Web Dev Toolkit Free

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.0.0

Overview

This is a plain Markdown web-development helper with some command-use cautions, but no hidden payload, persistence, or deceptive behavior was found.

Install only if you want a Chinese-language web-development helper and are comfortable granting it code-editing and command-running capability. Review shell commands before running them, keep deployment tokens out of chat and client-side environment variables, and use localhost-only temporary servers for local previews.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:204

Finding

Local Development Server Exposes Files on All Network Interfaces

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:204
Vulnerability Type: Unrestricted network binding and unintended file disclosure
Risk Level: Medium

Vulnerable Code Snippet:

bash

python3 -m http.server 8000

Technical Analysis

Python's built-in http.server binds to all available network interfaces by default. It serves files from the current working directory and ordinarily provides directory listings when no index file is present.

If a user runs this instruction from a repository root or another directory containing source code, configuration files, build artifacts, backups, or accidentally stored credentials, those files may become accessible through TCP port 8000. Exposure depends on host firewall rules, container or virtual-machine networking, router configuration, and whether an attacker can reach the host.

The command does not itself provide arbitrary code execution or elevate privileges. An attacker can only access files exposed beneath the selected serving directory and readable by the server process.

Attack Path

1. A user follows the documented local-validation instruction from a project directory.
2. python3 -m http.server 8000 starts an unauthenticated server listening on all network interfaces.
3. The host permits inbound access to TCP port 8000 from another system.
4. An attacker discovers the service by network scanning, local network observation, or knowledge of the host address.
5. The attacker requests / and uses generated directory listings to enumerate accessible files.
6. The attacker downloads exposed source code, configuration files, backups, or other content under the served directory.

Impact Assessment

A reachable attacker may obtain unauthenticated read access to files beneath the directory from which the command was started. Potential consequences include source-code disclosure, exposure of application configuration, leakage of credentials acc ...[truncated 331 chars]

Remediation

View remediation

Remediation Suggestions

Bind the server explicitly to the loopback interface and serve only a dedicated directory containing public development assets:

bash

python3 -m http.server 8000 --bind 127.0.0.1 --directory ./public

Apply the following additional hardening measures:

1. Instruct users never to serve a repository root, home directory, or directory containing secrets.
2. Ensure the selected public directory excludes environment files, credentials, source maps containing sensitive source content, backups, and private configuration.
3. Document that http.server is intended only for temporary local development and does not provide authentication, TLS, or production-grade security.
4. Require firewall restrictions if access from another development device is necessary.
5. Stop the server immediately after validation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

<html lang="zh-CN">
<head>
  <meta charset="UTF-8">
  <!-- 关键:viewport meta -->
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>响应式页面</title>
  <style>

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises exec-enabled behavior and deployment-related command use without a clear warning or approval model for system-impacting operations. In an agent environment, this can normalize command execution during common support tasks, increasing the risk of unintended local changes, network access, or credential exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill claims it works without extra scripts or API keys, but elsewhere enables exec usage and references deployment platform tokens. This mismatch can mislead users and host agents about the actual trust boundary, causing them to invoke command execution or handle credentials under a false assumption of low risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The document says the skill is not suitable for operations or deployment management, yet it also provides deployment workflows and mentions platform access tokens. Contradictory scope statements can bypass user caution and policy gating by presenting potentially sensitive operational actions as out-of-scope while still encouraging them.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger conditions are broad enough to match many ordinary development requests, increasing the chance the skill activates in contexts beyond its narrowly described purpose. Overbroad routing is dangerous when the skill has write and exec tools, because routine prompts may unnecessarily escalate into file modification or command execution paths.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The display name, summary, description, and the entire user-facing documentation are written in Chinese, with no indication that users may choose another language. This appears to impose a locale-specific experience without opt-in or justification as a region-specific tool.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.