Security audit

mp-groundline

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly fits its stated migration purpose, but its scanner can be steered to read files outside the selected project.

Install only if you trust the project being scanned and can review the generated MIGRATION-MAP before edits. Prefer a pinned commit or release, run it on a clean git tree, avoid sensitive live app sessions during vince-mp capture, and treat the miniprogramRoot containment issue as something to fix before using it on untrusted projects.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/scan.mjs:267
Finding: Unrestricted miniprogramRoot Allows Scanning Outside the Selected Project
Content: View full analysis
Vulnerability Details

File Location: scripts/scan.mjs:267-272
Vulnerability Type: Path traversal leading to unauthorized file reads
Risk Level: Medium

Vulnerable Code

js
if (json && typeof json.miniprogramRoot === "string" && json.miniprogramRoot.trim()) { miniprogramRoot = json.miniprogramRoot.replace(/^\.\//, ""); } const ign = json && json.packOptions && json.packOptions.ignore; if (Array.isArray(ign)) packIgnore = ign; } const mpAbs = path.resolve(absRoot, miniprogramRoot);

Technical Analysis

The scanner treats project.config.json as project-controlled input and uses its miniprogramRoot value to derive the directory it will inspect. Removing a leading ./ does not prevent either an absolute path or traversal sequences such as ../../.

path.resolve(absRoot, miniprogramRoot) normalizes such input but does not enforce that the result remains beneath absRoot. Later scanner operations use mpAbs to locate app.json, page configuration files, and recursively scanned .wxml, .wxss, .less, .js, .ts, and .wxs files.

Consequently, a project author can redirect the scanner outside the project directory selected by the user. Relevant source snippets and paths may subsequently appear in scanner JSON and the generated MIGRATION-MAP.md.

Attack Path

An attacker prepares a project containing a project.config.json with a value such as:

json
{ "miniprogramRoot": "../../other-project" }

The user or Agent invokes the documented scan against the attacker-controlled project:

bash
node scripts/scan.mjs <program-root>

The scanner resolves the configured value to a location outside the selected project root without checking containment.

If that external location contains a suitable app.json, the scanner reads its configuration and recursively examines supported source files.

Findings containing external file paths, line numbers, source snippet ...[truncated 865 chars]
Remediation: View remediation
Remediation Suggestions

Reject absolute miniprogramRoot values.

Resolve and canonicalize both the selected project root and candidate Mini Program root, including symlinks.

Require the canonical candidate to equal the canonical project root or remain beneath it:

js
const canonicalRoot = fs.realpathSync(absRoot); const candidate = path.resolve(canonicalRoot, miniprogramRoot); const canonicalCandidate = fs.realpathSync(candidate); if ( canonicalCandidate !== canonicalRoot && !canonicalCandidate.startsWith(canonicalRoot + path.sep) ) { return fail("miniprogramRoot escapes the selected project root"); } const mpAbs = canonicalCandidate;

Apply equivalent containment checks to configured ignore paths and any future project-controlled paths before filesystem access.

Add regression tests covering ../, nested traversal, absolute paths, and symlink-based escapes.

Return a structured blocker instead of following a path that falls outside the authorized project.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (25)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
node scripts/gen_migration_map.mjs <program-root> # or pipe the scan JSON

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
md
node scripts/gen_migration_map.mjs <program-root> # or pipe the scan JSON

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill metadata says it is not for live-runtime debugging, yet this file requires a live DevTools session and runtime automation through vince-mp/mp-cli-sup. That contradiction can mislead users and downstream policy controls, causing the skill to be invoked in environments where runtime access, app attachment, and interactive tooling were not expected or approved.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · scripts/scan.mjs (reported line 97)May include surrounding context.
js
try { // strip a leading UTF-8 BOM (WeChat-DevTools / Windows-saved JSON) before // parse — otherwise JSON.parse throws and a real file is wrongly "malformed". const raw = fs.readFileSync(file, "utf8").replace(/^/, ""); return { json: JSON.parse(raw), error: null }; } catch (e) { return { json: null, error: e.message };

