酷家乐AI室内设计

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:24 AM UTC
• Version: 1.0.4

Overview

The skill is mostly an interior-design workflow, but it asks agents to use a Kujiale account token, upload home layout data, and run unclear shell commands in ways that need review before installation.

Review this skill before installing. Use it only if you are comfortable sending floorplans, render requests, and design metadata to Kujiale and storing a Kujiale access token locally. Do not run the documented shell commands with untrusted input as plain interpolated strings; use audited local scripts, structured argument passing, token redaction, and protected token storage. Confirm any action that consumes account credits before execution.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:109

Finding

Access Token Exposed Through Process Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 109–116; the same pattern recurs at lines 157–162, 181, 193, 199, 216–224, and 236–242
Vulnerability Type: Credential exposure through process arguments
Risk Level: Medium

Vulnerable Code Snippet

bash

# Read the access_token field from .kjlconfig.json into TOKEN before execution.
node SCRIPT_PATH --token=$TOKEN --version=1.0.0

Other documented invocations repeat the same unsafe credential-passing pattern:

bash

node SCRIPT_PATH --token=$TOKEN --designId=$DESIGN_ID
node SCRIPT_PATH --obsDesignId=$DESIGN_ID --xToken=$TOKEN

SCRIPT_PATH represents the script placeholder used by the original document; no actual scripts are included in the audited package.

Technical Analysis

The skill directs the Agent to read the Kujiale bearer token from a plaintext configuration file and expand it into command-line arguments such as --token and --xToken.

Command-line arguments are not an appropriate secret transport mechanism. Depending on the host and Agent platform, expanded arguments can appear in:

• Process inspection interfaces and process listings.
• Agent tool-call and command-execution traces.
• Terminal transcripts or shell debugging output.
• Audit, telemetry, crash, or error logs.
• Process-monitoring and endpoint-management products.

Quoting the token would not resolve the exposure because quoting only changes shell parsing; the expanded secret remains in the child process argument vector.

Attack Path

1. A user stores a valid Kujiale access token in .kjlconfig.json as directed.
2. The Agent reads the token into the TOKEN shell variable.
3. The Agent executes one of the documented commands using --token=$TOKEN or --xToken=$TOKEN.
4. The shell expands the variable before starting the Node.js process.
5. The complete token becomes part of the process argument vector and may also be captured by Age ...[truncated 828 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --token and --xToken from every documented command.
2. Have scripts read the credential directly from a protected environment variable or secret manager without copying it into the argument vector.
3. Where environment exposure is also a concern, pass the token through a dedicated inherited file descriptor or standard input, provided the script does not log it.
4. Configure the Agent and scripts to redact token values from command traces, errors, telemetry, and HTTP logs.
5. Store .kjlconfig.json with owner-only permissions and validate those permissions before use.
6. Add .kjlconfig.json to .gitignore and provide only a placeholder example file.
7. Avoid printing request headers, complete API responses containing credentials, or expanded command strings.
8. Use short-lived, narrowly scoped tokens where the Kujiale API supports them, and provide a documented revocation procedure.
9. Rotate any token that may already have appeared in command logs or process-monitoring records.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:138

Finding

User-Controlled Values Interpolated into Shell Commands

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 138–138; related unsafe command construction patterns occur at lines 93, 216–218, 271, and 280–282
Vulnerability Type: Potential shell command injection
Risk Level: High

Vulnerable Code Snippet

bash

node SCRIPT_PATH --token=$TOKEN --query="COMMUNITY_NAME" --areaId="CITY_ID" --start=0 --num=20

The layout workflow similarly inserts identifiers into a shell command:

bash

node SCRIPT_PATH --token=$TOKEN --designId=$DESIGN_ID \
  --tagIds=$TAG_IDS --styleId=$STYLE_ID \
  --applyDecorationStyle=true --buildCeiling=true --autoDesign=true

COMMUNITY_NAME and CITY_ID denote the user-provided values identified by the original instructions. SCRIPT_PATH represents the unspecified script placeholder in the document.

Technical Analysis

The workflow instructs the Agent to put user-provided search text and dynamically obtained identifiers into shell command examples. It does not require a structured process API, define strict validation rules, or prohibit execution through a shell.

If an implementation constructs a single command string by textual substitution, malicious quotation marks, command substitutions, separators, redirections, or newline characters can terminate the intended argument and introduce additional shell operations.

Double quotes do not make arbitrary input safe. Shell constructs such as command substitution can still be interpreted inside double-quoted values if the untrusted content is inserted before shell parsing. Unquoted variables such as TAG_IDS, STYLE_ID, and DESIGN_ID also create risks involving word splitting, glob expansion, and option injection.

Exploitation depends on the Agent or runtime executing the constructed text through a shell. A structured process invocation that passes a fixed executable and an argument array without shell interpretation would prevent the primary command-injection path.

...[truncated 1727 chars]

Remediation

View remediation

Remediation Suggestions

1. Never create a shell command by concatenating or interpolating user-controlled values.
2. Invoke Node.js with a structured argument array and disable shell processing. For example, use the platform equivalent of spawning node with separate arguments and shell: false.
3. Define strict validation for every dynamic field:
   • Permit community names only as ordinary text with a documented maximum length.
   • Require area, plan, design, style, task, and tag identifiers to match their exact expected formats.
   • Parse numeric values as integers and enforce valid ranges.
   • Reject control characters, null bytes, and unexpected newlines.
4. Treat identifiers returned by remote APIs as untrusted until validated.
5. Use -- where supported to terminate option parsing before values that might begin with a hyphen.
6. Do not rely solely on shell quoting or escaping, as escaping errors are common and shell-specific.
7. Add tests containing quotation marks, command substitutions, separators, redirections, wildcard characters, leading hyphens, and newline characters.
8. Run all helper scripts in a restricted sandbox with minimal filesystem and network permissions.
9. Replace unspecified script placeholders with reviewed, package-local scripts so the execution path can be audited.
10. Ensure helper scripts also validate their arguments and never pass them into secondary shell commands.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description states "不适用于3D建模和动画制作" and frames the skill as design/UI/poster/brand-visual use, which excludes 3D modeling. However, the rest of the file documents generating floorplans, auto-layout, and rendered interior images via Kujiale, which is exactly a 3D interior-design workflow rather than UI/poster design.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use the skill for '设计创作、UI设计、海报制作、品牌视觉', which is a very broad invocation condition and extends far beyond the documented interior-design workflow. This can cause unintended activation on common creative-design requests that are unrelated to Kujiale indoor layout/rendering.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description states '支持中文交互', and the document consistently presents operation as Chinese-only without offering users a language or locale choice. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The feature summary explicitly highlights '中文交互' as a core capability, but does not indicate whether other languages are supported or whether Chinese is optional. This reads as a fixed language constraint rather than a user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to upload floorplan images and project data to Kujiale, but it does not present an upfront disclosure that these materials are transmitted to an external third-party service. This creates a meaningful privacy and consent risk because users may share home layouts, images, and project metadata without understanding where the data goes or how it will be processed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger '用户提到要做室内设计/装修设计' is still broad and does not define boundaries for when the skill should or should not activate. There are no negative examples to distinguish interior-rendering workflows from adjacent requests like construction drawings, remodeling advice, or general decoration consultation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The input section presents a conventional parameterized interface including callback_url, implying request-driven operation. Later, the documented behavior for uploaded floorplans is to watch $HOME/.skill-platform/media/inbound every 5 seconds for new images, which is a materially different execution model and contradicts the declared interaction pattern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.