T08 · Insecure Dependencies
Warning
- Location
SKILL.md:146- Finding
Unpinned Global Installation of Third-Party Packages
- Content
View full analysis
- Remediation
View remediation
Security audit
DomainAgentHub
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent task-routing helper, but it under-discloses its effective delegation and local gateway behavior while recommending broad agent routing and unpinned global tool installs.
Review this skill before installing if you expect strict permission transparency. It should disclose local gateway use, agent delegation targets, inherited permissions, and any external services before sending tasks to other agents; avoid running the suggested global npm install commands unless you verify package provenance and versions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
package.json:39- Finding
Permission Metadata Conflicts with Gateway and Agent-Delegation Behavior
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The domain keyword lists are very broad and include common words such as '写作', '搜索', '规划', '代码', and '文档' that appear in many normal conversations. In a routing skill, such overlap increases the chance of false matches, unintended activation, and misclassification that could send user requests to the wrong downstream tools or agents.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The usage description says the skill will automatically determine the user's task domain and recommend solutions, but it does not define narrow activation boundaries or explicit user consent. Because the covered domains and examples are broad everyday activities, this can cause unintended invocation or overreach into requests the user did not mean to route through this hub skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description and operational instructions are entirely in Chinese and present the behavior as the default interaction mode, with no indication that users may choose another language. This can violate language/locale policy when the skill is deployed in multilingual environments without explicit opt-in or a documented region-specific constraint.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The routing rules use very broad keyword/domain matching and position this skill as a front-door dispatcher for many common tasks, which can cause unintended invocation or misrouting. In practice this can trigger the wrong downstream agent or tool path for benign user requests, increasing the chance of unnecessary tool use, incorrect handling, or policy bypass through ambiguous phrasing.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The natural-language description is entirely in Chinese and presents the skill's behavior in that language with no indication that users may choose another language or locale. For a general-purpose skill package, this can violate language/locale policy expectations when no opt-in or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill documentation is entirely in Chinese and presents behavior and usage only in that language, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the policy, forcing a specific language without opt-in can be a natural-language policy issue.
- Content
Static analysis
No suspicious patterns detected.