Tob Sales Proposal

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 6:39 AM UTC
• Version: 1.2.2

Overview

This is a local Chinese-language sales proposal generator with some dependency and documentation issues, but I found no hidden execution, persistence, credential use, or data exfiltration behavior.

Install only if you want a Chinese-language local CLI that generates HTML sales proposals. Do not rely on the stated automatic sensitive-information desensitization; avoid entering confidential client details unless you are comfortable with them appearing in the generated HTML file. Audit or update dependencies before using it in CI or on untrusted repositories.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is for a content-generation skill that produces HTML sales proposals from business inputs and a case knowledge base. The supplied code chunk does not implement proposal generation or HTML/CSS output at all. Instead, it is a repository smoke test that inspects source/data files and checks for sensitive strings. This is a materially different primary purpose, so the description does not accurately represent the code shown.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==3.14.2 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

js-yaml 3.14.2 has multiple high-severity CPU exhaustion issues involving merge keys and omap parsing. Here it is nested under dev tooling, so the main risk is denial of service when CI or local tooling parses attacker-controlled YAML config files, not direct compromise of proposal generation at runtime.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==1.1.14 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

brace-expansion 1.1.14 has several denial-of-service issues from pathological expansion inputs causing excessive CPU or memory usage. Because it is transitively used by glob/minimatch in dev dependencies, the realistic exposure is build/test tooling handling attacker-controlled glob-like patterns rather than the end-user-facing proposal generator runtime.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.2 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

browserslist 4.28.2 is flagged for crashes/prototype writes from untrusted browserslist-stats input and for unbounded memory growth from distinct queries. In this project it is only present through development dependencies, so the issue is real but mainly threatens availability and stability of build tooling rather than production proposal generation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

js-yaml 4.1.1 retains multiple parser-level denial-of-service issues involving complex YAML constructs. Although this copy is in dev tooling, parsing malicious YAML during lint/test/config processing could still hang or exhaust CI resources, making it a true vulnerability with moderate practical impact.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description, examples, and user-facing instructions are presented entirely in Chinese, including the product description and CLI usage examples. Under the policy rule for natural-language violations, this constitutes a language/locale restriction because no user opt-in, alternative language option, or justification for a Chinese-only audience is documented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The display name, description, and main heading all specify a Chinese-language sales proposal generator, and the document consistently describes outputs in Chinese without any opt-in or language-selection mechanism. This is a natural-language locale policy concern because the skill appears to enforce a specific language by default rather than allowing user choice or clearly documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description string is entirely in Chinese and presents the skill as a Chinese-language sales proposal generator, with no indication that users can choose another language or locale. Under the policy rule for natural-language constraints, this can be read as enforcing a specific language without documented opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The command description, option help text, status messages, and interactive prompts are all hard-coded in Chinese. This imposes a specific language/locale on all users, and the file does not offer any opt-in, fallback, or explanation that the tool is intentionally restricted to a Chinese-speaking region or audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The embedded HTML template declares lang="zh-CN" and all visible proposal content is written in Chinese, which forces a specific language/locale in the generated output. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified; neither is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This JSON file uses Chinese for the skill name and description, and the case content throughout the file is likewise Chinese-only. Under the policy rule for language/locale, forcing a specific language without user opt-in or documented regional justification can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This JSON skill data uses Chinese-language names and descriptions throughout, which can amount to a language/locale constraint when no opt-in, alternative language option, or region-specific justification is provided. The policy for SQP-3 applies to all file types and flags natural-language content that effectively forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @babel/core==7.29.0 — 1 advisory(ies): CVE-2026-49356 (@babel/core: Arbitrary File Read via sourceMappingURL Comment)

Low

• Category: Supply Chain
• Confidence: 76% confidence

Finding

@babel/core 7.29.0 is flagged for an arbitrary file read via crafted sourceMappingURL comments. In this lockfile it is a dev dependency pulled in by Jest/Babel tooling, so exploitation would usually require processing attacker-controlled JavaScript during test/build workflows rather than normal skill runtime. That makes this a real but low-context-risk dependency issue.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: baseline-browser-mapping==2.10.29 — 1 advisory(ies): CVE-2026-45819 (baseline-browser-mapping process termination on invalid input causes denial of s)

Low

• Category: Supply Chain
• Confidence: 72% confidence

Finding

baseline-browser-mapping is reported vulnerable to process termination on invalid input, which is essentially a denial-of-service condition. It is only used transitively by browserslist in development tooling, so this is a real issue but has limited practical impact on the deployed skill.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

Using a caret version range for commander allows newer compatible releases to be installed automatically, which can introduce supply-chain risk if an upstream package ships a vulnerable or malicious update. In a CLI skill that processes user input and generates output files, dependency compromise could affect the local environment or generated artifacts.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json

"author": "ToB Skills Team",
  "license": "MIT",
  "dependencies": {
    "commander": "^11.0.0",
    "inquirer": "^8.2.6",
    "chalk": "^4.1.2",
    "handlebars": "^4.7.8",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

Using a caret version range for inquirer permits automatic uptake of future releases within the major version, increasing exposure to supply-chain compromise or newly introduced vulnerabilities. Because this package likely handles interactive CLI prompts, a compromised dependency would execute in the user's local environment.

Content

Scanner excerpt · package.json (reported line 24)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "commander": "^11.0.0",
    "inquirer": "^8.2.6",
    "chalk": "^4.1.2",
    "handlebars": "^4.7.8",
    "fs-extra": "^11.1.0"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The chalk dependency is not pinned to an exact version, so builds may resolve to different package contents over time. That weakens build reproducibility and creates a low-severity supply-chain risk if a later allowed release is compromised.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json

"dependencies": {
    "commander": "^11.0.0",
    "inquirer": "^8.2.6",
    "chalk": "^4.1.2",
    "handlebars": "^4.7.8",
    "fs-extra": "^11.1.0"
  },

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

Handlebars is a templating library and, if an upstream allowed version were compromised or introduced a security flaw, it could materially affect generated HTML output or local execution paths. The unpinned caret range increases that supply-chain exposure, even though package.json alone does not prove active exploitation.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json

"commander": "^11.0.0",
    "inquirer": "^8.2.6",
    "chalk": "^4.1.2",
    "handlebars": "^4.7.8",
    "fs-extra": "^11.1.0"
  },
  "engines": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The fs-extra dependency has an unpinned caret range, allowing future releases to be installed without review. Since file-system libraries often have broad access to local files, a compromised or vulnerable update could have outsized effects in this CLI context.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

"inquirer": "^8.2.6",
    "chalk": "^4.1.2",
    "handlebars": "^4.7.8",
    "fs-extra": "^11.1.0"
  },
  "engines": {
    "node": ">=18"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The HTML root sets lang="zh-CN", and all visible content is presented in Chinese, which establishes a fixed language/locale choice. Under the policy, locale constraints should either be user-selectable or clearly justified as region-specific; this file provides neither.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The generator formats dates with toLocaleDateString('zh-CN'), which imposes a specific locale regardless of user preference. While less impactful than the full template language lock, it still reflects a natural-language/locale policy issue because no opt-in or documented regional scope is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.