T03 · Remote Payload Retrieval and Execution
Error
- Location
setup.sh:97- Finding
Unverified Remote Installation Scripts Are Executed Directly
- Content
View full analysis
- Remediation
View remediation
Security audit
问卷网
Security checks for vulnerabilities and agentic risk
Overview
This is a real Wenjuan survey skill, but it includes overbroad install and update paths that can execute unreviewed remote instructions.
Install only if you trust the publisher and your environment. Prefer installing Node.js yourself, run npm ci instead of the automatic setup path where possible, do not run server-returned update commands without review, avoid setting WENJUAN_HOST, and use local JSON files instead of arbitrary import URLs for sensitive networks. Protect and periodically remove ~/.wenjuan and the skill .wenjuan credentials when no longer needed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:248- Finding
Remote Version API Instructions Are Authorized to Control Agent Execution
- Content
View full analysis
current_version`），必须立刻进入更新流程，不能只提示不执行。 # SKILL.md:294 3. 若需更新：优先按接口返回的 `instruction` 执行下载与安装。 ``` The version-check script obtains and displays that untrusted field directly from the remote response: ```javascript const data = result.data || {}; const current = data.current_version || CURRENT_VERSION; const latest = data.latest || "1.0.0"; let hasUpdate = data.has_update || false; const releaseNote = data.release_note || ""; const instruction = data.instruction || ""; if (!hasUpdate && current && latest) { hasUpdate = compareVersions(current, latest); } if (hasUpdate) { console.log(`\n⚠️ 发现新版本！`); if (releaseNote) { console.log(`\n更新内容:\n${releaseNote}`); } if (instruction) { console.log(`\n更新说明:\n${instruction}`); } } ``` ### Technical Analysis The JavaScript does not directly evaluate the response as code. However, the Agent-facing policy in `SKILL.md` explicitly delegates update behavior to the mutable `instruction` field returned by the remote version endpoint. It also requires immediate execution rather than treating the response as advisory text. This creates an indirect remote code-execution channel in an Agent environment. The effective command or download operation is not present in the audited package and can change after review. A compromised Wenjuan version endpoint, malicious backend response, or redirected API host can supply arbitrary instructions and rely on the Skill policy to make the Agent execute them. The risk is amplified ...[truncated 1456 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wenjuan_env.js:16- Finding
Unrestricted API Host Override Can Redirect Bearer Tokens to an Attacker
- Content
View full analysis
` headers. Consequently, an attacker who can influence the environment can redirect requests and authentication material to a server under their control. An `http://` value also allows the token to be transmitted without transport encryption. This applies broadly because the same host configuration is used by project creation, editing, publishing, listing, report statistics, archive operations, export operations, login, signing, and version checks. ### Attack Path 1. An attack ...[truncated 1256 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/workflow_create_and_publish.js:1044- Finding
URL-Based JSON Import Allows SSRF and Plaintext HTTP Retrieval
- Content
View full analysis
status >= 200 && status < 300, }); const raw = stripBom(String(response.data || "")); try { return JSON.parse(raw.trim()); } catch (e) { throw new Error(`链接内容不是合法 JSON: ${e.message}`); } } ``` ### Technical Analysis The URL importer checks only whether the scheme is HTTP or HTTPS. It does not reject: - Loopback addresses such as `127.0.0.1` or `::1`. - Private network ranges. - Link-local destinations such as `169.254.169.254`. - Cloud metadata endpoints. - Internal DNS names. - Reserved or special-use IP ranges. - Hostnames that resolve or rebind to private addresses. - Redirects from a public URL to an internal destination. Axios follows redirects by default, and the implementation does not specify a redirect limit or revalidate each redirect target. It also permits unencrypted HTTP. The response-size cap mitigates excessive body size but does not prevent internal service probing, authenticated network-position access, metadata retrieval, or disclosure through subsequent survey creation. The downloaded JSON is parsed and used by the create-and-publish workflow, so information retrieved from an internal endpoint can be transmitted to Wenjuan as project content. ### ...[truncated 1630 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (190)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill advertises questionnaire operations but also includes environment setup that can install Node.js and dependencies, potentially invoking curl and sudo or other privileged package-management actions. In an agent context, hidden installation behavior is dangerous because it crosses from application usage into system modification, enabling unexpected privilege use and supply-chain exposure.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill advertises questionnaire operations but also includes environment setup that can install Node.js and dependencies, potentially invoking curl and sudo or other privileged package-management actions. In an agent context, hidden installation behavior is dangerous because it crosses from application usage into system modification, enabling unexpected privilege use and supply-chain exposure.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill advertises questionnaire operations but also includes environment setup that can install Node.js and dependencies, potentially invoking curl and sudo or other privileged package-management actions. In an agent context, hidden installation behavior is dangerous because it crosses from application usage into system modification, enabling unexpected privilege use and supply-chain exposure.