Security audit

project-analyzer

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent project documentation generator, but it broadly reads project code and configuration and can carry sensitive or untrusted text into generated Markdown.

Install only if you are comfortable letting the skill read the selected project's source, SQL, tests, and configuration files. Run it on a narrow project path, remove or redact secrets first, review generated Markdown before sharing or opening it in permissive renderers, and treat Apifox-related instructions as requiring separate explicit consent because external sync is not safely documented here.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/doc_generator.py:675
Finding: Unsanitized Repository Content Is Embedded into Generated Markdown
Content: View full analysis
Vulnerability Details

File Location: scripts/api_scanner.py:71, scripts/database_scanner.py:109, scripts/doc_generator.py:675,717,745, scripts/main.py:104
Vulnerability Type: Stored Markdown and HTML content injection
Risk Level: Medium

Vulnerable Code

Source content is read from an analyzed repository:

python
# scripts/api_scanner.py:71 content = controller_file.read_text(encoding='utf-8', errors='ignore')

python
# scripts/database_scanner.py:109 content = sql_file.read_text(encoding='utf-8', errors='ignore')

Extracted comments and descriptions are interpolated directly into Markdown:

python
# scripts/doc_generator.py:675 - **描述**: {ep.get('description', '无描述')}

python
# scripts/doc_generator.py:717 lines.append(f"| {col.get('name', '')} | {col.get('type', '')} | {col.get('comment', '')} |")

python
# scripts/doc_generator.py:745 - 描述: {ep.get('description', '无描述')}

The resulting content is then written without sanitization:

python
# scripts/main.py:104 output_file.write_text(final_content, encoding='utf-8')

Technical Analysis

The analyzer treats source repositories as trusted input. Java documentation comments and SQL column comments can originate from an untrusted contributor or a malicious third-party repository. These values are inserted directly into generated Markdown without escaping:

Raw HTML elements

Markdown image and link syntax

Table delimiters

Backticks and code-fence delimiters

Dangerous URL schemes

Renderer-specific active content

ConstraintChecker only searches for a short list of placeholder strings and does not sanitize HTML or Markdown. EntropyManager reformats content but does not apply a security policy.

Consequently, malicious repository text can persist in generated APID, SDD, or DBD documents. When a user opens those files, the effect depends on the Markdo ...[truncated 1475 chars]
Remediation: View remediation
Remediation Suggestions

Treat every value extracted from a target repository as untrusted.

Apply context-aware Markdown escaping before interpolation, including escaping pipes, backticks, brackets, parentheses, and heading markers.

Strip or encode raw HTML tags unless HTML output is an explicitly required feature.

Reject dangerous URL schemes such as javascript:, data:, and file:.

Consider blocking remote images and other automatically loaded resources.

Use structured Markdown-generation helpers rather than direct string interpolation.

Keep source-derived text inside clearly delimited, escaped code blocks where appropriate.

Add tests containing malicious JavaDoc and SQL comments, including HTML tags, remote images, links, table delimiters, and code fences.

Document that generated files should be opened with a renderer that disables raw HTML and active content.

T09 · Insecure Skill Coding Practices

Note

Location: scripts/doc_generator.py:80
Finding: Undefined Variable Causes Deterministic SRS Generation Failure
Content: View full analysis
Vulnerability Details

File Location: scripts/doc_generator.py:80
Vulnerability Type: Unhandled generation-time exception and denial of service
Risk Level: Low

Vulnerable Code

python
# scripts/doc_generator.py:80 {project.get('name', '项目')} 是基于 **{tech_stack.get('language', 'Java')}** 技术栈开发的{template_type}。

The referenced template_type variable is not defined in _generate_srs() or as an instance attribute before this formatted string is evaluated.

Technical Analysis

Python evaluates expressions inside an f-string when constructing the string. Because template_type is undefined, _generate_srs() raises a NameError.

The main generation loop processes SRS first:

python
doc_types = ['srs', 'sad', 'sdd', 'dbd', 'apid', 'tsd'] for doc_type in doc_types: content = self.generator.generate(doc_type, self.context)

There is no exception handler around document generation. Therefore, the error propagates to the entry point and terminates the process before the advertised document set can be generated.

Attack Path

A user invokes the analyzer using its documented workflow.

ProjectAnalyzer._generate_documents() selects srs as the first document type.

DocumentGenerator.generate() calls _generate_srs().

Python evaluates the f-string containing template_type.

A NameError is raised because the variable does not exist.

The exception is not caught, and the analyzer exits.

This failure does not require specially crafted repository content and occurs during normal operation.

Impact Assessment

No additional privileges, data access, or code-execution capability can be obtained through this defect. The impact is limited to availability and output integrity:

The complete document-generation workflow cannot finish.

Expected SRS, SAD, SDD, DBD, APID, and TSD output is not reliably produced.

Automation or CI jobs invoking ...[truncated 151 chars]
Remediation: View remediation
Remediation Suggestions

Define template_type before constructing the SRS content, using validated project metadata and a safe fallback.

Alternatively, replace the variable with a fixed description if dynamic project classification is unnecessary.

Add unit tests that invoke every document generator independently.

Add an end-to-end test that generates all six document types.

Catch per-document generation exceptions and report them clearly instead of terminating without a structured result.

