Security audit

Tob Poc Budget Justify

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Chinese-language CLI report generator for ToB POC budget justification, with no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Installers should expect a Chinese-language CLI that prints business-planning Markdown. If report inputs can come from untrusted people, render the output with raw HTML disabled and consider blocking remote images or links in the Markdown viewer.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

Location: src/generator.js:260
Finding: Unsanitized User Input Allows Markdown Content Injection
Content: View full analysis
客户：${client || '未指定'}`); if (industry) lines.push(`> 行业：${industry}`); if (pocGoal) lines.push(`> POC 目标：${pocGoal}`); if (budget) lines.push(`> 客户预算：${budget}`); if (decisionMaker) lines.push(`> 决策人：${decisionMaker}`); lines.push(`> 验证类型：${pocType}`); lines.push(''); // 模块 1：POC 目标对齐 lines.push(`## 🎯 POC 目标对齐`); lines.push(''); if (pocGoal) { lines.push(`- **客户表面诉求**：${pocGoal}`); ``` ### Technical Analysis The report generator inserts the user-controlled `client`, `industry`, `pocGoal`, `budget`, and `decisionMaker` values directly into Markdown without escaping Markdown metacharacters, removing line breaks, or validating embedded URLs. An attacker can include newlines, headings, links, images, block quotes, or raw HTML in these fields. This allows the attacker to alter the structure and apparent meaning of the generated report. If the report is subsequently displayed by an HTML-capable Markdown renderer, injected remote images may trigger requests to attacker-controlled servers. Raw HTML may present additional risks when the renderer permits unsafe HTML. The CLI wrapper uses argument-array spawning without a shell, so this issue does not constitute shell command injection. No direct local code-execution path was identified. ### Attack Path 1. An attacker supplies a crafted CLI field, for example through `--client` or `--poc-goal`, containing line breaks and Markdown content such as a deceptive heading or remote image. 2. `generateReport()` interpolates the value into the report without sanitization. 3. The generated Markdown is copied, saved, shared, or opened in a Markdown viewer. 4. The injected content is rendered as part of the trusted report. 5. If remote resources are enabled, the viewer may connect to an attacker-controlled URL, disclo ...[truncated 881 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The display name, description, usage guidance, and operating principles are all written in Chinese, which effectively forces a specific language for users. Under the policy, locale or language constraints should either provide user opt-in/choice or be explicitly documented as a justified region-specific limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code's natural-language interface and help text force a specific language/locale for users, including the title, usage, parameter descriptions, and interactive prompts. Under the policy, a skill should not impose a language without user opt-in unless the restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The manifest describes a skill that takes business inputs and produces POC scope, resource estimates, and budget justification. In this file, the implemented capability is process spawning via child_process to execute another Node program, which is not itself justified by the stated business-purpose description and introduces execution capability beyond content generation logic.
Content: No source excerpt is available for this finding.