Lan Knowledge Share

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:34 AM UTC
• Version: 1.0.12

Overview

This is a disclosed LAN file-sharing skill, but it can expose files outside the selected folder through symlinks and renders shared active content with weak isolation.

Install only after reviewing the exposure model carefully. Use a narrow folder containing only files intended for LAN sharing, remove or avoid symlinks, do not share repositories/home directories/credential folders, and only preview Markdown or HTML files from trusted contributors until symlink containment and preview sandboxing are fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/deploy.js:416

Finding

Symbolic Link Traversal Can Expose Files Outside the Shared Directory

Content

View full analysis

{ if (!res.headersSent) res.writeHead(500); res.end('Internal Server Error'); }); stream.pipe(res); ``` ### Technical Analysis `safeJoin` provides only lexical traversal protection. It normalizes the requested path and verifies that the resulting string begins with the configured root directory. This blocks conventional `../` traversal, but it does not verify where the path resolves on the filesystem. `fs.statSync` and `fs.createReadStream` follow symbolic links. Consequently, a path can lexically remain under the shared directory while re ...[truncated 1999 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/runtime/assets/js/doc-inline.js:151

Finding

Shared Markdown and HTML Files Are Rendered as Untrusted Active Same-Origin Content

Content

View full analysis

' + esc(doc.body) + ''; } catch (e) { html = '

text

' + esc(doc.body) + '

'; } container.innerHTML = html; ``` HTML reports are placed in a same-origin iframe without a `sandbox` attribute: ```js var fr = el('iframe', 'kb-html-frame'); fr.src = info.fileUrl; page.appendChild(fr); ``` ### Technical Analysis The Markdown rendering path accepts raw document content, converts it with Marked, and assigns the resulting HTML to `innerHTML`. No maintained HTML sanitizer or restrictive element-and-attribute allowlist is applied. While script elements inserted through `innerHTML` are not consistently executed, active HTML such as event-handler attributes, malicious links, embedded resources, and other browser-supported injection vectors may execute or trigger unsafe behavior. The HTML preview path creates an iframe without `sandbox`. The HTML file is served by the same HTTP origin as the parent application, so scripts inside the report execute as same-origin content. Such content can access and modify the parent page, invoke same-origin APIs, request other files exposed by the server, and initiate outbound browser requests. The application does not apply a restrictive Content Security Policy that would otherwise limit inline scripts, event handlers, frames, or outbound connections. HTML report functionality may require some active behavior, but unrestricted same-origin ...[truncated 1871 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md

| `docsify.min.js` | docsify | 4.13.1 | MIT | SPA 路由与文档渲染 |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

| `mammoth.browser.min.js` | mammoth.js | bundle | BSD-2-Clause | docx → HTML 预览 |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md

| `xlsx.full.min.js` | SheetJS (Community Edition) | 0.18.5 | Apache-2.0 | xlsx/xls/csv 解析与搜索 |

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · assets/runtime/assets/vendor/mammoth.browser.min.js (reported line 5)May include surrounding context.

js

",gamma:"γ",delta:"δ",epsilon:"ε",zeta:"ζ",eta:"η",theta:"θ",iota:"ι",kappa:"κ",lambda:"λ",mu:"μ",nu:"ν",xi:"ξ",omicron:"ο",pi:"π",rho:"ρ",sigmaf:"ς",sigma:"σ",tau:"τ",upsilon:"υ",phi:"φ",chi:"χ",psi:"ψ",omega:"ω",thetasym:"ϑ",upsih:"ϒ",piv:"ϖ",OElig:"Œ",oelig:"œ",Scaron:"Š",scaron:"š",Yuml:"Ÿ",fnof:"ƒ",
circ:"ˆ",tilde:"˜",ensp:" ",emsp:" ",thinsp:" ",zwnj:"‌",zwj:"‍",lrm:"‎",rlm:"‏",ndash:"–",mdash:"—",lsquo:"‘",rsquo:"’",sbquo:"‚",ldquo:"“",rdquo:"”",bdquo:"„",dagger:"†",Dagger:"‡",bull:"•",hellip:"…",permil:"‰",prime:"′",Prime:"″",lsaquo:"‹",rsaquo:"›",oline:"‾",euro:"€",trade:"™",larr:"←",uarr:"↑",rarr:"→",darr:"↓",harr:"↔",crarr:"↵",lceil:"⌈",rceil:"⌉",lfloor:"⌊",rfloor:"⌋",loz:"◊",spades:"♠",clubs:"♣",hearts:"♥",diams:"♦"}),exports.entityMap=exports.HTML_ENTITIES},{"./conventions":41}],45:[function(require,module,exports){var dom=require("./dom");exports.DOMImplem

