Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to perform the promised Kujiale interior-design workflow, but it needs review because it handles an access token, uploads local images, and can trigger account-consuming design actions with limited safeguards.
Install only if you trust this publisher and are comfortable connecting your Kujiale account. Use a scoped or short-lived token if possible, keep .kjlconfig.json out of source control, rotate the token after testing, and confirm the exact image file before any upload. Do not let the skill proceed with layout or rendering unless you understand any quota, credit, or account effects.
scripts/searchPlan.js:10Access Token Exposure Through Process Arguments and URL Query Parameters
SKILL.md:87Shared Inbound Directory Monitoring Can Upload an Unrelated Local Image
声明描述的是一个面向用户的室内智能设计 skill，核心能力应是通过对话推进设计流程并最终生成渲染结果。而实际代码仅是一个独立的 CLI 工具：解析 --token、--bitmap、--name 参数，调用 kujiale 的 bitmap/import/async 接口创建异步导入任务。它没有任何对话管理、户型/风格/布局确认逻辑，也没有渲染出图功能。其主要目的与声明的高层产品能力明显不一致，因此应判定为描述与行为不匹配。
声明描述的是一个完整的室内设计交互式 skill，核心能力应包括多轮对话引导、设计决策和渲染出图。但提供的代码仅实现了根据 planId 查询户型图信息的网络请求工具，没有任何对话管理、风格/布局处理或渲染逻辑。虽然“户型确认”可能需要获取户型信息，这段代码最多只覆盖了其中一个底层辅助步骤，无法代表声明中的主要功能。因此描述与实际代码行为存在明显不匹配。
The declared description presents a full interactive interior design skill covering multiple stages: confirming house layout, choosing style, confirming layout, and rendering images. The supplied code only performs one narrow backend action: querying a hard-decoration style library from an external API with a token and optional tag filters. While 'style selection' is related, the code does not implement the broader conversational design workflow or the other claimed stages. Therefore the actual behavior is materially narrower and different from the declared purpose.
The declared description suggests a conversational interior design skill focused on confirming layouts, selecting styles, and generating renderings. The supplied code does none of those things. Instead, it is a utility script for querying custom tags from Kujiale's API using an access token. This is a materially different purpose and involves external API access and token-based data retrieval that are not represented in the description or permissions. Therefore, this is a clear description-behavior mismatch.
声明描述的是一个面向室内设计的多轮对话式能力，而实际代码只是在调用 oauth.kujiale.com 的接口获取 AI design skill 的上传凭证。这属于明显不同的主要用途：代码没有实现任何室内设计、对话引导、风格选择、布局确认或渲染逻辑，反而执行了与认证/上传准备相关的网络访问。该行为更像是支持性运维/接口调试工具，而不是所声明的终端 skill 功能，因此存在明显描述与行为不一致。
声明描述的是一个面向用户的室内智能设计 skill，核心能力应包含交互式流程推进以及设计/渲染相关功能。但给出的代码仅实现了一个独立的搜索户型脚本：解析命令行参数，向 kujiale 的 floorplan search 接口发起 GET 请求，并输出返回结果。它没有实现对话式流程控制，也没有风格选择、布局确认或渲染出图逻辑。虽然“户型确认”可能与户型搜索存在弱相关，但该代码的主要目的与声明的整体功能相比明显更窄且不同，因此构成描述与实际行为不匹配。
声明描述的是一个面向用户的“室内智能设计”对话式 skill，核心流程应包括户型确认、风格选择、布局确认以及最终渲染出图。但提供的代码并不包含任何对话管理、用户输入收集、户型/风格/布局决策逻辑。它的实际作用仅是基于已存在的 obsDesignId，调用外部接口触发自动视角生成并提交渲染任务，属于渲染流水线中的技术性后处理脚本。虽然“渲染出图”与声明的最后一步部分相关，但代码覆盖的功能范围明显更窄，且主要能力与声明的核心交互式设计流程不符。此外，代码显式依赖 xToken 进行鉴权并访问多个外部 API，这种关键能力/资源访问也未在声明中体现。因此应判定为描述与实际行为不匹配。
The declared description presents an end-user interior design conversational workflow focused on confirming room layout, selecting style, confirming arrangement, and generating renders. The supplied code does not implement any conversational design flow, rendering, layout handling, or style selection. Instead, it performs a backend/administrative version-check operation against an external API using an access token and version parameter. This is a materially different primary purpose and involves undeclared external resource access unrelated to the described design interaction.
Referenced artifact was not completely inspected
每次执行前调用：`node ./scripts/versionCheck.js --token=${token} --version=0.0.6`
Referenced artifact was not completely inspected
node ./scripts/searchPlan.js --token=<token> --query=<小区名> --areaId=<城市id> --start=0 --num=20
Referenced artifact was not completely inspected
node ./scripts/getUploadToken.js --token=<token>
Referenced artifact was not completely inspected
node ./scripts/createBitmapTask.js --token=<token> --bitmap=<url>
Referenced artifact was not completely inspected
node ./scripts/getBitmapTaskResult.js --token=<token> --taskId=<taskId>
Referenced artifact was not completely inspected
node ./scripts/createDesign.js --token=<token> --planId=<planId>
Referenced artifact was not completely inspected
node ./scripts/getTags.js --token=<token>
Referenced artifact was not completely inspected
node ./scripts/getStyles.js --token=<token> --tagItemIds=<id1,id2,...>
Referenced artifact was not completely inspected
node ./scripts/triggerLayout.js --token=<token> --designId=<designId> --tagIds=<id1,id2,...> --styleId=<styleId> --applyDecorationStyle=true --buildCeiling=true
Referenced artifact was not completely inspected
node ./scripts/getLayoutResult.js --token=<token> --designId=<designId>
Referenced artifact was not completely inspected
node ./scripts/trigger-render.js --obsDesignId=<designId> --xToken=<token>
Referenced artifact was not completely inspected
node ./scripts/getRenderResult.js --token=<token> --designId=<designId>
The skill clearly instructs networked API use, token handling, uploads, polling, and rendering, but it declares no explicit tool scope or allowed-tools. Missing scope declarations weaken least-privilege controls and make it easier for an agent runtime to grant broader capabilities than users or reviewers expect.
The skill instructs users to place an access token in a local JSON file at the project root without any guidance on file permissions, secret management, or exclusion from source control. This can easily lead to credential leakage through local compromise, accidental commits, backups, logs, or shared workspaces.
The skill instructs continuous monitoring of a local inbound media directory for new images without clearly informing the user that local files are being watched and may be processed automatically. This undermines user awareness and can unintentionally ingest unrelated sensitive images placed in that directory by other workflows.
Continuous polling of a local inbound directory creates an implicit data collection channel outside the immediate chat interaction. In a skill that handles user images and uploads them to remote services, this broadens data exposure and increases the chance of collecting or transmitting unintended content.
The workflow says the user must confirm they understand quota or credit consumption before layout generation, but the documented flow proceeds directly into layout generation. This creates a consent bypass that can trigger billable or irreversible actions without an explicit authorization checkpoint.