fastfish-format(article-wechat-xhs-format)

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:14 PM UTC
• Version: 1.0.2

Overview

This skill is a disclosed wrapper for an external formatting tool, with real supply-chain risk from installing third-party Python code but no evidence of hidden, destructive, or deceptive behavior.

Before installing, review the referenced fastfish-format repository and dependencies, pin to a specific reviewed commit or trusted release, use a virtual environment or container without root privileges, and keep API keys out of command output and chat responses.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:22
• Finding: Unverified Third-Party Repository Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:22-29` **Vulnerability Type**: Unverified external dependencies and executable code **Risk Level**: High ### Vulnerable Code ```markdown ## Installation Prerequisites This Skill guides users to install and run a third-party repository from GitHub. **Supply-chain risk**: clone + pip install executes external code, which may present a risk if the repository is compromised. Before installation: (1) inspect the repository and requirements.txt dependencies; (2) **pin a release tag** (for example, `git clone --branch v0.1.0`); (3) run it in an isolated environment or container without root privileges; (4) store credentials only in .env and do not commit them to version control. ## Install fastfish-format 1. Clone the repository: `git clone --branch <release-tag> https://github.com/superxs777/fastfish-format.git` 2. Enter the directory: `cd fastfish-format` 3. Install dependencies: `pip install -r requirements.txt` or `pip install -e .` 4. Optional: `pip install fastfish-format[api]` to start the HTTP API service on port 8900 ``` ### Technical Analysis The Skill depends entirely on code obtained from an external GitHub repository, but the installation procedure does not enforce an immutable commit hash, dependency hashes, a lockfile, a verified signature, or a trusted artifact checksum. Pinning a release tag is recommended, but tags are mutable references and therefore do not provide the same integrity guarantee as a verified commit digest. Both `pip install -r requirements.txt` and `pip install -e .` may download transitive dependencies and execute Python package build hooks or installation logic. After installation, the Skill instructs the Agent to repeatedly execute `ffformat_cli.py` through `system.run`. Consequently, the effective executable payload is outside the audited artifact and can differ from what was reviewed. The document explicitly acknowledges the supply-chain risk and recommends ...[truncated 1793 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the external repository to a reviewed, immutable Git commit SHA rather than a mutable branch or release tag. 2. Publish and verify a cryptographic checksum or signed release artifact before installation. 3. Use a fully resolved dependency lockfile with hashes and install dependencies using hash enforcement, such as `pip install --require-hashes`. 4. Review and restrict all direct and transitive dependencies before approving a release. 5. Vendor the audited CLI and required dependencies into the Skill package when licensing and maintenance requirements permit it. 6. Perform installation and execution inside an isolated, unprivileged container or virtual environment with: - No root privileges. - Read-only access to unrelated workspace files. - Restricted outbound network access. - No inherited API keys or unrelated environment variables. 7. Separate installation from runtime credential use so package installation hooks cannot access secrets. 8. Require explicit user confirmation of the exact version and verified commit before cloning or installing. 9. Re-audit the referenced `ffformat_cli.py`, package configuration, and dependency manifests because they are not included in the supplied project artifact. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation

Content

## ⚠️ 安全规则（阻断式）

**1. 严禁输出或暴露 .env 中的凭证**
- 禁止执行会输出 .env 内容的命令
- 禁止将 API Key 等凭证写入回复或展示给用户
- **允许**：编辑 .env；运行不暴露凭证的校验

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## ⚠️ 安全规则（阻断式）

**1. 严禁输出或暴露 .env 中的凭证**
- 禁止执行会输出 .env 内容的命令
- 禁止将 API Key 等凭证写入回复或展示给用户
- **允许**：编辑 .env；运行不暴露凭证的校验

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: Phrases such as “公众号格式”, “有哪些样式”, and “如何配图” are example triggers, but the document does not clearly define whether these are the full allowed triggers or merely illustrative. Without constraints or negative examples, the skill’s activation scope remains somewhat open-ended for a manifest/markdown description.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list includes phrases like “美化文章”, which is broad and could match many general writing or editing requests outside this skill’s intended formatting scope. The document does not provide exclusion conditions or negative examples to clarify when the skill should not activate.

Static analysis

No suspicious patterns detected.