer any language or locale choice. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Static analysis
No suspicious patterns detected.