FaviconDL · 任意网站 Favicon 下载工具

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:15 AM UTC
• Version: 2.0.0

Overview

The favicon tool is mostly coherent, but its install instructions tell users to download executable scripts from a mutable GitHub branch without integrity checks.

Use the REST API or the bundled reviewed Bash script when possible. Be cautious with the documented raw GitHub install commands because they can fetch changed executable code later; prefer pinned commits, checksums, or manual review before running downloaded scripts.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:56

Finding

Mutable Remote Executable Download Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56–68
Vulnerability Type: Remote payload retrieval from a mutable source
Risk Level: Medium

Vulnerable Code

markdown

> Download directly from raw.githubusercontent.com to the local system:

### Windows PowerShell

```powershell
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/sweesama/favicondl.com/main/favicondl.ps1" -OutFile "$env:USERPROFILE\favicondl.ps1"

Linux / macOS (Bash)

bash

curl -fsSL -o ~/favicondl.sh "https://raw.githubusercontent.com/sweesama/favicondl.com/main/favicondl.sh"
chmod +x ~/favicondl.sh

text

### Technical Analysis

The installation instructions retrieve executable scripts from the mutable `main` branch of a personal GitHub repository. Neither command pins the downloaded content to a reviewed commit or release, and no cryptographic checksum or signature is verified.

Consequently, the code installed by users can differ from the version inspected during this audit. The bundled `favicondl.sh` is not malicious and only invokes the advertised HTTPS API, but this does not establish the safety of future content returned by the mutable remote URLs.

The Bash command also writes directly to `~/favicondl.sh`, potentially replacing an existing file, and then marks the downloaded content executable. The PowerShell instruction similarly writes a remotely controlled script into the user's profile. Execution is not automatic in the shown commands, so exploitation requires the user or an agent to subsequently run the downloaded wrapper.

This behavior exceeds the minimum privileges and components necessary for the declared favicon-download functionality because the REST API can be called directly and a reviewed Bash wrapper is already included in the Skill package.

### Attack Path

1. An attacker compromises the upstream GitHub account or repository, gains permission to modify it, or introduces a malici
...[truncated 1114 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer the reviewed favicondl.sh already distributed inside the Skill package rather than downloading another copy at installation time.
2. If remote installation remains necessary, pin each URL to an immutable, reviewed Git commit instead of the main branch.
3. Publish SHA-256 hashes through a separately protected release channel and verify them before making the files executable or running them.
4. Prefer signed release artifacts and document signature verification using a trusted maintainer key.
5. Avoid silently overwriting existing files. Refuse installation when the destination exists, or require explicit user confirmation and create a backup.
6. Clearly identify both CLI wrappers as optional because direct HTTPS API access provides the declared functionality without installing executable code.
7. Apply identical pinning and verification controls to both the Bash and PowerShell downloads.
8. If updates are supported, present and verify the exact version before replacing a previously reviewed local script.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs users to download and run shell scripts (PowerShell and Bash) and references a local Node-based MCP process, but it does not declare any explicit tool scope such as shell permissions or allowed tools. This can weaken agent/runtime safety controls because a host may not realize the skill expects code execution and network-capable shell access, increasing the chance of unintended command execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill's display name and full description are presented in Chinese, and the rest of the document predominantly instructs agents in Chinese. The policy only permits fixed language/locale behavior when the skill offers user opt-in or clearly documents a justified regional constraint, which is not present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.