Write output atomically through temporary files and replace final files only after successful generation, preventing stale or partial document sets.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: 该代码的核心功能是基于 context 中已有的 project/api/database 信息，使用预设 Markdown 模板生成文档文本。这与“文档生成器”这一大方向部分一致，且支持 SDD、数据库结构分析相关文档也与部分场景相符。但声明中的核心卖点——Harness Engineering 模式、受控环境、架构约束、上下文工程、反馈循环、熵管理——在代码里没有任何对应实现；同时声明的“开发规范生成”和“Apifox 自动测试对接”也未见实现。因此，描述显著夸大并偏离了代码实际能力，属于功能描述与实现不一致。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README explicitly promotes syncing project-derived API documentation to Apifox and executing interface tests, but it does not warn that project metadata, endpoints, schemas, examples, or other potentially sensitive internal details may be transmitted to a third-party service. In a code/documentation analysis skill, this omission can cause users to export internal system structure outside their trust boundary without informed consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README includes a configuration example setting content.language: zh-CN, which imposes a specific locale. The document does not present this as optional or user-selectable, so it can violate language/locale policy expectations requiring user choice unless the locale restriction is justified.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs broad file-reading and implies document generation workflows over repository contents, but it does not declare any explicit tool scope such as permissions or allowed-tools. In practice, this weakens least-privilege controls and makes it easier for the agent to access or modify files beyond what users may expect during analysis.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill’s title, description, and usage framing are entirely in Chinese and describe the skill as a Chinese SDD generator, but nowhere indicate that language selection is optional. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill mandates comprehensive scanning and complete reading of project files before document generation, including docs, source, tests, and related artifacts, without any caution about proprietary or confidential content. In a codebase-analysis context, this increases the risk of over-collection, unnecessary exposure of sensitive intellectual property, and leakage into generated documents or downstream systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly directs reading configuration files such as application.yml, Dockerfile, and Kubernetes manifests, which commonly contain credentials, endpoints, tokens, or internal infrastructure details. Because the instructions mandate broad content ingestion without privacy safeguards, generated outputs may unintentionally expose sensitive secrets or proprietary architecture data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill is defined with a very broad invocation scope ('analyze a project and generate complete documentation') and does not specify boundaries on what files, directories, or operations are in scope. In an agent setting, this can lead to over-collection of sensitive data, unintended inspection of secrets or unrelated repositories, and unsafe downstream actions such as external synchronization without explicit user confirmation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest contains user-facing description fields and comments in Chinese, including the main description and short description, but does not indicate that the skill is Chinese-only or provide any language/locale opt-in. This can violate language/locale policy because it effectively forces one language for discovery and use without documented user choice or justified regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The content.language: zh-CN setting imposes a specific locale for generated output. Under the policy, forcing a language without user opt-in or a clearly documented region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown template is written entirely in Chinese and labels the API documentation format in Chinese, which effectively imposes a specific language/locale on generated documentation. The file does not offer a language choice or explain that the template is intentionally limited to a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown template is written in Chinese throughout, including the title and section labels, with no indication that language is configurable or chosen by the user. The policy explicitly calls for flagging language or locale constraints when they are imposed without user opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file contains user-facing natural-language descriptions entirely in Chinese (for example, the module docstring and validator descriptions) without any indication that the skill is region-specific or that users can choose a language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module title, class docstrings, and operational messages are written in Chinese, which indicates the skill is designed around a fixed language/locale. The file does not provide any opt-in, fallback, or justification that this scanner is intended only for Chinese-speaking users or a region-specific environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module title, class docstrings, and all generated document content are written in Chinese, which indicates the skill is designed to force a specific language output. The file does not provide any user opt-in, locale selection, or justification that this is a region-specific tool, so it violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module title and description are written entirely in Chinese, and the embedded natural-language docstrings/comments consistently prescribe Chinese-language operation without any opt-in or locale-selection mechanism. This can violate language/locale policy when the skill is used in broader contexts where users have not chosen Chinese.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module title and descriptive text are presented in Chinese, and the class/docstring language throughout the file is Chinese without any indication that users may choose another language or that the skill is region-specific. This creates a language/locale policy concern because the skill appears to impose a specific language by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The default language constraint is hard-coded to zh-CN, which imposes a specific language/locale on outputs. Under the policy, locale restrictions should either be user-selectable or clearly justified as region-specific; neither is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code file contains user-facing natural-language descriptions and console/report text entirely in Chinese, including the tool name and operational messages. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The help text and argument definition indicate users can specify particular document types with --type, implying constrained generation behavior. However, analyze() always calls _generate_documents(), and _generate_documents() uses a hardcoded doc_types list without consulting parsed args.type, so the documented behavior is contradicted by the code.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file's natural-language descriptions are entirely in Chinese, including the top-level module description and method docstrings, with no indication that language choice is optional or region-specific. This can violate language/locale policy when a skill is expected to adapt to user preference rather than implicitly forcing one language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest’s user-facing description and default prompt are entirely in Chinese, with no indication that users may choose another language or that the skill is region-specific. Per the policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description string is written only in Chinese ("SDD 软件设计文档生成器"), which indicates a fixed language choice in user-facing metadata. The file does not offer any language choice or explain that the skill is intentionally region-specific, so this may violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Line L095 contains Chinese text ('Full链路监控') inside an otherwise English SRS template. This creates a language/locale inconsistency and effectively forces part of the document into a specific language without user opt-in or explanation.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The dependency is specified as PyYAML>=6.0 without an upper bound or exact pin, which makes builds non-reproducible and can silently introduce vulnerable or incompatible releases over time. In a tool that analyzes projects and may process user-supplied repository content or configs, dependency drift increases supply-chain risk and makes it harder to verify whether a safe version is actually installed.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
# Project Analyzer 依赖 PyYAML>=6.0

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Tp4

Missing User Warnings

Natural-Language Policy Violations

Undeclared Tool Scope

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Vague Triggers

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Intent-Code Divergence

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Unpinned Dependencies

Static analysis