Security audit

HTML编码工具-专业版

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly an HTML development helper, but it requests broad command, file-write, and external-service authority without enough concrete boundaries.

Review this before installing. Use it only in a constrained project workspace, require confirmation before shell commands or outbound service calls, and do not rely on its WCAG example as proof of full accessibility compliance.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill is presented as an HTML coding tool, but it also advertises generic external API integration capability without tightly scoping that capability to HTML-specific workflows. This broadens the trust boundary and can enable unintended data exfiltration or interaction with arbitrary remote services if an agent invokes the skill based on its broad claims.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill claims generic system command execution despite being framed as an HTML development tool. Unscoped exec capability materially increases risk because prompts related to routine web development could be routed to a skill that can run shell commands, creating a pathway to arbitrary command execution, file tampering, or environment inspection.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The example presents `check_full_compliance` as a comprehensive WCAG validator, but at least some referenced checks are placeholders that always return no issues. This can create a false sense of accessibility compliance, causing developers or downstream agents to ship inaccessible HTML while believing it has been fully validated.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger conditions are overly broad, covering general coding assistance, debugging, testing, and deployment scenarios. This increases the chance the skill will be invoked for unrelated or higher-risk tasks, which is especially dangerous here because the skill also declares write, exec, and API-integration capabilities.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation advertises file writing, external service access, and command execution but does not provide strong, prominent user-facing risk disclosures or operational guardrails. In practice, this can mislead users and routing systems into treating the skill as a normal content-generation tool while it possesses materially more dangerous side-effecting capabilities.

Static analysis

No suspicious patterns detected.