印迹工作室(免费版)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:40 AM UTC
• Version: 1.0.0

Overview

This looks like a real Print Studio API helper, but it gives agents broad triggers plus account-changing web requests and API-key handling that should be reviewed before use.

Install only if you intend to let an agent interact with Print Studio on your behalf. Require explicit confirmation before registration, deletion, task posting, accepting offers, completing/reviewing work, protocol registration, key reset, or NFT verification. Store the API key in a secret store or environment variable, do not commit it, and pin/review any optional ethers.js dependency before installing it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:303

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:303
Vulnerability Type: Unpinned npm dependency
Risk Level: Medium

Vulnerable Code Snippet

markdown

| ethers.js | JS library | Optional (required for on-chain verification) | `npm install ethers` |

Technical Analysis

The skill instructs the agent to install ethers without specifying an exact version, lockfile, or package integrity value. Consequently, npm resolves the package version available through the configured registry at installation time rather than a dependency artifact that was reviewed alongside the skill.

This creates a supply-chain risk because the effective code can change after the skill has been audited. If the package, one of its transitive dependencies, a maintainer account, or the configured npm registry is compromised, the installation may introduce malicious code. npm lifecycle scripts may also execute during installation unless explicitly disabled.

This finding does not establish that the legitimate ethers package is malicious. The vulnerability is the mutable and insufficiently verified dependency installation procedure.

Attack Path

1. A user asks the agent to perform the documented on-chain verification workflow.
2. The agent determines that the optional ethers.js dependency is required.
3. Following SKILL.md, the agent executes npm install ethers.
4. npm resolves the current package and transitive dependency versions from its configured registry.
5. If the resolved package, dependency, maintainer account, or registry response has been compromised, attacker-controlled package content is downloaded.
6. Malicious lifecycle scripts may execute during installation, or malicious library code may execute when the verification workflow imports and uses the package.

Impact Assessment

Exploited dependency code would execute with the privileges of the user running the agent or npm command. Depending on t ...[truncated 466 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin ethers to an audited exact version rather than relying on the registry's current release:

   bash

   npm install --save-exact ethers@<audited-version>
   

2. Commit a reviewed package.json and lockfile containing dependency versions and integrity metadata.
3. Use npm ci in automated environments to enforce the lockfile rather than dynamically resolving versions.
4. Review transitive dependencies and run a dependency vulnerability scan before release.
5. Disable lifecycle scripts during installation where the workflow permits:

   bash

   npm ci --ignore-scripts
   

6. Use a trusted registry and restrict or verify registry configuration to reduce dependency-confusion and registry-spoofing risks.
7. Perform installation and blockchain operations in a sandbox or container with minimal filesystem access, no unnecessary credentials, and restricted network permissions.
8. Document the exact reviewed version and an update process requiring security review before changing it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger scope is extremely broad and includes generic workflow language, making unintended activation more likely in unrelated contexts. In an MD+EXEC skill that can drive HTTP requests and credentialed actions, overbroad activation materially raises the risk of accidental external calls, task creation, registration, or other side effects without clear user intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The document claims tasks are mediated through the platform to avoid direct agent exposure, but it also exposes a protocol registration endpoint that could enable direct communications or broaden the attack surface. This inconsistency can mislead users about the trust boundary and may cause them to disclose capabilities or endpoints under a false assumption of mediation-only operation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

独立开发者开发了一个代码评审Agent，希望让其他Agent能够发现自己并协作：

bash

curl -X POST https://print-studio.io/v3/agents \
  -H "Content-Type: application/json" \
  -d '{
    "agent_card": "0.2",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs users to save an API key for future authenticated operations, but the surrounding guidance does not clearly foreground the sensitivity of that secret at the point of issuance. In a skill that supports exec and external HTTP use, weak secret-handling guidance increases the risk of credential leakage, reuse in unsafe contexts, or accidental logging.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is presented as a free edition limited to basic registration, search, and task collaboration, yet the documented command set includes destructive and higher-risk operations such as agent deletion, key reset references, and protocol registration. This mismatch can cause users or downstream agents to invoke sensitive operations they would not reasonably expect from the declared scope, increasing the chance of accidental destructive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The local configuration example stores an API key in plain JSON without an adjacent warning about file permissions, secret management, or exclusion from source control. This can directly lead to credential compromise through repo commits, shared workspaces, backups, or other local disclosure paths.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The phrase "全中文文档重写" indicates the skill content is intentionally constrained to Chinese, but the file does not offer users a language option or explain that the skill is region- or locale-specific. This can conflict with language/locale policy expectations when no user opt-in is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.