minium-test-generator

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:07 AM UTC
• Version: 1.0.0

Overview

This skill appears non-malicious, but it overstates its automation and asks for broad project file access and writes without enough scoping guidance.

Review this skill before installing if you expect a finished automatic generator. Use it only on a confirmed workspace, inspect any file changes before applying them, and redact tokens, cookies, account data, internal URLs, or other secrets from Minium recording scripts before sharing them with an agent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description presents a functional conversion tool that automatically parses Minium recording scripts and generates规范-compliant test cases and page objects while ensuring no steps are missed and logic remains consistent. The actual code only partially aligns with that purpose at a high level: it accepts CLI arguments, reads an input script, counts step markers, and invokes generator methods. However, the substantive behavior is missing. Operation extraction defines regex patterns but never uses them; page grouping is a stub; page/test/step-table generation methods are empty; and the advertised validation flag is parsed but not used. There is no evidence of undeclared malicious or unrelated behavior, but there is a strong description-to-behavior mismatch because the code is largely an unfinished skeleton rather than a working implementation of the declared tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

声明描述强调这是一个“录制脚本转测试用例工具”，核心能力应包括自动生成规范化测试用例和页面对象。实际代码的主要功能是：读取脚本文件，按 mark_step_start 切分步骤，基于简单字符串规则判断步骤类型，提取 XPath，并输出 Markdown 检查清单与对照表，供后续人工填写和验证。它没有生成测试用例文件、没有构建页面对象类/方法，也没有真正自动确保逻辑一致性，只是生成辅助审查模板。因此，代码行为与声明的核心用途存在实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

声明描述的核心能力是把录制脚本转换为测试用例和页面对象，并保证步骤完整、逻辑一致；而该代码并不生成任何测试用例或页面对象，也没有执行转换流程。它只是对现有录制脚本和现有测试用例进行比对校验，输出缺失步骤、逻辑保留情况和等待检查结果。虽然“确保步骤完整、逻辑一致”与其验证目标部分相关，但主功能明显从“生成工具”变成了“验证工具”，属于实质性描述不符。代码访问的资源仅是本地输入/测试文件，未见额外敏感权限问题。

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · .idea/SweepConfig.xml (reported line 4)May include surrounding context.

text

<?xml version="1.0" encoding="UTF-8"?>
<project version="4">
  <component name="dev.sweep.assistant.components.SweepConfig">
    <option name="autoApprovedTools">
      <set>
        <option value="list_files" />
        <option value="read_file" />

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill title and the entire user-facing README are presented only in Chinese, and the quick-start instruction implies users should interact directly with the skill in that language context. The file does not offer any language or locale choice, which can violate a policy requiring user opt-in before forcing a specific language.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill describes reading existing project files and creating or modifying files in user-specified directories, but it declares no explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can allow broader-than-expected filesystem access and make it harder for users or orchestrators to constrain the skill safely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

All user-facing descriptions, triggers, workflows, and examples are presented only in Chinese, effectively forcing a single language experience. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The core rule says the agent must first ask for the test-case directory, inspect whether it exists, and wait for confirmation before generating. But the later usage example shows the skill immediately running parse_steps.py, generate_pages.py, and validate_steps.py on generic paths without first collecting or checking the user directory, contradicting the declared required process.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Page Object rules state that the skill must not generate extra sleep() or wait_for() calls because wrapper methods already contain waiting logic. Later, the quality-control section says every page transition must add wait_for_page_success(), which directly conflicts with the earlier prohibition and could cause the agent to generate behavior opposite to its documented guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation directs the agent to create directories and files at user-specified paths without a strong upfront warning about filesystem modifications or guardrails on where writes may occur. In an automated agent setting, this can lead to unintended overwrites, writes outside the expected workspace, or changes to sensitive repositories if the path is mis-specified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Overly broad trigger phrases can cause the skill to activate on common requests and start reading project files or preparing file writes when the user did not intend to invoke this capability. Because this skill is designed to inspect local code and generate filesystem changes, accidental invocation increases the risk of unintended data exposure and unauthorized modifications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

An ambiguous core trigger scenario makes it difficult to distinguish between harmless conversation and permission to inspect local scripts or generate files. In a skill with file-read and file-write behavior, ambiguous activation can lead to unintended access to user project data or creation of artifacts in the wrong location.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

General trigger phrases without exclusion criteria can unintentionally launch a workflow that reads code, inspects directories, or prepares writes based on loosely related user messages. In this context, unintended invocation is more dangerous because the skill explicitly discusses operating on local paths and modifying project files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

该 Markdown 文档从标题、说明到示例命令注释全部以中文固定呈现，没有提供可选语言、双语说明，或声明该流程仅适用于中文团队/场景。根据规则，强制特定语言而无用户选择或明确正当说明，属于自然语言层面的语言/区域策略违规。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The entire file is written in Chinese and presents usage instructions as the default with no indication that other languages are supported or that Chinese is required for a region-specific reason. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The module docstring and user-facing CLI descriptions are written only in Chinese, with no indication that other languages are supported or that the language choice is intentional and optional. Per the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains natural-language text in the module docstring, CLI argument help, and console/report output that assumes a Chinese-speaking user. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide explicitly instructs users to copy and send the entire recorded .py script, but provides no warning that recorded test scripts may embed sensitive data such as access tokens, cookies, internal URLs, test accounts, or other secrets. In this skill's context, that omission increases the chance of unnecessary data disclosure to the agent or downstream systems during normal use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill instructs reading existing project structure and source files but does not clearly disclose upfront that local project data will be accessed. This weakens informed consent and can surprise users into exposing proprietary test code, internal paths, or other sensitive implementation details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill recommends exec/command-line checks on user-provided paths but does not include a safety warning about local command execution or guidance on avoiding command injection patterns. Even simple path checks become risky if later implemented with unsafe string interpolation or expanded to broader shell usage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The entire skill document is written in Chinese, including headings, instructions, and templates, with no indication that users may choose another language or that the skill is limited to a Chinese-speaking context. The policy explicitly calls for flagging language or locale constraints when they are imposed without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown template uses Chinese throughout and does not indicate that the skill is region-specific or that users may opt into another language. Under the language/locale policy rule, forcing a single language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file’s human-readable docstrings and guidance are entirely in Chinese, including the template description and usage instructions. This can constitute a language/locale policy violation when the skill does not offer any language choice or document that it is intentionally region-specific.

Content

No source excerpt is available for this finding.