Security audit

Shanku Paolu 1.0.0

Security checks for vulnerabilities and agentic risk

Overview

This skill scans and packages local files for departure-themed backup, but its framing, remote scripts, and unsafe filename handling create review-worthy data exposure risk.

Install only if you are using it on files you own or are explicitly authorized to copy. Treat it as a review item: it loads third-party scripts when opened, lacks integrity pinning, and has unsafe filename rendering, so avoid using it on confidential, employer-owned, regulated, or attacker-supplied folders unless those issues are fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: assets/scanner.html:287
Finding: DOM-Based HTML Injection Through Attacker-Controlled Filenames
Content: View full analysis
{ const row = document.createElement('tr'); row.innerHTML = ` ${file.name} ${file.type} ${formatFileSize(file.size)} ${file.lastModifiedDate} `; tbody.appendChild(row); }); ``` ### Technical Analysis `File.name` and `File.webkitRelativePath` originate from files selected by the user and must be treated as untrusted data. A filename can contain HTML metacharacters on supported filesystems. The code interpolates this data directly into `row.innerHTML`, causing the browser to parse it as markup rather than display it as text. A crafted filename containing an element with an event handler can therefore introduce active DOM content when `generateTable()` runs. The derived `file.type` value is also inserted through the same unsafe sink. The ...[truncated 2283 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: assets/scanner.html:8
Finding: Remote JavaScript Dependencies Loaded Without Subresource Integrity
Content: View full analysis
``` ### Technical Analysis The scanner loads and executes three JavaScript files from `cdn.jsdelivr.net` at runtime. None of the script elements provides a Subresource Integrity hash. Consequently, the browser trusts whatever JavaScript is returned by the remote service for those URLs. Although explicit dependency versions are present, the application does not cryptographically verify the returned files. A compromise affecting the CDN, upstream package content, or dependency delivery process could therefore cause unauthorized JavaScript to run in the scanner page. This risk is significant in this application because the remote scripts execute in the same context as the scanner logic. After the user selects a directory, that context contains references to browser-authorized files. A compromised dependency could inspect filenames, read selected file contents through browser APIs, alter archives, falsify results, or issue network requests. Chart.js is loaded but is not used by the examined application code. It therefore expands the remote attack surface without providing current functionality. The runtime dependencies also conflict with broad claims that the application has “zero dependencies” and that processing is entirely local: file processing is local under normal behavior, but executable code is retrieved from an external service when the page loads. ### Attack Path 1. The victim opens `scanner.html` while connected to the network. 2. The browser requests Chart.js, JSZip, and FileS ...[truncated 1388 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Ssd 4

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The overall workflow is designed to help a departing user locate a local tool, scan directories, select documents, and package them for extraction under the pretext of '离职备份' and '删库跑路'. In context, this materially facilitates unauthorized collection and exfiltration of local or employer data, making the skill substantially more dangerous than a generic file-management utility.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill claims the tool is '零依赖' and implies local-only behavior, but later states it depends on external CDNs and requires network access. This misrepresentation can cause users to trust the tool with sensitive local files under false assumptions about isolation and privacy.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad enough to activate on common requests about file scanning, organizing, or backup, increasing the chance the agent deploys this skill in routine situations involving sensitive user data. Because the skill facilitates bulk discovery and packaging of local documents, accidental invocation materially increases exposure risk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The statement that 'files do not leave the local machine' conflicts with the documented CDN usage, which introduces outbound network activity in the same browser context used to access local file metadata and selected content. Even if file contents are not intentionally uploaded, the contradiction creates an unsafe trust boundary and may mislead users handling sensitive documents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The workflow encourages scanning folders and packaging files for download without warning users about handling confidential, employer-owned, or regulated documents. In the context of 'departure backup' and '删库跑路', this omission makes the capability more dangerous because it normalizes bulk collection of potentially unauthorized data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill claims to be a pure local, zero-dependency single-file tool, but it loads executable JavaScript from external CDNs at runtime. For a tool whose purpose is scanning potentially sensitive local files and packaging them for export, this breaks the trust boundary: any compromised CDN asset or future code change could access selected files, file metadata, and user actions, enabling silent exfiltration or manipulation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The stated purpose emphasizes 离职前文件扫描与备份, suggesting an actual backup workflow. The implemented behavior lets a user pick a folder, view file metadata, select files, and download a ZIP, but it does not copy files to another location, synchronize them, or otherwise implement a true backup process beyond ad hoc export.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill name and triggers use slang strongly associated with sabotage or improper exfiltration, and there is no limiting language that frames the tool as compliant or authorized. In security review, such framing is a red flag because it signals probable intent to support abusive handling of data rather than legitimate backup alone.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill notes that external CDNs are required but does not warn users that opening the page causes network requests to third parties. For a tool presented as local/offline and used on sensitive files, failing to disclose this network behavior undermines informed consent and increases privacy risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document declares lang="zh-CN", and the UI text and date formatting are also hard-coded to Chinese, which imposes a specific language/locale on users. The file does not present this as an opt-in choice or explain that the tool is intended only for a China-specific audience.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.