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.en.md (reported line 19)May include surrounding context.
md
**Not for** — live runtime debugging (→ mp-cli-sup); DEVELOPING Skyline components / worklet animations / custom routes (→ skyline-* skills, opposite direction); webview→skyline reverse migration; perf-only optimization with no renderer change; modernizing / reverting a workaround unless explicitly asked; non-WeChat work. **Dependency & maintenance** — Step 4 verification needs the system `vince-mp` CLI (driven by `mp-cli-sup`); without DevTools or vince-mp the MIGRATION-MAP marks every page UNVERIFIED and never claims "consistent". The scanner measures page-level `renderer` pins against the `webview` target (a program that adopted Skyline page by page is a migration target) and skips the program's own `packOptions.ignore` folders, listing them in the map (a folder that holds a page app.json declares is still scanned). The local `validate-skill` checks skill structure and the synthetic harness only — it does not prove a real migration is consistent. **Measured results and known issues (0.2.3)** — E11 two-arm run on 0.1.2, 3 cases. In all 3 cases the judge preferred the arm with the skill. That arm made a smaller diff every time, kept `rendererOptions` and every workaround, and did not fix any delta it had not observed. The bare model, without the skill, made fixes like that in all 3 cases. The result shows a direction only: the judge knew which arm had the skill, and only tool calls were recorded, no tokens. The two P2 defects the 0.2.0 fix audit left open are fixed in 0.2.2: a declared page inside a `packOptions.ignore` folder is scanned, and for per-page Skyline adoption the default-layout advice names only the pinned pages. The independent audit of that fix round found no P0 or P1, and the release check passed (release_ok). The items still open are no worse than installed 0.1.1. A `wx://` route on the same line after a quote-bearing regex literal is missed (0.1.x has the same limit). A `packOptions.ignore` folder that holds one declared page is scanned in full, ...[truncated 25 chars]

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.en.md (reported line 20)May include surrounding context.
md
**Dependency & maintenance** — Step 4 verification needs the system `vince-mp` CLI (driven by `mp-cli-sup`); without DevTools or vince-mp the MIGRATION-MAP marks every page UNVERIFIED and never claims "consistent". The scanner measures page-level `renderer` pins against the `webview` target (a program that adopted Skyline page by page is a migration target) and skips the program's own `packOptions.ignore` folders, listing them in the map (a folder that holds a page app.json declares is still scanned). The local `validate-skill` checks skill structure and the synthetic harness only — it does not prove a real migration is consistent. **Measured results and known issues (0.2.3)** — E11 two-arm run on 0.1.2, 3 cases. In all 3 cases the judge preferred the arm with the skill. That arm made a smaller diff every time, kept `rendererOptions` and every workaround, and did not fix any delta it had not observed. The bare model, without the skill, made fixes like that in all 3 cases. The result shows a direction only: the judge knew which arm had the skill, and only tool calls were recorded, no tokens. The two P2 defects the 0.2.0 fix audit left open are fixed in 0.2.2: a declared page inside a `packOptions.ignore` folder is scanned, and for per-page Skyline adoption the default-layout advice names only the pinned pages. The independent audit of that fix round found no P0 or P1, and the release check passed (release_ok). The items still open are no worse than installed 0.1.1. A `wx://` route on the same line after a quote-bearing regex literal is missed (0.1.x has the same limit). A `packOptions.ignore` folder that holds one declared page is scanned in full, so an unshipped backup subfolder inside it can add rewrite items (extra findings, never a dropped one). Other open items are listed in CHANGELOG. **Install** — `npx skills add VincentJiang06/skills` (or `cp -R skills/mp-groundline ~/.claude/skills/`). Full spec: [SKILL.md](SKILL.md)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The README instructs users to install the skill via npx skills add VincentJiang06/skills without pinning a version or commit. That allows the fetched package contents to change over time, so a compromised upstream package, account takeover, or malicious update could deliver different code than the reviewer expected.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 19)May include surrounding context.
md
**不适用** —— 实时运行时调试（→ mp-cli-sup）；开发 Skyline 组件 / worklet 动画 / 自定义路由（→ skyline-* skills，方向相反）；webview→skyline 反向迁移；不换渲染器的纯性能优化；除非明确要求，否则不现代化 / 回退 workaround；非微信工作。 **依赖与维护** —— Step 4 验证依赖 `mp-cli-sup` 驱动的系统 `vince-mp` CLI；开发者工具或 vince-mp 不可用时，迁移地图把每页标为 UNVERIFIED，不会声称「一致」。扫描器以迁移目标 `webview` 衡量页面级 `renderer`（逐页采用 Skyline 的程序也算迁移对象），跳过 `project.config.json` `packOptions.ignore` 里的文件夹并在地图里列出（放着 app.json 声明页面的文件夹照常扫描）。本地 `validate-skill` 只检查 skill 结构与合成用例，不能证明某次真实迁移页面一致。 **实测与已知问题（0.2.3）** —— 两臂对照（E11，在 0.1.2 上跑，3 个用例）：3 例中评委都判带 skill 的一臂更好。它每例的 diff 都更小，保留了 `rendererOptions` 和所有 workaround，也没有去修没观察到的差异。不带 skill 的裸模型三例都做了这类预防性修补。这个结论只是方向性的：评委知道哪臂带 skill，只记了工具调用次数、没记 token。0.2.0 修复审计留下的两条 P2 已在 0.2.2 修掉：声明页面落在 `packOptions.ignore` 文件夹里时照常扫描；逐页采用 Skyline 的程序，默认布局提示只指向被 pin 的页面。这一轮的独立修复审计没有 P0/P1，发布检查通过（release_ok）。仍开着的都不比已装的 0.1.1 差：同一行里带引号的正则字面量后面的 `wx://` 路由会漏报（0.1.x 同样存在）；`packOptions.ignore` 文件夹只要放着一个声明页面就整个照常扫描，里面没打包的备份子文件夹可能多报 rewrite 项（只会多报、不会漏报）。其余见 CHANGELOG。 **安装** —— `npx skills add VincentJiang06/skills`（或 `cp -R skills/mp-groundline ~/.claude/skills/`）。完整说明见 [SKILL.md](SKILL.md)。

