Security audit
Security checks for vulnerabilities and agentic risk
This skill is a purpose-aligned GP-C200V printer helper that sends user-chosen print data to a configured printer or local bridge, with no hidden persistence or credential handling found.
Install this only if you intend Codex to generate and send print jobs to your GP-C200V or compatible ESC/POS printer. Review the configured printer or bridge host before use, and avoid passing untrusted host, port, file path, or print payload values from another service without validation.
The text says to "Always use GBK encoding for Chinese text," which imposes a specific language/locale handling rule in absolute terms. The file does not indicate any user opt-in, alternative encoding choice, or that this constraint is a documented regional compliance requirement.
The rule '中文必须用 GBK 编码' is a natural-language requirement that forces a specific language/locale behavior. The file does not indicate that users may choose another language or that this restriction is an optional, region-specific mode.
The header comment describes the library as sending ESC/POS commands to the printer via the Node.js TCP bridge (server.js), implying bridge-mediated transmission. However, the implementation includes connect() and sendRaw() methods that open a direct TCP socket to the printer and explicitly note this bypasses the HTTP bridge, which contradicts the documented behavior.
This code posts command data to an HTTP endpoint, transmitting the print message over the network. While the file comments describe the bridge technically, there is no user-facing warning, confirmation, or logging around this transmission, which fits the missing-disclosure criterion for network operations in code files.
The request target is built dynamically from serverHost and serverPort and then fetched without any allowlist, scheme restriction beyond hardcoded HTTP, or host validation. If an attacker can influence these options, they can cause the process to send requests to arbitrary internal or local network services, enabling SSRF-style network reachability and possible interaction with unintended endpoints.
// ====== HTTP Bridge send ======
async sendViaBridge(cmdArray) {
const resp = await fetch(`http://${this.serverHost}:${this.serverPort}/send`, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ message: cmdArray }),
The text says "ALWAYS use GBK encoding," which is a hard requirement tied to Chinese text handling and effectively forces a specific locale/encoding choice. The document does not offer user opt-in or explain a broader region-specific constraint beyond this printer reference, so it fits the language/locale policy concern.
The dependency uses a caret range (^0.7.2), which allows automatic installation of future patch/minor releases within the 0.x range rather than a fully fixed version. This increases supply-chain risk because builds are not fully reproducible and a compromised or breaking upstream release of iconv-lite could be pulled in without an explicit review. In this skill, the package is small and the dependency is common, so the issue is real but lower risk than in a package with many network-facing or privileged dependencies.
"author": "",
"license": "ISC",
"dependencies": {
"iconv-lite": "^0.7.2"
}
}
No suspicious patterns detected.