TaoHtml

• Outcome: Pass
• Latest audit: Aug 21, 2026 · 2:42 PM UTC
• Version: 0.6.0

Overview

TaoHtml’s file processing, browser QA, and corporate-template reuse are disclosed and purpose-aligned, with dependency hygiene as the main installation caution.

Install only in a workspace where local file generation and Chromium-based QA are acceptable. Before using customer reference images or PDFs, use an up-to-date patched Pillow version and review what is stored under TAOHTML_HOME or ~/.taohtml if enabling corporate-template reuse.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises and documents capabilities that include environment access, file reads/writes, shell commands, browser automation, and network-linked installation/update flows, but the manifest section shown does not declare permissions or an equivalent capability boundary. This creates a trust and audit gap: an agent or platform may grant broader access than a user expects, increasing the risk of unauthorized file modification, command execution, or external dependency use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The declared purpose frames the skill primarily as document-to-HTML presentation generation, but the documented behavior extends into broader engineering and state-management functions such as HTML editing, Report IR patching, archive import/export, workflow gating, browser QA, packaging, and environment/toolchain operations. That mismatch can mislead users and reviewers about the true attack surface, causing them to approve a skill that can alter local artifacts, process untrusted files, and invoke auxiliary tooling beyond the expected narrow function.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The template hardcodes Chinese output for the generated design brief, which can override or ignore the user's preferred language. In a report-generation skill, this creates a quality and instruction-following vulnerability because the agent may produce unusable or misleading deliverables for non-Chinese-speaking users, and it can cause downstream confirmation or authorization steps to be misunderstood.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document instructs the skill to automatically resolve and bind an enterprise profile across tasks, which creates cross-project persistence of corporate template data. Even though the file tries to limit scope to brand/template material, the reuse is still persistent state and can surprise users if not clearly disclosed at the time of reuse, creating privacy, consent, and data-boundary risks.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation text is very broad: it applies whenever a request concerns an existing project, handoff, current HTML artifact, review, or continued work. In an agent skill system, such broad triggers can cause this overlay to activate on many unrelated tasks and override more appropriate instructions, creating scope confusion and increasing the chance of incorrect file handling or workflow control.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The instruction hard-codes output of the delivery-time list as `《待核实内容清单》`, which forces a specific language/form without asking the user. This can conflict with user expectations or surrounding workflow language, and in multi-lingual agent environments it may degrade transparency or cause downstream parsing and review errors.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill hard-codes Chinese-language interaction for a recovery message without offering language selection or adapting to the user's language. This can cause user misunderstanding, failed consent/confirmation, and policy noncompliance in multilingual deployments, though it is not a direct security exploit.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The confirmation gate requires an exact Chinese prompt as the primary customer-facing instruction, which can prevent users from understanding what they are authorizing. Misunderstood confirmation language weakens the reliability of user consent and creates locale-policy risk, especially for non-Chinese users.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Product Boundary

Treat a corporate profile as Skill-managed, inspectable state, not model memory. Use
`TAOHTML_HOME` when set; otherwise use `~/.taohtml`. Never write profiles into the
installed Skill directory. Codex, Claude Code, and other local Agents can reuse the
same home directory when they run as the same user and point to that directory.

• Confidence: 91% confidence
• Finding: The skill explicitly establishes persistent on-disk state in a shared home directory and allows multiple local agents running as the same user to reuse it. That is a real session-persistence and cross-context data-sharing mechanism: even if limited to enterprise profile artifacts, it can leak organizational identifiers, brand assets, and reuse decisions across otherwise separate tasks without strong user awareness or isolation.

Known Vulnerable Dependency: Pillow==10.0 — 10 advisory(ies): CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`) +7 more

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The requirement allows Pillow versions starting at 10.0 and below 13, which includes versions with multiple published security advisories. Because this skill processes user-supplied Word/PDF/PPT-derived content and likely handles embedded images, a vulnerable Pillow version could be reached through untrusted files and enable crashes, memory corruption, or potentially code execution depending on the specific CVE and code path.

Static analysis

No suspicious patterns detected.