思维导图生成（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.3

Overview

This mind-map skill is not clearly malicious, but it asks for broad local read/write/command authority and includes under-explained outbound callback and dependency-installation instructions for a simple generation task.

Install only if you are comfortable giving the skill local file and command-execution capability. Use it in a limited workspace, avoid automatic dependency installation, review any callback URL before sending content externally, and prefer plain Markdown generation unless you explicitly need local rendering.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:133

Finding

Unpinned Python Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 133
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

bash

pip install requests

Technical Analysis

The skill instructs the agent to install requests without specifying an exact version, validating package hashes, using a lockfile, or restricting resolution to an approved package source. The documented mind-map example does not use this library, so the dependency also unnecessarily increases the supply-chain attack surface.

Package resolution is therefore affected by the registry state and available releases at installation time. If a malicious or compromised release or transitive dependency is selected, package build or installation behavior could run attacker-controlled code. The audit did not identify evidence that the current requests package is malicious; the issue is the unsafe and unnecessary dependency-installation practice.

Attack Path

1. A user or AI agent follows the environment-preparation instructions.
2. The agent executes pip install requests using its configured Python package index.
3. Pip resolves an unpinned release and its transitive dependencies.
4. If the selected artifact, dependency, package source, or source-build process has been compromised, attacker-controlled code may run during installation or subsequent import.
5. That code executes within the permissions and environment of the user running the skill.

Impact Assessment

Exploitation could allow code execution with the privileges of the account running pip. Depending on that account's access, exposed resources could include project files, user-readable configuration, environment variables, credentials available to the process, and writable local files. The issue does not independently provide administrative privileges or persistence.

Remediation

View remediation

Remediation Suggestions

• Remove the requests installation instruction because it is not used by the documented workflow.
• If the dependency becomes necessary, pin it to a reviewed exact version.
• Use a lockfile or requirements file with cryptographic hashes, such as pip's --require-hashes mode.
• Configure an approved package index and disable untrusted extra indexes.
• Review and pin all transitive dependencies.
• Install dependencies in an isolated, least-privileged virtual environment.
• Prefer pre-reviewed binary artifacts where appropriate and prevent unexpected source builds in automated environments.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:234

Finding

Unpinned Markmap CLI Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 234
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

text

| markmap | npm package | Optional | npm install markmap-cli |

Technical Analysis

The skill recommends installing markmap-cli without an exact version, lockfile, integrity verification, or package-source restriction. Consequently, npm may install a different package version and dependency graph at different times.

npm packages can define lifecycle scripts that run during installation. If the package, one of its transitive dependencies, or the configured registry is compromised, installation may execute attacker-controlled code. The audit did not establish that the current markmap-cli package is malicious; the identified risk arises from unpinned and insufficiently verified dependency resolution.

Attack Path

1. A user or AI agent chooses the optional Markmap rendering capability.
2. The agent executes npm install markmap-cli.
3. Npm resolves the latest matching release and its transitive dependencies from the configured registry.
4. A compromised selected package or dependency executes malicious lifecycle logic during installation, or malicious code runs when the installed CLI is invoked.
5. The payload operates with the permissions of the user who executed npm or the CLI.

Impact Assessment

Successful exploitation could provide local code execution under the invoking user's privileges. It could expose files, environment variables, project data, and credentials available to that process, and could modify files writable by the account. This instruction does not by itself grant elevated system privileges.

Remediation

View remediation

Remediation Suggestions

• Pin markmap-cli to a reviewed exact version rather than resolving the latest release.
• Commit and enforce a lockfile with verified integrity metadata.
• Use only approved npm registries and avoid untrusted registry overrides.
• Audit the package's dependency tree and lifecycle scripts before approval.
• Consider installation with lifecycle scripts disabled when compatible with the package.
• Run rendering inside an isolated, least-privileged environment with minimal filesystem and credential access.
• Avoid granting the skill general exec access when Markdown generation alone satisfies the requested task.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises read, exec, and write capabilities but does not warn users that activation may modify files or run local commands. Because the skill's described purpose is simple mindmap generation, exposing powerful system capabilities without explicit consent language creates a mismatch that can lead to unsafe execution in response to routine prompts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example invocations are generic natural-language requests like '生成关于机器学习的思维导图' and '把这篇文档转为思维导图', which closely overlap with ordinary user intent rather than clearly scoped skill activation. In an agent platform, this can cause unintended auto-selection of a skill that has read/write/exec capabilities, increasing the chance of overbroad file access or command execution when a user only asked for content generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documented callback_url parameter enables outbound requests but provides no privacy or data-handling warning. This can expose user content, generated outputs, metadata, or internal network information to arbitrary remote endpoints if the skill or caller supplies an attacker-controlled URL.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.