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 19)May include surrounding context.
md
**不适用** —— 实时运行时调试(→ mp-cli-sup);开发 Skyline 组件 / worklet 动画 / 自定义路由(→ skyline-* skills,方向相反);webview→skyline 反向迁移;不换渲染器的纯性能优化;除非明确要求,否则不现代化 / 回退 workaround;非微信工作。 **依赖与维护** —— Step 4 验证依赖 `mp-cli-sup` 驱动的系统 `vince-mp` CLI;开发者工具或 vince-mp 不可用时,迁移地图把每页标为 UNVERIFIED,不会声称「一致」。扫描器以迁移目标 `webview` 衡量页面级 `renderer`(逐页采用 Skyline 的程序也算迁移对象),跳过 `project.config.json` `packOptions.ignore` 里的文件夹并在地图里列出(放着 app.json 声明页面的文件夹照常扫描)。本地 `validate-skill` 只检查 skill 结构与合成用例,不能证明某次真实迁移页面一致。 **实测与已知问题(0.2.3)** —— 两臂对照(E11,在 0.1.2 上跑,3 个用例):3 例中评委都判带 skill 的一臂更好。它每例的 diff 都更小,保留了 `rendererOptions` 和所有 workaround,也没有去修没观察到的差异。不带 skill 的裸模型三例都做了这类预防性修补。这个结论只是方向性的:评委知道哪臂带 skill,只记了工具调用次数、没记 token。0.2.0 修复审计留下的两条 P2 已在 0.2.2 修掉:声明页面落在 `packOptions.ignore` 文件夹里时照常扫描;逐页采用 Skyline 的程序,默认布局提示只指向被 pin 的页面。这一轮的独立修复审计没有 P0/P1,发布检查通过(release_ok)。仍开着的都不比已装的 0.1.1 差:同一行里带引号的正则字面量后面的 `wx://` 路由会漏报(0.1.x 同样存在);`packOptions.ignore` 文件夹只要放着一个声明页面就整个照常扫描,里面没打包的备份子文件夹可能多报 rewrite 项(只会多报、不会漏报)。其余见 CHANGELOG。 **安装** —— `npx skills add VincentJiang06/skills`(或 `cp -R skills/mp-groundline ~/.claude/skills/`)。完整说明见 [SKILL.md](SKILL.md)。

