Elegant One Pager Architect

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:25 PM UTC
• Version: 0.1.1

Overview

This skill is a single Markdown prompt that turns user-provided meeting or communication notes into a styled HTML summary, with no evidence of hidden execution, persistence, credential use, or data exfiltration.

Install only if you want a Chinese-oriented HTML one-page report generator. Treat generated HTML as untrusted when source notes may contain markup, and sanitize or escape user-derived content before rendering it in a browser or publishing it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25

Finding

Unescaped User-Controlled Content Inserted into Generated HTML

Content

View full analysis

` 容器。 - 如果仅缺失其中一个，删除缺失项对应的子 `

`，并保持保留项的 `flex: 1` 属性以占满整行。 **HTML 输出模板（现代色彩渐变版）：** ```html

[提取的核心主题]

相关方：[提取的干系人/系统] | 时间：[当前日期或事件日期]

``` ``` Other affected interpolation sinks include: ```html

[用 2-3 句话客观总结沟通的最终定论或当前状态]

[量化点 1]

[节点 1及状态]

[使用无序列表或带序号的列表，客观描述决策过程、技术方案或业务链路]

[动作/风险1]：[具体描述与责任边界]

``` ### Technical Analysis The skill directs the agent to extract information from user-provided communications and interpolate the extracted values directly into an HTML template. It does not require HTML entity encoding, context-aware output escaping, or sanitization with a strict allowlist. The skill's “langu ...[truncated 2256 chars]

Remediation

View remediation

`, `"`, and `'`. 2. State explicitly that stylistic language cleanup is not a substitute for HTML sanitization. 3. Treat extracted topics, stakeholders, dates, conclusions, metrics, milestones, process descriptions, risks, and actions as untrusted text. 4. Prefer inserting extracted values as text nodes through a trusted templating or DOM API rather than constructing raw HTML strings. 5. If limited rich-text formatting is required, process it with a maintained HTML sanitizer configured with a strict allowlist. 6. Reject or remove script elements, event-handler attributes, `javascript:` URLs, iframes, active embeds, SVG, MathML, form controls, and unsafe CSS or URL-bearing attributes. 7. Apply a restrictive Content Security Policy in the downstream renderer as defense in depth, particularly by disallowing inline scripts and restricting resource origins. 8. Add adversarial tests using closing tags, event handlers, encoded markup, malformed elements, SVG payloads, and dangerous URL schemes to verify that generated reports render only inert text. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description and operating instructions are written to require a Chinese-language workflow, including specific Chinese output conventions, without any opt-in or alternative language handling. This is a natural-language locale policy concern because the skill appears to impose a language choice rather than letting the user select it or explaining a region-specific need.

Content

No source excerpt is available for this finding.