TS编码规范工具(免费版)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:27 AM UTC
• Version: 1.0.1

Overview

This TypeScript style skill is not malicious, but it asks for command and file-write authority while giving broad auto-trigger and file-changing tool instructions without enough scoping or warnings.

Install only if you are comfortable with the agent having local read, command execution, and file-write authority for TypeScript projects. Require explicit confirmation before running npm, npx, or eslint --fix, prefer pinned dependencies and lockfiles, and run read-only checks before allowing automatic fixes. I found no evidence of hidden persistence, credential theft, or data exfiltration.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:184

Finding

Unpinned npm Dependencies and Implicit Package Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 184-185 and 264-266
Vulnerability Type: Unpinned third-party dependencies and unsafe npx execution
Risk Level: Medium

Vulnerable Code

Lines 184-185:

bash

npx tsc --noEmit
npx eslint . --fix

Lines 264-266:

markdown

| TypeScript | npm package | Recommended | `npm i -D typescript` |
| ESLint + @typescript-eslint | npm package | Optional | `npm i -D eslint @typescript-eslint/eslint-plugin` |
| Prettier | npm package | Optional | `npm i -D prettier` |

Technical Analysis

The recommended installation commands do not specify reviewed package versions or require installation from a lockfile. Consequently, package resolution may select mutable versions from the configured npm registry.

The npx commands introduce an additional execution risk. If the expected executable is not available locally, npx may offer to download and execute a registry package. In particular, invoking a short binary name without first guaranteeing the presence of the reviewed local dependency can resolve and execute unintended package code.

npm packages can execute code through lifecycle scripts during installation, while binaries invoked by npx execute with the permissions of the current user or agent. A compromised registry account, unsafe registry configuration, dependency-confusion condition, or incorrectly resolved package could therefore turn the documented validation procedure into arbitrary local code execution.

The command npx eslint . --fix also performs source-tree modifications. Although this is normal ESLint functionality, presenting it as a validation step can cause unreviewed file changes and increases the impact of a compromised or unexpectedly configured linter or plugin.

Attack Path

1. A user or AI agent follows the skill's setup or validation instructions.
2. The unversioned npm i commands resolve currently published ...[truncated 1300 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin all direct development dependencies to reviewed versions rather than resolving mutable latest releases.
2. Commit and review a package lockfile, and require reproducible installation with:

   bash

   npm ci --ignore-scripts
   

   If lifecycle scripts are genuinely required, review them before enabling scripts in a controlled environment.
3. Guarantee that TypeScript and ESLint are installed locally before validation. Invoke their reviewed local binaries directly:

   bash

   ./node_modules/.bin/tsc --noEmit
   ./node_modules/.bin/eslint .
   

4. If npx must be retained, use a mode that refuses package download, such as npx --no-install, where supported by the installed npm version.
5. Separate read-only validation from file mutation. Use eslint . for the default audit and require explicit user approval before running:

   bash

   ./node_modules/.bin/eslint . --fix
   

6. Use a trusted npm registry, enforce lockfile integrity checks, and consider dependency allowlisting, provenance verification, and automated supply-chain scanning.
7. Run package installation and developer tools in a least-privileged, network-restricted container or sandbox without unnecessary credentials.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The auto-activation language says the tool activates whenever TypeScript-related topics are mentioned, creating an overly broad invocation boundary. In an agent environment, broad triggers can cause the skill to run unexpectedly in unrelated contexts, especially dangerous because the manifest also grants exec and write capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition includes generic tasks like code generation, programming assistance, debugging, testing, and deployment, which are far broader than a TypeScript coding-conventions skill should claim. Such ambiguity increases the chance of unintended privileged activation and scope creep into workflows where the user did not expect this skill to participate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The display name, summary, and nearly all instructional content are presented in Chinese, and no option is provided for users to choose another language. For a general-purpose TypeScript guidance skill, this creates an implicit language constraint without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Declaring exec and write for a coding-standards guidance skill gives it capabilities that are not necessary for its stated purpose. Excess capabilities enlarge the attack surface: if the skill is auto-invoked or misused, it could run shell commands or alter local files under the guise of style assistance.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a TypeScript style-guidance tool, but its documented operations include create/modify/export/save/import behaviors that exceed passive guidance. This mismatch can mislead users and the hosting agent into granting or exercising broader capabilities than expected, increasing the risk of unintended file or configuration changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill describes modify/reset/import/export/save-style operations without warning that these may change files or configuration. Users may reasonably assume a guidance tool is read-only, so undocumented mutation behavior can lead to accidental changes, configuration corruption, or unsafe imports.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises shell-based validation commands but does not clearly warn that commands will run on the user's local system and may modify files (eslint --fix). In agent settings, omission of execution and side-effect warnings can cause users to approve actions they do not fully understand.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The '不适用场景' section explicitly excludes 运维部署管理, indicating operational/network administration is outside the skill's purpose. Yet the error-handling section tells the user to execute ping and inspect firewall/proxy connectivity, which is operational troubleshooting and contradicts the stated non-applicability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.