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 20)May include surrounding context.
md
**依赖与维护** —— Step 4 验证依赖 `mp-cli-sup` 驱动的系统 `vince-mp` CLI；开发者工具或 vince-mp 不可用时，迁移地图把每页标为 UNVERIFIED，不会声称「一致」。扫描器以迁移目标 `webview` 衡量页面级 `renderer`（逐页采用 Skyline 的程序也算迁移对象），跳过 `project.config.json` `packOptions.ignore` 里的文件夹并在地图里列出（放着 app.json 声明页面的文件夹照常扫描）。本地 `validate-skill` 只检查 skill 结构与合成用例，不能证明某次真实迁移页面一致。 **实测与已知问题（0.2.3）** —— 两臂对照（E11，在 0.1.2 上跑，3 个用例）：3 例中评委都判带 skill 的一臂更好。它每例的 diff 都更小，保留了 `rendererOptions` 和所有 workaround，也没有去修没观察到的差异。不带 skill 的裸模型三例都做了这类预防性修补。这个结论只是方向性的：评委知道哪臂带 skill，只记了工具调用次数、没记 token。0.2.0 修复审计留下的两条 P2 已在 0.2.2 修掉：声明页面落在 `packOptions.ignore` 文件夹里时照常扫描；逐页采用 Skyline 的程序，默认布局提示只指向被 pin 的页面。这一轮的独立修复审计没有 P0/P1，发布检查通过（release_ok）。仍开着的都不比已装的 0.1.1 差：同一行里带引号的正则字面量后面的 `wx://` 路由会漏报（0.1.x 同样存在）；`packOptions.ignore` 文件夹只要放着一个声明页面就整个照常扫描，里面没打包的备份子文件夹可能多报 rewrite 项（只会多报、不会漏报）。其余见 CHANGELOG。 **安装** —— `npx skills add VincentJiang06/skills`（或 `cp -R skills/mp-groundline ~/.claude/skills/`）。完整说明见 [SKILL.md](SKILL.md)。

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 20)May include surrounding context.
md
**依赖与维护** —— Step 4 验证依赖 `mp-cli-sup` 驱动的系统 `vince-mp` CLI;开发者工具或 vince-mp 不可用时,迁移地图把每页标为 UNVERIFIED,不会声称「一致」。扫描器以迁移目标 `webview` 衡量页面级 `renderer`(逐页采用 Skyline 的程序也算迁移对象),跳过 `project.config.json` `packOptions.ignore` 里的文件夹并在地图里列出(放着 app.json 声明页面的文件夹照常扫描)。本地 `validate-skill` 只检查 skill 结构与合成用例,不能证明某次真实迁移页面一致。 **实测与已知问题(0.2.3)** —— 两臂对照(E11,在 0.1.2 上跑,3 个用例):3 例中评委都判带 skill 的一臂更好。它每例的 diff 都更小,保留了 `rendererOptions` 和所有 workaround,也没有去修没观察到的差异。不带 skill 的裸模型三例都做了这类预防性修补。这个结论只是方向性的:评委知道哪臂带 skill,只记了工具调用次数、没记 token。0.2.0 修复审计留下的两条 P2 已在 0.2.2 修掉:声明页面落在 `packOptions.ignore` 文件夹里时照常扫描;逐页采用 Skyline 的程序,默认布局提示只指向被 pin 的页面。这一轮的独立修复审计没有 P0/P1,发布检查通过(release_ok)。仍开着的都不比已装的 0.1.1 差:同一行里带引号的正则字面量后面的 `wx://` 路由会漏报(0.1.x 同样存在);`packOptions.ignore` 文件夹只要放着一个声明页面就整个照常扫描,里面没打包的备份子文件夹可能多报 rewrite 项(只会多报、不会漏报)。其余见 CHANGELOG。 **安装** —— `npx skills add VincentJiang06/skills`(或 `cp -R skills/mp-groundline ~/.claude/skills/`)。完整说明见 [SKILL.md](SKILL.md)。

