T08 · Insecure Dependencies
Warning
- Location
package-lock.json:66- Finding
Native Dependency Installation Through an Alternate Package Registry
- Content
View full analysis
- Remediation
View remediation
Security audit
雄韬书法AI应用 - 汉字重心
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to perform local Hanzi visual-center analysis, but its install path runs a native npm dependency from an alternate registry, so it should be reviewed before installation.
Install only if you are comfortable running npm install for a native canvas dependency from the npmmirror registry. Prefer installing in an isolated environment, reviewing the lockfile and registry source, and using --no-png when you do not want files created in the working directory.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd "{baseDir}" && node scripts/analyze.js <汉字> [选项]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd "{baseDir}" && node scripts/analyze.js <汉字> [选项]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd "{baseDir}" && node scripts/analyze.js <汉字> [选项]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd "{baseDir}" && node scripts/analyze.js <汉字> [选项]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd "{baseDir}" && node scripts/analyze.js <汉字> [选项]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md cd "{baseDir}" && node scripts/analyze.js <汉字> [选项]
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill invokes a local Node.js script and references environment-capable execution, but it does not declare a restricted tool scope such as explicit permissions or allowed tools. In agent environments, missing scope boundaries can let the skill run with broader-than-necessary execution privileges, increasing the blast radius if the skill is mis-triggered or later modified to use additional environment access.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation description is broad enough to match ordinary discussion of Chinese characters, calligraphy, balance, or aesthetics, not just requests for pixel-level analysis. Over-broad routing can cause unintended execution of local code or file generation in response to benign conversation, violating least surprise and unnecessarily expanding the attack surface.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The '何时使用' section lists permissive, ambiguous conditions and lacks boundaries for when the skill should not run. In a tool-using agent, this can lead to frequent false-positive invocation, causing unnecessary code execution, PNG/JSON generation, and processing of user input that was meant for normal conversation rather than a local analyzer.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The CLI's natural-language interface, including help output and error/reporting text, is fixed to Chinese. This can violate language/locale policy when users are not given an opt-in choice or documentation justifying the locale restriction.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "author": "雄韬", "license": "ISC", "dependencies": { "canvas": "^3.2.3" } }
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code enables PNG output by default, and later writes a file to the current working directory. Although the CLI offers --no-png and logs after saving, there is no prior user-facing warning that running the command will create a file unless disabled.
- Content