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · assets/runtime/assets/vendor/xlsx.full.min.js (reported line 6)May include surrounding context.

js

פץצקרשת��‎‏�",r=[],t={};for(var a=0;a!=e.length;++a){if(e.charCodeAt(a)!==65533)t[e.charAt(a)]=a;r[a]=e.charAt(a)}return{enc:t,dec:r}}();cptable[1256]=function(){var e="\0\b\t\n\x0B\f\r !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~€پ‚ƒ„…†‡ˆ‰ٹ‹Œچژڈگ‘’“”•–—ک™ڑ›œ‌‍ں ،¢£¤¥¦§¨©ھ«¬­®¯°±²³´µ¶·¸¹؛»¼½¾؟ہءآأؤإئابةتثجحخدذرزسشصض×طظعغـفقكàلâمنهوçèéêëىيîïًٌٍَôُِ÷ّùْûü‎‏ے",r=[],t={};for(var a=0;a!=e.length;++a){if(e.charCodeAt(a)!==65533)t[e.charAt(a)]=a;r[a]=e.charAt(a)}return{enc:t,dec:r}}();cptable[1257]=function(){var e="\0\b\t\n\x0B\f\r !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~€�‚�„…†‡�‰�‹�¨ˇ¸�‘’“”•–—�™�›�¯˛� �¢£¤

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/runtime/index.html (reported line 2)May include surrounding context.

html

<!DOCTYPE html>
<!-- Locale: zh-CN — Chinese-first UI for "Lan Folder Share", a LAN knowledge-base
     tool built for Chinese-speaking users (language constraint documented in
     SKILL.md metadata: locale=zh-CN). 语言声明：面向中文用户，界面默认中文。 -->
<html lang="zh-CN">

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The header comment states the file is intended for Chinese-speaking users and that comments default to Chinese. Because SQP-3 applies to all file types and covers language or locale policy violations, this is a potential forced-locale constraint unless the broader skill offers user choice or a clearly justified regional limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The header comment states the file is for Chinese-speaking users and that comments default to Chinese, explicitly declaring locale zh-CN. The policy allows locale constraints only when clearly documented and justified; while this appears justified by the product description, the file itself still enforces a specific locale without offering user choice, so this is a low-severity policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The code automatically performs fetch requests for linked .xlsx/.xls/.csv/.tsv files and parses their contents in the browser. While the header comments describe the behavior for developers, there is no user-facing notice, confirmation, or runtime disclosure before these network/file-loading operations occur when links are auto-expanded.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The document title is presented bilingually with Chinese first, and substantial sections throughout the file are written in Chinese alongside English. This can be a natural-language locale policy concern because the file assumes a specific language presentation without explicitly offering user language preference or stating that the skill is intended for a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This bundled browser library reads DOCX contents and can follow linked image relationships via files.read/ZIP reads and XML parsing, which may access external or embedded resources as part of conversion, but the minified code provides no user-facing prompt, warning, or explanatory comment because it is a code-only vendor asset. For code files, the audit rule flags safety-relevant operations when there is no visible disclosure in code, and this file contains no such disclosure.

Content

No source excerpt is available for this finding.