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
baseline is captured pre-flip): `vince-mp session start --json` returns ok (vince-mp on PATH + a reachable DevTools automation port). **If it cannot run:** keep the flip uncommitted (revertible), mark every page `UNVERIFIED` in the MIGRATION-MAP, make **no** Step 5 fixes, and tell the user to run Step 4 — no verification → UNVERIFIED, not consistent. ### Step 5 — Targeted fixes → load `rules/minimal-fix-protocol.md` Fix ONLY confirmed deltas, smallest change first, re-verify each. Record each fix

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manual trigger phrase "$mp-groundline 帮我把这个项目落到 webview" is concise and namespaced, but the underlying pattern "$mp-groundline" can still be activated by ordinary user text that casually includes the token, causing the wrong skill to route or activate. In a routing system, overly broad manual triggers can create mis-execution or bypass more appropriate skills, especially because this skill performs migration-oriented actions rather than read-only assistance.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/skyline-to-webview.md (reported line 21)May include surrounding context.
md
| S-COMPONENT | `~/.agents/skills/skyline-overview/references/introduction/component-support.md` | | S-CONFIG | `~/.agents/skills/skyline-config/references/app-config.md` | | S-WXSS | `~/.agents/skills/skyline-wxss/` | | S-ROUTE | `~/.agents/skills/skyline-route/SKILL.md` | | S-WORKLET | `~/.agents/skills/skyline-worklet/SKILL.md` | ## Config (→ mechanical / keep)

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/skyline-to-webview.md (reported line 22)May include surrounding context.
md
| S-CONFIG | `~/.agents/skills/skyline-config/references/app-config.md` | | S-WXSS | `~/.agents/skills/skyline-wxss/` | | S-ROUTE | `~/.agents/skills/skyline-route/SKILL.md` | | S-WORKLET | `~/.agents/skills/skyline-worklet/SKILL.md` | ## Config (→ mechanical / keep)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says this skill migrates a Mini Program off Skyline to WebView while keeping pages consistent and emitting a MIGRATION-MAP, and explicitly says it is not for live-runtime debugging, which belongs to mp-cli-sup. This file instructs users to perform live DevTools-session verification on the real program using the vince-mp CLI, adding an operational runtime-verification capability beyond the manifest’s declared scope.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest explicitly excludes live-runtime debugging and points users away from that domain toward mp-cli-sup. Yet this file depends on starting automation sessions, attaching to a running app, diagnosing automation-port failures, navigating pages, reading live page data, and taking screenshots—all runtime-observation capabilities characteristic of the excluded tooling context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. Line L011 presents an authoritative instruction in Chinese only, which can impose a language constraint on readers who do not understand Chinese and does not indicate any opt-in or equivalent English instruction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: L05 presents the document as English or Simplified Chinese, with Simplified Chinese selected as the default, while the rest of the README is written only in Chinese. This imposes a language choice by default rather than offering language-neutral or user-selected behavior within the skill description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: L12 states the skill uses a system CLI to capture screenshots and pageData before and after migration. Those artifacts can contain user or application data, but the README does not warn about data exposure, storage, or the need to avoid sensitive environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The natural-language fields for user tasks are consistently keyed as task_zh and most examples are written in Chinese, including one case whose identifier suggests English while still storing the task under task_zh. This indicates a locale/language assumption without any visible opt-in or documented justification in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file contains untranslated Chinese phrases in the evidence descriptions, which effectively assumes Chinese-language comprehension. The file does not offer a language/locale choice or explain that the skill is intentionally region- or locale-specific, so it may violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The feature evidence rows use Chinese-only descriptions such as "速查表" and "Skyline 新增组件," which imposes a specific language on readers. Because the file does not provide a language option or a clear locale-scoped justification, this is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The workflow writes before/after screenshots to disk but does not include a clear user-facing warning that files will be created and retained under the workspace. Even if intended for legitimate verification, screenshots and page data can contain sensitive application content, so silent artifact creation increases confidentiality and data-handling risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Ae1

Ae1

Intent-Code Divergence

Hidden Instructions

Session Persistence

Skill Enumeration

Rp1

Session Persistence

Session Persistence

Skill Enumeration

Skill Enumeration

Rp1

Autonomous Decision Making

Vague Triggers

Skill Enumeration

Skill Enumeration

Description-Behavior Mismatch

Context-Inappropriate Capability

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Static analysis