有道云工作总结规划

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:11 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent work-note analysis purpose, but it needs Review because it accesses sensitive Youdao notes and automatically retains derived findings while generating active HTML reports with unsafe content handling.

Before installing, treat the Youdao Key like a password, limit the note search scope, and assume generated reports and `.workbuddy/memory/` may contain sensitive work information. Prefer an updated version that makes memory retention opt-in, sanitizes all note-derived report fields, and bundles or verifies Chart.js.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/analysis_report_template.html:133

Finding

Stored Cross-Site Scripting Through Unescaped Note-Derived Report Content

Content

View full analysis

Four: In-depth Insight Analysis

{{INSIGHTS}}

{{KEY_FINDINGS}}

Five: Detailed Category Descriptions

{{CATEGORY_DETAILS}}

Six: Optimization Suggestions

{{SUGGESTIONS}}

``` ```javascript let tableHtml = ''; for (let i = 0; i < categories.length; i++) { const diff = dataYear2[i] - dataYear1[i]; const diffText = diff > 0 ? '+' + diff + '%' : (diff < 0 ? diff + '%' : 'No change'); tableHtml += ` ${categories[i]} ${examples[i]}

${dataYear1[i]}%

${dataYear2[i]}%

${trends[i]} ${diffText}
${trendLabels[i]} `; } document.g ...[truncated 2998 chars]

Remediation

View remediation

`, `"`, and `'`. - HTML attribute context: use attribute-specific encoding and prohibit event-handler attributes. - JavaScript context: use a safe JSON serializer that escapes `<`, `>`, `&`, U+2028, U+2029, and script-closing sequences. 4. If formatted HTML is an explicit requirement, sanitize it with a maintained allowlist sanitizer. Allow only required formatting elements and prohibit scripts, event handlers, `javascript:` URLs, iframes, embedded objects, and unsafe CSS. 5. Validate all chart arrays and presentation metadata against strict schemas. Require finite numeric percentages and allowlisted color formats. 6. Add a restrictive Content Security Policy. Prefer external or hashed scripts, prohibit object embedding, and restrict network connections to required destinations. 7. Add security tests using payloads in every note-derived field, including HTML tags, event handlers, malicious URLs, quotes, backticks, and `` sequences. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:108

Finding

Untrusted Note-Derived Findings Are Written to Persistent Agent Memory

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: assets/analysis_report_template.html:7

Finding

Generated Reports Execute a Third-Party CDN Script Without Integrity Verification

Content

View full analysis

``` The report specification explicitly requires the same remote dependency: ```markdown - Use the Chart.js 4.x CDN: `https://cdn.jsdelivr.net/npm/chart.js@4.4.0/dist/chart.umd.min.js` ``` ### Technical Analysis Each generated report loads and executes JavaScript from a third-party CDN when opened. The URL pins Chart.js to version `4.4.0` and uses HTTPS, which reduces accidental version drift and network interception risk. However, the script element does not include a Subresource Integrity hash, and the report does not define a restrictive Content Security Policy. As a result, the report trusts the CDN delivery path and the hosted package asset at runtime. If that delivery path or asset is compromised, substituted JavaScript will execute when the report is opened. Runtime CDN loading also makes report rendering dependent on network availability and discloses request metadata, such as the user's IP address and access time, to the CDN. ### Attack Path 1. An attacker compromises the CDN delivery path, hosted package asset, or another component capable of modifying the remote response. 2. The attacker replaces the expected Chart.js response with malicious JavaScript. 3. A user opens either generated HTML report while connected to the network. 4. The browser retrieves the remote script without checking a cryptographic integrity hash. 5. The substituted script executes in the report's browser context. ### Impact Assessment A successful supply-chain compromise could execute attacker-controlled browser JavaScript in every affected report opened during the compromi ...[truncated 496 chars]

Remediation

View remediation

``` 4. Do not invent the integrity value; calculate and independently verify it against the exact distributed asset. 5. Add a restrictive Content Security Policy that permits scripts only from the selected source and preferably requires hashes or nonces. 6. Maintain a dependency inventory and periodically review Chart.js security advisories and supported versions. 7. Ensure reports fail safely and display a clear message when the dependency cannot be loaded. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs the user to provide a personal Youdao Cloud Note key for authentication but does not include a clear warning that the key is a sensitive credential. This raises the risk that users will disclose secrets too casually, and any accidental logging, reuse, or mishandling of the key could enable unauthorized access to their notes.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/planning_report_template.html (reported line 85)May include surrounding context.

html

<p style="margin-top:8px;font-size:13px;opacity:0.8">分析时间：{{ANALYSIS_DATE}} ｜ 规划周期：{{PLAN_PERIOD}}</p>
</div>

<!-- 一、当前vs建议 -->
<div class="section">
  <h2>一、当前 vs 建议 时间分配对比</h2>
  <p style="font-size:14px;color:#555;margin-bottom:16px;">{{ALLOCATION_RATIONALE}}</p>

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The description includes broad trigger phrases such as '工作分析', '工作总结分析', and '工作复盘', which are common everyday expressions that may cause the skill to activate in situations the user did not intend. In this skill, unintended invocation is more concerning because activation can lead to requests for a personal key and access to note data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to save generated HTML reports to the working directory and also persist core analysis data to local memory, but it does not warn the user that extracted note-derived artifacts will be written to local storage. Because the source material is work logs, the saved files may contain sensitive operational, managerial, or project information that users may not expect to remain on disk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to persist derived analysis data and key findings into .workbuddy/memory/ after completing the user-requested note analysis. This creates unnecessary secondary retention of potentially sensitive work-log summaries beyond the immediate reporting task, increasing the chance of later disclosure, unintended reuse, or cross-task data exposure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction to record classification ratios and key findings into persistent memory lacks consent, minimization, purpose limitation, and retention controls. Since the underlying data comes from personal work notes, even summarized memory entries may reveal confidential work patterns, priorities, or organizational details across future interactions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The HTML template explicitly sets the document language to zh-CN, which imposes a specific language/locale by default. Under the policy criteria, this is a natural-language locale constraint and there is no visible opt-in, alternative locale handling, or documented region-specific justification in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document sets lang="zh-CN" and all visible report text is written in Chinese, which enforces a specific language/locale. There is no indication in this file that the user can choose another language or that the Chinese-only output is a documented regional requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The title and the entire specification are written as mandatory report requirements in Chinese, which indicates the skill is prescribing a specific language/locale for generated output. The file does not offer user opt-in, alternative language options, or a documented region-specific justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This HTML code fetches and executes Chart.js from a third-party CDN, which is a network operation. The file contains no visible notice, comment, or other user-facing disclosure that the generated report depends on loading external remote code.

Content

No source excerpt is available for this finding.