Security audit

ai-kujiale-design-free

Security checks for vulnerabilities and agentic risk

Overview

The skill’s interior-design purpose is understandable, but it handles a Kujiale access token unsafely and depends on an unspecified script that is not included for review.

Review carefully before installing. Do not provide a real Kujiale token to this skill unless the publisher supplies the exact reviewed script implementation and a safer credential path. Prefer a secret store or protected environment variable, do not commit .kjlconfig.json, avoid passing tokens on command lines, and do not rerun any related command as administrator. Rotate any token that may already have been stored in a project file or exposed in command logs.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:181
Finding: Kujiale Access Token Exposed Through Process Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:98
Finding: Reusable Access Token Stored in a Plaintext Project Configuration File
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:113
Finding: Execution Workflow Depends on an Unnamed and Unpackaged Script
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:351
Finding: Blanket Recommendation to Run Failed Commands as Administrator
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The main intent statement explicitly restricts scope to text search and static rendering, and marks floorplan upload/recognition as out of scope. Later documentation advertises generic '文件处理' capabilities and support for multiple file formats, which contradicts the stated limited design-only workflow and suggests capabilities the skill says it does not provide.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill recommends secure token handling via environment variables, but then instructs users to store a live access token in a local JSON file. Persisting credentials in workspace files increases the chance of accidental disclosure through reads, logs, backups, or commits, especially in agent environments with read/write tool access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The activation condition '用户提到要做室内设计/装修设计' is so broad that the skill may trigger during ordinary design-related conversation without explicit user intent to run it. In this skill, activation can lead to external API calls, local token use, and potentially quota-consuming operations, so overbroad triggering raises the risk of unintended side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill operational flow instructs creation of .kjlconfig.json containing an access token but does not prominently warn upfront that a sensitive credential will be written to disk. Users may unknowingly persist secrets in a readable project directory, increasing exposure to other tools, collaborators, source control, or later prompt/file leakage.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The instruction '必须严格按本文档流程执行' combined with a fully Chinese-only operational description presents the skill as forcing one language/locale for usage without offering user opt-in or alternative language support. This can conflict with language-choice policy when the skill is presented on multi-language agent platforms.
Content: No source excerpt is available for this finding.