Security audit

伐谋 - 实验结果渲染

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent visualization helper, but users should know its generated HTML loads third-party CDN code when opened.

Before installing, understand that this skill creates an HTML file from your provided solution data. Do not use it for confidential optimization data unless you remove or locally bundle the CDN dependencies, and have the agent confirm the output path before writing so an existing famou_viz_result.html is not overwritten.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:101
Finding: Remote JavaScript Dependencies Without Integrity Protection
Content: View full analysis
``` ### Technical Analysis The Skill instructs the Agent to generate HTML documents that execute JavaScript fetched from third-party CDNs whenever a visualization is opened. Although the React and Babel URLs contain version numbers, none of the script elements provides a Subresource Integrity (`integrity`) hash. The Tailwind dependency is loaded from the unversioned `https://cdn.tailwindcss.com` endpoint, so its effective content may change after the Skill has been reviewed. This design makes the behavior of generated artifacts dependent on remotely controlled content. If a CDN account, distribution system, DNS path, or upstream asset is compromised, substituted JavaScript will execute in the generated page. The remote scripts execute in the same document context as the embedded `SOLUTION_DATA`, visualization DOM, and other page state. The instruction at line 141 describing the output as self-contained and offline-capable is also inconsistent with these runtime network dependencies. The generated page cannot obtain these resources offline unless they have already been cached or replaced with local files. ### Attack Path 1. A user supplies Python solution code or optimization-result ...[truncated 1668 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are overly broad, including generic phrases like '帮我可视化这个解', '画出来看看', and '展示一下结果', which can cause the skill to activate in unrelated contexts. In an agent setting, overbroad invocation can lead to unintended file generation, unnecessary processing of sensitive user code/data, and execution of a more privileged workflow than the user intended.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill’s HTML template pulls React, ReactDOM, Babel, Tailwind, and Google Fonts from external CDNs, which creates an external dependency and a supply-chain/network exposure for a workflow that is described as local-only visualization. If the generated file is opened in a browser, it will make outbound requests and execute third-party code, which can fail offline or expose users to tampered CDN content and metadata leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs writing directly to famou_viz_result.html without warning about file creation, overwrite risk, or asking for confirmation. In agent environments, silent file writes can overwrite user work, create artifacts in unexpected locations, and normalize side effects without informed consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The provided template hardcodes <html lang="zh">, and the surrounding instructions are written as if the visualization page should be produced in Chinese by default. This imposes a locale choice without offering user selection or documenting a justified region-specific requirement.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation states the output is self-contained and can be opened offline, but the provided template depends on remotely hosted scripts and fonts. This mismatch is security-relevant because users may trust the file as local-only while it actually performs network fetches, causing hidden data exposure, unpredictable execution, and operational failure in restricted environments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.