Security audit

星火织境

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a normal immersive web-project scaffolder, with ordinary npm and CDN dependency risks users should review.

Install only if you want a Chinese-language Three.js/GSAP/Lenis web scaffold. Review generated package versions, consider adding a lockfile, and self-host Draco/KTX2 decoder assets before deploying a production site.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: scripts/scaffold.sh:18
Finding: Generated Project Installs Dependencies from Mutable Version Ranges Without a Lockfile
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: templates/three-scene.js:83
Finding: Generated Sites Can Retrieve Mutable Draco Decoder Code at Runtime
Content: View full analysis
{ // scene.add(gltf.scene); // }); ``` The same external decoder configuration is recommended in `reference.md:41-46`: ```javascript const draco = new DRACOLoader(); draco.setDecoderPath('https://www.gstatic.com/draco/v1/decoders/'); const loader = new GLTFLoader(); loader.setDRACOLoader(draco); loader.load('model.glb', (gltf) => { ``` ### Technical Analysis `DRACOLoader.setDecoderPath()` directs Three.js to retrieve Draco decoder resources from an external host when Draco-compressed content is loaded. These resources can include executable JavaScript and WebAssembly. The URL uses the mutable `v1` path rather than locally reviewed, immutable assets. The generated HTML does not define a restrictive Content Security Policy, and this loading mechanism does not provide an application-controlled integrity check for the fetched decoder files. The default template leaves model loading commented out, so the external request is not necessarily triggered by the unmodified scaffold. However, loading Draco-compressed GLB assets is an expressly documented use of the template, and uncommenting or adding the intended model-loading call activates the remote execution channel. The external provider is a recognized service, and there is no evidence th ...[truncated 1677 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/scaffold.sh (reported line 72)May include surrounding context.
sh
cat > .gitignore << 'GIT' node_modules/ dist/ .env GIT echo ""

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation phrases are overly broad and include common terms like "Three.js", "GSAP", "WebGL", and generic requests such as "复刻网站" or "vibe coding", which can cause the skill to trigger on many unrelated frontend or web-development conversations. This creates unsafe overreach: the agent may invoke this skill in contexts the user did not intend, leading to inappropriate fetching of URLs, project scaffolding, or guidance that overrides more suitable skills or default behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The alias list contains generic names such as "氛围编程", "网站复刻", "Three.js网页", and "GSAP动画", which are broad descriptors rather than unique identifiers for this specific skill. Such vague aliases increase the chance of accidental invocation during ordinary web-development requests, causing the system to route users into this skill even when they asked for general frontend help rather than this specialized replica/scaffold workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document declares lang="zh-CN", which sets a specific language/locale for the page. Under the policy, forcing a locale without user opt-in or clear justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code configures DRACOLoader to fetch decoder binaries from a third-party CDN at runtime, creating a supply-chain and privacy risk. If the remote asset is modified, unavailable, or blocked, model loading behavior can be altered or broken, and users make outbound requests to a third party without explicit disclosure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.