语构 App Builder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:56 AM UTC
• Version: 1.0.5

Overview

The skill mostly matches its app-builder purpose, but it pushes agents to publish apps automatically and includes credential-bearing network and destructive account actions that need clearer user control.

Review this skill before installing. Use a revocable, least-privilege API key; do not use --insecure or untrusted YUGOO_BASE_URL values; require explicit approval before publishing, unpublishing, deleting conversations, deleting versions, or uploading local files; and inspect generated apps for secrets or unsafe behavior before making them public.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:1335

Finding

Mandatory Publication and Agent Output Hijacking

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/yugoo_cli.py:133

Finding

Bearer API Credential Can Be Sent to an Arbitrary or TLS-Unverified Endpoint

Content

View full analysis

Dict[str, str]: return { "Authorization": f"Bearer {token}", "Content-Type": "application/json", "Accept": "application/json", "User-Agent": f"yugoo-cli/{VERSION}", } ``` ```python def _get(cfg: dict, path: str, params: Optional[dict] = None) -> Any: """HTTP GET helper.""" url = f"{cfg['base_url']}{path}" try: resp = requests.get(url, headers=_headers(cfg["token"]), params=params, timeout=cfg["timeout"], verify=cfg["verify"]) ``` ```python def _post(cfg: dict, path: str, body: Optional[dict] = None) -> Any: """HTTP POST helper.""" url = f"{cfg['base_url']}{path}" try: resp = requests.post(url, headers=_headers(cfg["token"]), json=body or {}, timeout=cfg["timeout"], verify=cfg["verify"]) ``` ```python parser.add_argument( "--base-url", default=os.environ.get("YUGOO_BASE_URL", DEFAULT_BASE_URL), help=f"API base URL (default: {DEFAULT_BASE_URL})", ) parser.add_argument( "--timeout", type=int, default=int(os.environ.get("AUTOAGENT_TIMEOUT", "30")), help="HTTP request timeout in seconds (default: 30)", ) parser.add_argument( "--insecure", "-k", action="store_true", default=os.environ.get("AUTOAGENT_INSECURE", "").lower() in ("1", "true", "yes"), help="Disable SSL certificate verification", ) ``` ```python # Resolve token: --token arg > CREO4U_SKILL_API_KEY env var > prompt user token = args.token if not token: token = os.environ.get("CREO4U_SKILL_API_KEY") if not token: # Prompt user for API key print("Warning: CREO4U_SKILL_API_KEY environment ...[truncated 2436 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/yugoo_cli.py:498

Finding

Local File Upload Uses an Unvalidated Server-Supplied Destination

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 88% confidence

Finding

The skill contains imperative hidden-style instructions such as 'IMPORTANT' and 'You MUST follow these rules strictly' that attempt to control agent behavior at a high priority. In an agent ecosystem, this is a prompt-injection risk because the skill text can override or compete with host safety policies and push the agent into rigid behaviors such as forced polling, publication, or result formatting.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

_API_KEYenvironment variable — no need to pass--token` or any API key parameter.

---

语构 App Builder

语构 is a chat-driven full-stack application builder. Users describe what they want in natural language and 语构 generates a production-ready web application, including frontend UI, backend services, database schema, and a live development environment.

This skill enables AI agents to interact with the 语构 platform to create, iterate, publish, and deploy applications.

All platform operations must be executed through the CLI script:

bash

python scripts/yugoo_cli.py [global options] <command> [command options]

IMPORTANT: Argument Order — Global options (--token, --base-url, --insecure, --timeout) must appear BEFORE the subcommand. Placing them after the subcommand will cause a parse error.

bash

# ✅ Correct — global options before subcommand
python scripts/yugoo_cli.py --token TOKEN create --name "My App"

# ❌ Wrong —

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill exposes meaningful capabilities—environment access for API keys, local file reading, and network operations—without declaring an explicit tool/permission boundary. In an agent setting, missing scope declarations can cause overbroad execution and make it harder for hosts to sandbox or review what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file first defines a development/preview URL at L0319-L0325, then at L0332-L0340 presents the identical 'https://preview-{conversation_id}.creo4u.com/' format as the production URL. That is an active contradiction in the skill documentation about what URL corresponds to preview versus production behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented delete command terminates a conversation and appears destructive, yet the skill provides no prominent warning, confirmation requirement, or recovery guidance. For agent-driven execution, this creates a meaningful risk of accidental data loss or denial of access to application state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents a destructive delete-version action without requiring confirmation, safety checks, or explicit warning about irreversible loss of WIP work. In an autonomous agent workflow, that increases the chance of accidental destructive actions from ambiguous prompts or misrouted requests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

L1095 says 'The chat and publish commands with --watch use polling to monitor progress,' but the publish command is consistently documented earlier as using --wait rather than --watch (for example L0563-L0570 and L0580-L0589). This is a direct documentation contradiction about how to invoke polling for publish.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs agents to always publish and share application URLs after development, regardless of whether the user requested deployment or whether the generated app may contain sensitive logic, secrets, or unsafe content. Automatic publication materially increases the risk of unintended public exposure and turns a development workflow into a deployment action without adequate consent gates.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes a skill for managing Yugoo development conversations, build progress, results, publishing, and versions. This code adds a general local-file exfiltration path by reading any user-specified file, hashing it, obtaining upload credentials from the platform, and posting the file contents to an external OSS host, which is not explicitly justified by the stated purpose at the manifest level.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest focuses on building apps through chat, monitoring builds, extracting results, publishing, and managing versions. Listing marketplace items and cloning an existing market app introduces a separate marketplace/bootstrap capability that is not mentioned in the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The CLI allows TLS certificate verification to be disabled via --insecure or an environment variable, while sending bearer tokens and potentially sensitive conversation content to remote endpoints. In an agent/automation context, this materially increases risk of man-in-the-middle interception, credential theft, and tampering with API responses or uploaded build instructions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

L0063 states 'Do not call platform APIs directly. Always use the CLI commands provided by this skill,' but this file is itself only documentation for those commands and contains no enforcement mechanism. This is a mild intent/documentation divergence because the statement presents a strict behavioral rule without code or policy backing in the artifact provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The guidance includes fixed Chinese progress-message examples and elsewhere uses Chinese-only example content, but the document does not state that language is optional or user-selected. This can create a language/locale policy issue if agents infer they should operate or respond in Chinese by default rather than matching user preference.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

L1335-L1337 instructs agents not to manually inspect generated code files after a build, but elsewhere the skill explicitly describes extracting generated results including files and exposes files_generated/files_modified in result output (for example L0003 and L0672-L0690). While not a runtime contradiction, it is conflicting intent guidance about whether file-level inspection is part of expected usage.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The inline comment says 'Polling mode with fixed 5s interval' and the parser help for --watch also says '(5s interval)', but cmd_chat passes interval=15.0 and logs 'Polling every 15.0s...'. This is an active contradiction between documentation and runtime behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest does mention build progress, results, publishing, and version management, but it does not mention billing, cost analytics, or credit consumption inspection. Accessing spending records adds an account/usage-reporting capability outside the described app-builder workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.