YunxiaoPM
Fail
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONTIME_DELAYED_CONDITIONALINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill contains logic to extract session cookies from the Chrome browser. Scripts like accept_release.py and list_projects.py use the browser_cookie3 library to programmatically access the user's local browser data.
- [REMOTE_CODE_EXECUTION]: The ensure-daily-skill-update.mjs script performs runtime updates using npx, which downloads and executes the latest versions of various skills from a remote repository.
- [COMMAND_EXECUTION]: Python and Node.js scripts within the skill utilize subprocess.run and spawnSync to execute system commands, including the Aliyun CLI and skill management tools.
- [DYNAMIC_EXECUTION]: Command arguments are dynamically assembled in yunxiao_cli_runtime.py, creating a potential path for command injection during CLI interactions.
- [TIME_DELAYED_CONDITIONAL]: A daily update trigger is implemented in ensure-daily-skill-update.mjs, which checks a local state file before executing remote updates.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from various sources such as chat logs and item descriptions to populate work items, creating an attack surface for indirect prompt injection as it lacks strict boundary delimiters for this data.
Recommendations
- AI detected serious security threats
Audit Metadata