图表工具基础版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:27 AM UTC
• Version: 1.0.4

Overview

This diagram skill is mostly purpose-aligned, but it includes unnecessary credential-environment checks and unclear data-flow claims that users should review before installing.

Install only if you are comfortable reviewing commands before they run. Do not let the agent execute the environment-variable grep or PowerShell check; verify only the exact API key variable needed, and avoid using sensitive diagram content with any feature that may call external APIs until the publisher documents what is sent.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:173

Finding

Unnecessary Credential Environment Enumeration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 173–178
Vulnerability Type: Credential discovery through excessive system access
Risk Level: Medium

Vulnerable Code

bash

# 验证环境变量是否设置
echo "配置检查:"
env | grep -E "API|KEY|TOKEN|SECRET" | sed "s/=.*/=***/"  # Linux/macOS
# 或 PowerShell
# Get-ChildItem Env: | Where-Object {$_.Name -match "API|KEY|TOKEN"} | Format-Table

Technical Analysis

The Skill instructs the Agent to enumerate all environment variables whose names contain credential-related terms. This access is unnecessary for the stated diagram-generation functionality and violates least-privilege principles.

The Unix pipeline masks values before displaying them, but it still reveals the existence and names of potentially sensitive variables. Those names can disclose configured services, authentication mechanisms, infrastructure providers, and security tooling.

The PowerShell alternative is more dangerous because Get-ChildItem Env: returns both variable names and values. Filtering the resulting objects by name and sending them to Format-Table can display plaintext API keys and tokens. Because the Skill declares exec access, an Agent following these instructions may place the output into terminal logs, model context, transcripts, or other execution records.

The reviewed file does not contain instructions to transmit discovered credentials to a remote party. The confirmed issue is unnecessary credential reconnaissance and potential local disclosure rather than confirmed exfiltration.

Attack Path

1. A user installs or invokes the Skill for diagram generation.
2. The user or Agent follows the environment-validation instructions in SKILL.md.
3. The Agent executes the Unix or PowerShell environment-enumeration command with the current process privileges.
4. The command searches the entire inherited environment for names associated with API keys, tokens, or secrets.
5. On Unix, sensitive variable names are discl ...[truncated 1156 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove broad environment enumeration from the setup and validation instructions.

2. Validate only the explicitly required variable by its exact name, without printing its value. For example:

   bash

   if [ -n "${REQUIRED_API_KEY:-}" ]; then
     printf '%s\n' "REQUIRED_API_KEY is configured"
   else
     printf '%s\n' "REQUIRED_API_KEY is not configured"
   fi
   

3. Use an equivalent presence-only check in PowerShell:

   powershell

   if ($null -ne $env:REQUIRED_API_KEY -and $env:REQUIRED_API_KEY.Length -gt 0) {
       Write-Output "REQUIRED_API_KEY is configured"
   } else {
       Write-Output "REQUIRED_API_KEY is not configured"
   }
   

4. Never pass secret values into Agent prompts, command output, logs, error messages, or conversation history.

5. Document the exact credentials needed by each optional external integration rather than searching for generic terms such as API, KEY, TOKEN, or SECRET.

6. Reassess whether exec permission is required for ordinary Mermaid text generation. Remove it or restrict execution to narrowly defined rendering commands where the host platform supports tool-level allowlisting.

7. Add output redaction as defense in depth, but do not treat redaction as a substitute for avoiding unnecessary secret access.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description explicitly states '支持中文交互' while presenting the skill as generally applicable across users and teams, but it does not offer language selection or indicate that Chinese is optional. This creates a language-policy concern because it imposes a locale expectation without user opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition is broad enough that the skill may activate for generic requests involving analysis, reporting, or visualization, even when the user's intent does not clearly require this tool. In an agent environment with exec privileges, overbroad invocation increases the chance of unnecessary tool use, unintended command execution paths, or accidental handling of sensitive user data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document makes a strong privacy assurance that all data stays local and is never uploaded, while elsewhere stating that some features require external API access and API key configuration. This inconsistency can mislead users into exposing sensitive diagram content or credentials under false assumptions about data handling, which is a real security and trust issue for a tool-enabled agent skill.

Content

No source excerpt is available for this finding.