iKuai 流量报表

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:54 AM UTC
• Version: 1.0.2

Overview

This skill appears intended to make an iKuai router report, but it exports sensitive network details in an unsafe local HTML report that needs review before installation.

Install only if you are comfortable granting the skill access to your iKuai CLI auth and exporting detailed router inventory, configuration, traffic, and logs. Treat the generated HTML as confidential, avoid sharing it, and prefer changing the output to a private user-owned location with redaction and HTML escaping before regular use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/template.html:848

Finding

DOM-based script injection through unescaped router-controlled data

Content

View full analysis

''+c.ip+''+(c.hostname||'—')+''+c.vendor+''+c.conn+'' ).join(''); document.getElementById('logContainer').innerHTML=logs.map(l=>{ const cls=l.s==='ok'?'log-ok':l.s==='warn'?'log-warn':'log-info'; const icon=l.s==='ok'?'✅':l.s==='warn'?'⚠️':'ℹ️'; return'

'+l.t+''+icon+''+l.c+'

'; }).join(''); document.getElementById('srcGrid').innerHTML=sources.map(s=> '

Remediation

View remediation

``` 5. Add regression tests containing hostile hostnames, application labels, and log messages to verify that payloads are displayed as text rather than interpreted as markup. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_report.py:13

Finding

Predictable temporary report path permits symlink overwrite and sensitive-data exposure

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: assets/template.html:523

Finding

Distributed template exposes detailed internal-network inventory

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill documentation instructs use of Python, shell commands, and writes an output file, but it does not declare any tool scope or permissions boundary. In an agent environment, undocumented shell/file capabilities increase the chance of over-broad execution and make it harder to review or sandbox the skill safely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill writes a router traffic report to /tmp/ikuai-report.html, a predictable shared temporary location that may be accessible to other local users or processes. Because the report contains network, device, and possibly security-log data, this creates a realistic local information disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill collects and embeds sensitive router information including online devices, internal IP/MAC data, ACLs, NAT/port forwarding, VPN-related status, and system logs into an HTML file without any explicit privacy or handling warning. In the context of a router administration skill, this materially increases the sensitivity of the output because the report can expose internal topology, security controls, and user/device metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The report immediately presents sensitive network and device information without any warning, consent, or disclosure that the generated artifact may contain confidential infrastructure details. In this skill context, the absence of a warning makes accidental sharing more likely, which amplifies the privacy and security risk of the exposed data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The template goes well beyond a traffic-only report and renders sensitive router configuration, management exposure, interface inventory, DHCP ranges, DNS settings, logs, and device inventory. In the context of a shareable HTML report, this unnecessarily broad disclosure materially increases the chance of credential targeting, network mapping, and follow-on compromise if the report is viewed by unintended parties.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The template displays sensitive operational data including a PPPoE username, internal hostnames, MAC addresses, WAN/LAN addressing, and whether web management is exposed on WAN. This information is highly useful for reconnaissance and account targeting, and its inclusion in a generated report creates an avoidable data-leak channel even without active exploitation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_report.py (reported line 20)May include surrounding context.

python

# ── check auth ────────────────────────────────────────────────
def check_auth():
    r = subprocess.run([CLI, "auth", "status"], capture_output=True, text=True)
    if r.returncode != 0:
        print(f"❌ ikuai-cli 执行失败: {r.stderr.strip()}")
        return False

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_report.py (reported line 37)May include surrounding context.

python

except Exception:
        pass
    # Fallback: try a simple API call to verify connectivity
    r2 = subprocess.run([CLI, "monitor", "system", "--format", "json"],
                        capture_output=True, text=True)
    if r2.returncode != 0 or not r2.stdout.strip():
        print("❌ ikuai-cli 连接失败，请检查 auth 配置")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_report.py (reported line 47)May include surrounding context.

python

# ── helpers ───────────────────────────────────────────────────

def run(args):
    r = subprocess.run(args, capture_output=True, text=True)
    try:
        j = json.loads(r.stdout)
        return j.get("results", j)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script aggregates sensitive router and client data and writes a browsable HTML report to /tmp without warning the user about confidentiality risks or controlling file permissions. On multi-user systems or environments where /tmp contents are exposed, this can leak internal IPs, hostnames, logs, and security configuration to unintended parties.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill claims to generate a traffic report, but it also collects and embeds broader network and security configuration data such as WAN/LAN details, DNS settings, ACLs, QoS, system logs, and DNAT rules. This expands data exposure well beyond user-expected scope and can leak sensitive internal topology and security posture if the report is viewed, shared, or read by other local processes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

L008 says the generated report has no external dependencies and can be opened directly in a browser, which implies a self-contained artifact. However, L105 explicitly says the report uses 'Chart.js（CDN）', meaning the HTML depends on fetching a remote script and is not actually free of external runtime dependencies.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document sets the page language to Chinese via lang="zh", and the interface text and timestamp formatting are hard-coded to Chinese throughout the file. This creates a locale-specific experience without any visible opt-in or alternative language selection.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The report includes a sources section that exposes the exact commands run and snippets of their JSON output, which is not necessary for a normal end-user traffic report. Even truncated output can disclose internal identifiers, configuration structure, and monitoring capabilities that increase information leakage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.