萤火虫报价助手V5

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:08 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed compressor quotation tool, but its HTML output and tax calculation instructions create review-worthy business document risks.

Install only if you intend to generate branded Firefly compressor quotations. Before sending quotes to customers, verify the seller contact details, independently check VAT/tax totals, and avoid using the HTML output with untrusted customer-supplied text unless it is escaped or sanitized.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:224

Finding

Mandatory Third-Party Promotional Content in Agent Outputs

Content

View full analysis

📞 13825202084（邹先生）
📧 [e-mail]
🌐 www.fireflies.net.cn

广州市萤火虫智能装备技术有限公司

报价有效期：30 天

最终价格以合同为准

``` ### Technical Analysis The controlling Skill instructions require the agent to append fixed third-party contact and branding information to every generated quotation. This is not merely a configurable template default: the wording in `SKILL.md` establishes it as an unconditional requirement that modifies the agent's output behavior whenever the Skill is loaded. The same behavior is reinforced in both the executable quotation script and the HTML template. Consequently, an ordinary quotation request becomes a persistent promotional and lead-routing mechanism for the embedded company identity. No evidence was found that this instruction changes system safety constraints, accesses unrelated resources, or persists beyond the current Skill invocation. Its scope is limited to generated quotation content. ### Attack Path 1. A user loads or invokes the quotation Skill. 2. The agent reads `SKILL.md` as the controlling ...[truncated 978 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/quote-template.html:101

Finding

Unescaped HTML Placeholder Substitution Enables Active Content Injection

Content

View full analysis

客户名称{{CUSTOMER_NAME}}

联系人{{CONTACT_PERSON}}

联系电话{{CONTACT_PHONE}}

项目名称{{PROJECT_NAME}}

``` `assets/quote-template.html:114-117`: ```html {{LINE_ITEMS}} 设备总价{{TOTAL_PRICE}} ``` `assets/quote-template.html:129-132`: ```html

安装调试费{{INSTALL_AMOUNT}} 万元

{{OPTIONAL_FEES}}

不含税合计{{SUBTOTAL}} 万元

``` ### Technical Analysis The HTML-generation procedure specifies direct placeholder replacement. Customer-controlled values such as customer name, contact name, phone number, and project name are inserted directly into HTML element content. Structural placeholders such as `LINE_ITEMS` and `OPTIONAL_FEES` are inserted as raw markup. No escaping, sanitization, allowlist, Content Security Policy, or trusted rendering implementation is provided. If a supplied value contains HTML, it can terminate the intended element and inject arbitrary markup. Depending on br ...[truncated 2000 chars]

Remediation

View remediation

`, `"`, and `'` before interpolation into element content. 4. Generate line-item and optional-fee rows from validated data structures rather than accepting preformatted HTML strings. 5. If limited rich text is required, sanitize it with a strict allowlist that excludes scripts, event-handler attributes, frames, forms, external resource elements, and unsafe URLs. 6. Add a restrictive Content Security Policy, for example prohibiting scripts, frames, forms, and remote connections unless explicitly required. 7. Add automated tests using payloads containing closing tags, event handlers, scripts, remote images, and malformed markup. 8. Document separate escaping requirements for text nodes, attributes, URLs, and any intentionally permitted HTML contexts. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/calculate.py:139

Finding

Contradictory Tax Semantics Cause VAT to Be Added to VAT-Inclusive Prices

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This HTML template sets the document language to zh-CN and presents the document primarily in Chinese throughout, which effectively forces a specific language/locale. The file does not indicate that the locale is optional, user-selectable, or limited to a clearly documented region-specific use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This YAML manifest includes natural-language instructions and descriptions exclusively in Chinese in the header comments, such as usage guidance and update metadata. Under the language/locale policy rule, forcing a single language without user opt-in or a documented regional justification is a policy concern, especially because these comments describe how the skill should be used.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill name, command description, and all user invocation examples are presented in Chinese, with no indication that users may interact in other languages or that the skill is intentionally limited to a Chinese-speaking context. This can violate language/locale policy expectations when a skill implicitly forces one language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This file embeds the company name and tagline entirely in Chinese in visible text elements. Because SQP-3 applies to all file types and flags forced language without user opt-in, this is a natural-language locale constraint with no indication of user choice or documented regional justification in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file’s user-facing documentation and CLI descriptions are written in Chinese, and the script later emits fixed Chinese output, indicating a language constraint. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless a justified locale restriction is documented, which is not present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.