Security audit

HTML编码工具

Security checks for vulnerabilities and agentic risk

Overview

This HTML coding skill is not overtly harmful, but it asks for broad coding, file, API, deployment, and command-execution authority that is not tightly scoped to HTML work.

Install only if you are comfortable with a coding skill that may read and write project files and run commands. Keep use limited to HTML/front-end tasks, review any command or deployment action before it runs, and avoid providing API keys unless you know exactly which service will receive them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is presented as an HTML coding tool, but the documentation and declared capabilities expand into file handling, external API use, and system command execution. This scope drift increases the chance that an agent will invoke the skill for broader tasks than users expect, potentially enabling filesystem or command-side effects unrelated to HTML generation.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill claims CI/CD integration, dependency defect detection, and batch code review features that materially exceed a narrowly scoped HTML coding assistant. Overbroad claims can cause an agent or user to trust the skill with security-sensitive development workflows it is not clearly designed to handle safely.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: System command execution is a high-risk capability that is not justified by the stated HTML-coding use case. In this context, exposing exec broadens the attack surface significantly because prompts or downstream workflows could induce shell execution, causing unintended filesystem changes, data access, or arbitrary code execution.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The invocation guidance is broad enough to match generic coding, debugging, testing, and deployment requests rather than HTML-specific work. That increases the chance of over-invocation, where the skill is selected for higher-risk software tasks outside its stated competency and expected safety boundary.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The markdown advertises file writing, command execution, and external API use but does not clearly warn users about possible system modifications, network egress, or data handling consequences. In an agent context, missing safety disclosures can lead to unsafe assumptions and unreviewed side effects during normal use.

Static analysis

No suspicious patterns detected.