Security audit

Leafer Js

Security checks for vulnerabilities and agentic risk

Overview

This is a LeaferJS documentation skill with some broad routing and copyable persistence examples, but no evidence of hidden execution, data theft, or destructive behavior.

This skill is reasonable to install as a LeaferJS reference. Review its broad trigger terms if you only want it used for explicit LeaferJS requests, and do not copy the autosave example into a production editor without telling users what is stored locally and giving them a way to disable or clear it.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The example implements automatic persistence of the application tree into localStorage, which can retain potentially sensitive user-created canvas/document data across sessions without any access control, expiration, or consent flow. In a graphics editor or infinite-canvas context, saved objects may include proprietary designs, embedded text, or other sensitive content, making unintended persistence a real privacy and data-exposure risk on shared or compromised browsers.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger conditions are broad enough to activate on generic topics like canvas applications, visualization, UI layout, and graphics interaction, not just explicit LeaferJS requests. This can cause unnecessary skill invocation, expanding the skill’s influence over unrelated conversations and increasing the chance of incorrect guidance or context hijacking.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The skill description is written to provide behavior in Chinese without any indication that language should follow the user’s preference. This can override expected assistant behavior, reduce usability for non-Chinese users, and create opportunities for deceptive prompt steering if users cannot easily inspect or understand the injected skill behavior.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The sample enables periodic localStorage autosave with no user-facing notice or consent, so users may unknowingly leave persistent copies of their work in the browser. While this is primarily a privacy and transparency issue rather than direct code execution, it can still expose data to other local users, browser extensions, or future sessions.

Static analysis

No suspicious patterns detected.