local-api-chart-generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:55 AM UTC
• Version: 1.0.3

Overview

This skill does generate local API charts, but it ships an embedded bearer credential, silently falls back to demo data, and returns unsanitized active HTML.

Review this skill before installing. It should remove the embedded bearer token, require administrator-provided credentials, fail clearly instead of silently returning demo data, validate all user-derived parameters, generate HTML with proper escaping, and pin or bundle the charting library.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: build_chart.py:29

Finding

Hardcoded Bearer Credential in Source Code

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:25

Finding

Shell Command Injection Exposure in the Documented Execution Workflow

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: build_chart.py:70

Finding

HTML and JavaScript Injection Through an Unescaped Chart Title

Content

View full analysis

{title} ``` The same value is also embedded in an executable JavaScript context: ```python title: {{ text: '{title}', left: 'center', top: 20 }}, ``` The title is assembled from command-line values derived from the user's request: ```python title_parts = [args.fueltype1] if args.horsepower: title_parts.append(f"马力 {args.horsepower}") if args.emission: title_parts.append(args.emission) if args.displacement: title_parts.append(args.displacement) title_str = " | ".join(title_parts) + " 扭矩占比分布" ``` ### Technical Analysis The `title` value is inserted without context-sensitive encoding into two separate output contexts: 1. An HTML `` element. 2. A single-quoted JavaScript string inside an executable `<script>` block. HTML escaping alone would not make the JavaScript insertion safe. An attacker can supply characters that terminate the JavaScript string or the script element and then introduce executable markup or JavaScript. The Skill instructions require the generated HTML to be returned verbatim, making it likely that consuming applications will render attacker-influenced output. Using `json.dumps` for chart data demonstrates an appropriate serialization technique, but that protection is not applied to `title`. ### Attack Path 1. An attacker places an HTML or JavaScript payload in a fuel type or optional ...[truncated 984 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: build_chart.py:75

Finding

Unpinned Third-Party Script Executed Without Integrity Verification

Content

View full analysis

``` ### Technical Analysis The generated HTML downloads and executes ECharts from a third-party CDN. The URL does not pin an exact package version and does not include a Subresource Integrity hash. As a result, the effective JavaScript executed by generated charts can change after this Skill has been reviewed. A compromised registry, CDN, package release, or mutable package resolution could therefore introduce code that is absent from the audited project. This is a supply-chain risk rather than evidence that the current ECharts dependency is malicious. ### Attack Path 1. The unversioned dependency resolution or its delivery infrastructure is compromised or changed. 2. A user requests a chart and receives the generated HTML. 3. The user opens or embeds that HTML in a browser with network access. 4. The browser retrieves the altered script from jsDelivr. 5. The third-party script executes with the privileges of the chart document's browser context. ### Impact Assessment A malicious dependency can read or modify the generated document, intercept chart data, make network requests allowed by browser policy, and access origin-readable data when the page is rendered in a privileged application origin. The dependency does not execute in the Python process; its privileges are limited to the browser context in which the generated HTML is rendered. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented behavior materially differs from the described purpose: the skill appears to rely on command-line arguments instead of true natural-language parameter extraction, uses a hardcoded Bearer token for local API access, and may silently fall back to demo data on failure. Hardcoded credentials risk secret leakage and misuse, while undisclosed fallback behavior can mislead users into trusting fabricated or non-live results.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

A sensitive authorization token is sent in outbound requests without any disclosure to the user that the skill contains and uses privileged credentials. This increases the risk of secret exposure, unauthorized API use, and hidden access to protected internal data, especially in an agent skill context where users may assume only unauthenticated local processing occurs.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · build_chart.py (reported line 31)May include surrounding context.

python

ment:
        condition["displacement"] = [displacement]
    params = {"condition": condition, "select_options": []}
    temporary_name = ["37a7e623"]
    try:
        session = requests.Session()
        session.trust_env = False
        response = session.post(url_, json=params, timeout=10, headers={"Content-Type": "application/json","Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NDg2MywidXNlcm5hbWUiOiJMQUlYVUZFSSIsImV4cCI6MTc3ODgzNDQwNiwiaWF0IjoxNzc2MjQyNDA2LCJpc3MiOiJCRkNFQyIsImF1ZCI6IkRYUCJ9.BrHo5EKoLo8G-pUK6uoYJli1v3305egFMtwVhlXXcAY"})
        if response.status_code == 200:
            temporary_name = response.json().get("data", ["37a7e623"])
    except Exception as e:
        pass
    url = "http://127.0.0.1:9080/api/cdas/torque_proportion"
    params = {"condition":{"dataday":[time_range[0],time_range[1]], "temporary_name":temporary_name},"retrieval":[],"x_data":"func_deal_torque_range100(actual_torque)"}
    
    try:
        session = requests.Sessio

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill instructs execution of a local Python script that calls an API, but it declares no explicit tool scope or permissions boundaries. This creates an authorization and transparency gap: an agent may invoke network-capable behavior without the caller being clearly informed or the runtime enforcing least privilege.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented required response format hard-codes <html lang="zh-CN">, which imposes a specific locale on all outputs. This is a natural-language policy concern because the skill does not indicate that users may choose another language or that the locale restriction is optional or justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill hardcodes a bearer token directly in source and automatically uses it to access local APIs. Even though the endpoint is localhost, embedded credentials can be extracted, reused, and abused by anyone who can read the skill or its outputs, and the capability exceeds simple chart rendering because it silently grants authenticated access to protected data services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The HTML and chart labels are hard-coded to Chinese language settings and text, such as lang="zh-CN" and Chinese UI labels. This imposes a specific language/locale on all users without opt-in or explanation, which matches the policy's language/locale violation criteria.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description says the skill accepts natural-language instructions broadly and automatically extracts parameters, which creates an overly permissive activation surface. In a skill that calls a local API and returns generated HTML, broad triggering increases the chance of unintended invocation, unsafe parameter inference, and misuse of local resources or sensitive data paths.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill description is written entirely in Chinese and presents the capability as Chinese-oriented without indicating that users can choose another language or that the skill is intentionally restricted to a Chinese-language context. This can violate language/locale policy when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The generated HTML loads ECharts from a public CDN, creating an external network dependency in a skill that is described as using local APIs only. This can leak usage metadata, break in restricted environments, and expose users to supply-chain risk if the CDN resource is unavailable or tampered with.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.