radxa docs

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:34 AM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent for Radxa offline documentation, but its deploy/update workflow runs unverified code from an external repository.

Review the MDMaker repository and pin a trusted commit before deploying or updating. Run it only in an account or sandbox without sensitive credentials, and avoid using the update workflow unless you trust the current upstream code and package resolution path.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:35

Finding

Unpinned Third-Party Code Retrieval and Execution

Content

View full analysis

Remediation

View remediation

``` 2. Verify the selected revision before running any Python code. Prefer a signed commit or signed tag and enforce signature verification against an explicitly trusted maintainer key. 3. Where feasible, vendor the minimal required scripts into the skill package after security review. This keeps the executable payload within the audited artifact. 4. Record and validate a cryptographic checksum for every externally retrieved executable script or release artifact. 5. Replace unconstrained package installation with a reviewed lock file containing exact versions and hashes, for example: ```bash python -m pip install --require-hashes -r requirements.lock ``` 6. Explicitly configure trusted package indexes and prevent fallback to unexpected indexes or untrusted mirrors. 7. Before running the update script, fetch the expected revision, verify its commit identity and signature, inspect that the working tree is clean, and only then execute the script. 8. Run repository-provided scripts in a restricted environment with minimal filesystem access, no unnecessary credentials, and constrained network access. Do not run them as root. 9. Fail closed if repository, signature, commit, checksum, or dependency verification does not succeed. ]]>

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description promises an end-to-end offline documentation skill covering board detection, product-series mapping, local documentation mirror deployment/update, and offline documentation querying. The supplied code chunk implements only one narrow part of that description: basic model detection through standard system files and fallbacks. There is no evidence of any MDMaker directory management, documentation synchronization, series mapping, or doc query functionality. Because the actual behavior is substantially narrower than the declared purpose, this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

When a document contains relative `.md` links with `../`, normalize the link against the current document path, then open the resolved file under the same `dist/<lang>/` tree.

## Output Rules

- Quote concrete file paths when citing local documentation.
- State clearly when the answer is confirmed from local docs versus inferred from model mapping.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language content in the skill description and default prompt is entirely in Chinese, with no indication that the user can choose another language or locale. This can violate a language/locale policy when a skill imposes a specific language by default rather than offering user opt-in or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.