Huo15 Mind Map

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:01 AM UTC
• Version: 1.2.0

Overview

This is a local mind-map converter and renderer that reads and writes user-specified files, with no network, persistence, credential access, or hidden privilege behavior found.

Install this for local mind-map conversion/rendering if you are comfortable with it reading input files and writing output files at paths you provide. Review output paths before running conversions, especially when using absolute paths or overwriting existing files, and note that some command-line help text may be less complete than the main skill description.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code generally matches the core declared purpose: it is a mind-map generation/conversion tool handling the declared input families and most declared output formats, including image/document exports. However, the description materially overstates the available styling capabilities: the CLI help and examples only advertise four styles, not the thirteen named in the description. Additionally, the code supports JSON output, which is an undeclared capability, though this is relatively minor and related to the main purpose. Overall, the primary purpose aligns, but the declared feature set—especially the style catalog—does not accurately represent the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code clearly belongs to a mind map rendering feature, so the general domain matches the description. It implements style selection, layout, font handling, and graphical export to PNG/PDF/SVG. However, the declared purpose is materially broader: it claims multi-format import (Markdown/JSON/OPML/XMind) and multi-format export including XMind, OPML, FreeMind, and Markdown. None of those conversion/parsing capabilities appear in this code chunk. The code only renders an already-constructed Node tree to image/vector outputs. Additionally, while 13 style objects are present in the registry, the public list_styles() function returns only 10 styles, which is a smaller discrepancy. Overall, the description overstates the implemented capabilities in this supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code substantially matches the core domain of mind-map processing and does support several declared formats: Markdown, JSON, OPML, XMind input/output, and FreeMind export. However, the declared description includes major capabilities not present in this code chunk: there is no PNG, PDF, or SVG export, and no implementation of any of the 13 named styles/themes. The code focuses on a unified tree model and format conversion/serialization rather than visual rendering or styled output. This is a material description-behavior mismatch, even though the main high-level purpose (mind-map import/export) is aligned.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents and encourages file-reading and file-writing behavior through CLI examples and APIs, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, undeclared filesystem capabilities weaken least-privilege controls and can let the skill access or write files more broadly than users expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Embedding a long ambiguous trigger list directly in the manifest description makes routing less precise and can cause accidental invocation on generic mind-mapping prompts. In a skill that can read inputs and write outputs, misrouting increases the chance of unintended file handling and confusing privilege use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are very broad and overlap with common user requests, increasing the chance the skill activates in situations beyond the user's clear intent. Over-broad activation can expose local files or cause file generation/conversion actions in contexts where another skill should respond, which is more concerning here because the skill handles filesystem input and output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring, usage examples, and user-facing descriptions are entirely in Chinese, and later argparse descriptions continue this pattern. This can violate a language/locale policy when a skill mandates a specific language without user opt-in or a documented regional justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file-level docstring says output is determined by extensions including json and lists only four styles, while the argparse description later advertises only XMind/OPML/Markdown + PNG/PDF. The manifest claims broader export support and 13 built-in styles, but this script exposes only a subset in its user-facing documentation, creating a mismatch between claimed skill behavior and what this entrypoint presents as supported.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest and this module both indicate support for a larger built-in style set, and the registry in L268-L329 includes editorial, bauhaus, and swiss. However, list_styles() returns only the older 10-style subset, so the code documentation and exposed helper disagree with actual supported behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring and several user-visible defaults are written only in Chinese, including exported defaults such as '思维导图'. This imposes a specific language/locale choice in natural-language content without offering user selection or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.