Security audit

HTML 工具箱

Security checks for vulnerabilities and agentic risk

Overview

This HTML helper is mostly ordinary documentation, but it asks for broad read/write/command access and has mismatched communication-related triggers that could activate it outside its stated purpose.

Review this before installing. It does not show malicious payloads or hidden exfiltration, but you should only use it in a controlled project workspace, require confirmation before edits or commands, and avoid letting the communication-related trigger text invoke it for email, SMS, notification, or messaging tasks.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill claims the free version does not support site-wide auditing, yet it exposes unrestricted read/exec/write tooling that could still enable broad repository-wide inspection or modification workflows through the agent. This mismatch weakens user expectations and can lead to unintended large-scope file access or edits beyond the documented feature set.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: An HTML quality-check skill does not appear to need arbitrary command execution, yet the skill advertises exec capability without justification or restriction. In an agent environment, exec can be abused to run shell commands, access sensitive local data, or perform unintended system actions if the skill is invoked on untrusted input.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is presented as a self-check and error-avoidance assistant, but its documented operations include create/modify/delete/import/export/save behaviors. That expansion from advisory analysis to state-changing actions increases risk because users may invoke a seemingly harmless review skill that can actually alter files or workflows.

Vague Triggers

High

Confidence: 95% confidence
Finding: The trigger condition references message sending, notification pushing, email/SMS, and communication integration, which is inconsistent with an HTML linting/accessibility skill. Overbroad and unrelated triggers increase the chance of accidental invocation in unrelated contexts, causing the agent to expose write/exec capabilities where they are not expected.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill advertises write/exec and save/modify/export operations without clearly warning users that files or the local environment may be changed. In agent systems, missing change warnings reduce informed consent and make risky actions easier to trigger unintentionally.

Static analysis

No suspicious patterns detected.