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill advertises questionnaire operations but also includes environment setup that can install Node.js and dependencies, potentially invoking curl and sudo or other privileged package-management actions. In an agent context, hidden installation behavior is dangerous because it crosses from application usage into system modification, enabling unexpected privilege use and supply-chain exposure.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill advertises questionnaire operations but also includes environment setup that can install Node.js and dependencies, potentially invoking curl and sudo or other privileged package-management actions. In an agent context, hidden installation behavior is dangerous because it crosses from application usage into system modification, enabling unexpected privilege use and supply-chain exposure.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill advertises questionnaire operations but also includes environment setup that can install Node.js and dependencies, potentially invoking curl and sudo or other privileged package-management actions. In an agent context, hidden installation behavior is dangerous because it crosses from application usage into system modification, enabling unexpected privilege use and supply-chain exposure.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill advertises questionnaire operations but also includes environment setup that can install Node.js and dependencies, potentially invoking curl and sudo or other privileged package-management actions. In an agent context, hidden installation behavior is dangerous because it crosses from application usage into system modification, enabling unexpected privilege use and supply-chain exposure.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill advertises questionnaire operations but also includes environment setup that can install Node.js and dependencies, potentially invoking curl and sudo or other privileged package-management actions. In an agent context, hidden installation behavior is dangerous because it crosses from application usage into system modification, enabling unexpected privilege use and supply-chain exposure.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill advertises questionnaire operations but also includes environment setup that can install Node.js and dependencies, potentially invoking curl and sudo or other privileged package-management actions. In an agent context, hidden installation behavior is dangerous because it crosses from application usage into system modification, enabling unexpected privilege use and supply-chain exposure.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 本 Skill 提供问卷网问卷的创建、查询、编辑、**查看报表**（`/report/topic/{project_id}`，由 `open_report.js` 实现，**默认自动用浏览器打开**；`--no-open` 仅输出链接）、**数据概况**（`overview_stats.js`，即时统计答卷/浏览/完成
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 本 Skill 提供问卷网问卷的创建、查询、编辑、**查看报表**（`/report/topic/{project_id}`，由 `open_report.js` 实现，**默认自动用浏览器打开**；`--no-open` 仅输出链接）、**数据概况**（`overview_stats.js`，即时统计答卷/浏览/完成
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 本 Skill 提供问卷网问卷的创建、查询、编辑、**查看报表**（`/report/topic/{project_id}`，由 `open_report.js` 实现，**默认自动用浏览器打开**；`--no-open` 仅输出链接）、**数据概况**（`overview_stats.js`，即时统计答卷/浏览/完成
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 本 Skill 提供问卷网问卷的创建、查询、编辑、**查看报表**（`/report/topic/{project_id}`，由 `open_report.js` 实现，**默认自动用浏览器打开**；`--no-open` 仅输出链接）、**数据概况**（`overview_stats.js`，即时统计答卷/浏览/完成
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 本 Skill 提供问卷网问卷的创建、查询、编辑、**查看报表**（`/report/topic/{project_id}`，由 `open_report.js` 实现，**默认自动用浏览器打开**；`--no-open` 仅输出链接）、**数据概况**（`overview_stats.js`，即时统计答卷/浏览/完成
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 本 Skill 提供问卷网问卷的创建、查询、编辑、**查看报表**（`/report/topic/{project_id}`，由 `open_report.js` 实现，**默认自动用浏览器打开**；`--no-open` 仅输出链接）、**数据概况**（`overview_stats.js`，即时统计答卷/浏览/完成
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 器打开**；`--no-open` 仅输出链接）、**数据概况**（`overview_stats.js`，即时统计答卷/浏览/完成率；**请求 URL 与 `generate_sign.js`（ai_skills）同源签名**）与数据导出能力。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 器打开**；`--no-open` 仅输出链接）、**数据概况**（`overview_stats.js`，即时统计答卷/浏览/完成率；**请求 URL 与 `generate_sign.js`（ai_skills）同源签名**）与数据导出能力。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 器打开**；`--no-open` 仅输出链接）、**数据概况**（`overview_stats.js`，即时统计答卷/浏览/完成率；**请求 URL 与 `generate_sign.js`（ai_skills）同源签名**）与数据导出能力。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 器打开**；`--no-open` 仅输出链接）、**数据概况**（`overview_stats.js`，即时统计答卷/浏览/完成率；**请求 URL 与 `generate_sign.js`（ai_skills）同源签名**）与数据导出能力。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 器打开**；`--no-open` 仅输出链接）、**数据概况**（`overview_stats.js`，即时统计答卷/浏览/完成率；**请求 URL 与 `generate_sign.js`（ai_skills）同源签名**）与数据导出能力。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 成 **`references/create_survey.md`** 所述的**发布前用户确认**（展示标题、类型、题目概要并取得明确同意）后，再执行 **`workflow_create_and_publish.js`**（登录 → 创建并导入 → 发布 → 轮询审核）。**注意**：把题目写成 `examples
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 成 **`references/create_survey.md`** 所述的**发布前用户确认**（展示标题、类型、题目概要并取得明确同意）后，再执行 **`workflow_create_and_publish.js`**（登录 → 创建并导入 → 发布 → 轮询审核）。**注意**：把题目写成 `examples
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 成 **`references/create_survey.md`** 所述的**发布前用户确认**（展示标题、类型、题目概要并取得明确同意）后，再执行 **`workflow_create_and_publish.js`**（登录 → 创建并导入 → 发布 → 轮询审核）。**注意**：把题目写成 `examples
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 成 **`references/create_survey.md`** 所述的**发布前用户确认**（展示标题、类型、题目概要并取得明确同意）后，再执行 **`workflow_create_and_publish.js`**（登录 → 创建并导入 → 发布 → 轮询审核）。**注意**：把题目写成 `examples
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 成 **`references/create_survey.md`** 所述的**发布前用户确认**（展示标题、类型、题目概要并取得明确同意）后，再执行 **`workflow_create_and_publish.js`**（登录 → 创建并导入 → 发布 → 轮询审核）。**注意**：把题目写成 `examples
Static analysis
No suspicious patterns detected.