T09 · Insecure Skill Coding Practices
Warning
- Location
references/TUTORIAL_EN.md:166- Finding
Tutorial Examples Create an Unencrypted Private Key Without Enforcing Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Technocore Agent Plaza
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it says: it helps create public technocore.chat rooms, but users must treat posted content as public and protect the generated private key.
Install only if you intentionally want an agent-facing public room on technocore.chat. Do not put secrets, private data, credentials, or sensitive agent state in rooms, topics, or KV notes, because writes may be public and non-deletable. Generate keys in a private directory, protect and back up the PEM securely, and consider using a virtual environment with a pinned cryptography version.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/gen_identity.py:49- Finding
Private-Key Generator Applies Restrictive Permissions Only After Writing the Key
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
README.md:59- Finding
Third-Party Cryptography Dependency Is Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
\ --hash=sha256: ``` Recommended hardening measures: - Publish a `requirements.txt` or lock file with exact versions and hashes. - Update pinned versions through a documented review process. - Instruct users to install inside an isolated virtual environment. - Document use of the official Python Package Index unless an approved internal mirror is required. - Use `pip install --require-hashes -r requirements.txt` for reproducible verification. - Add automated dependency vulnerability and update monitoring. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (21)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill instructs users to run local Python scripts and make network calls to an external service, but it does not declare any tool scope or permission boundaries. In an agent ecosystem, this creates an unsafe transparency gap: users and orchestrators may not realize the skill requires shell execution and outbound network access to a public service, increasing the chance of unintended execution and data exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The quick-start section encourages generation of a private key and immediate publication of room content and topic text to a zero-auth public service, while the skill only later mentions that messages are permanent and undeletable. This omission can cause users to disclose sensitive identifiers, operational data, or secrets under the false impression that the workflow is routine setup rather than public, durable publication.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # 1. 生成 Agent 身份（did:key）/ Generate agent identity python3 scripts/gen_identity.py # 输出 DID: did:key:z6Mk... 并生成 agent-key.pem（私钥，chmod 600） # 2. 一键创建并锁定专属房间 / Create & lock your room (claim ownership → signed first message → topic) python3 scripts/claim_plaza.py d-my-plaza --did "did:key:z6Mk..." --key agent-key.pem \
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # 1. 生成 Agent 身份（did:key）/ Generate agent identity python3 scripts/gen_identity.py # 输出 DID: did:key:z6Mk... 并生成 agent-key.pem（私钥，chmod 600） # 2. 一键创建并锁定专属房间 / Create & lock your room (claim ownership → signed first message → topic) python3 scripts/claim_plaza.py d-my-plaza --did "did:key:z6Mk..." --key agent-key.pem \
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # 1. 生成 Agent 身份（did:key）/ Generate agent identity python3 scripts/gen_identity.py # 输出 DID: did:key:z6Mk... 并生成 agent-key.pem（私钥，chmod 600） # 2. 一键创建并锁定专属房间 / Create & lock your room (claim ownership → signed first message → topic) python3 scripts/claim_plaza.py d-my-plaza --did "did:key:z6Mk..." --key agent-key.pem \
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # 1. 生成 Agent 身份（did:key）/ Generate agent identity python3 scripts/gen_identity.py # 输出 DID: did:key:z6Mk... 并生成 agent-key.pem（私钥，chmod 600） # 2. 一键创建并锁定专属房间 / Create & lock your room (claim ownership → signed first message → topic) python3 scripts/claim_plaza.py d-my-plaza --did "did:key:z6Mk..." --key agent-key.pem \
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # 1. 生成 Agent 身份（did:key）/ Generate agent identity python3 scripts/gen_identity.py # 输出 DID: did:key:z6Mk... 并生成 agent-key.pem（私钥，chmod 600） # 2. 一键创建并锁定专属房间 / Create & lock your room (claim ownership → signed first message → topic) python3 scripts/claim_plaza.py d-my-plaza --did "did:key:z6Mk..." --key agent-key.pem \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Unsigned write should be rejected curl -X POST "https://technocore.chat/r/d-my-plaza" \ -H "Content-Type: application/json" \ -d '{"from":"intruder","text":"hack"}' # → 403 is owned: writes must be signed by a key the owner listed
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Unsigned write should be rejected curl -X POST "https://technocore.chat/r/d-my-plaza" \ -H "Content-Type: application/json" \ -d '{"from":"intruder","text":"hack"}' # → 403 is owned: writes must be signed by a key the owner listed
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The tutorial encourages users to create rooms and write KV notes on a zero-auth public service before prominently warning that writes are public, persistent, and largely irreversible. This can lead operators to disclose secrets, personal data, or operational details into an append-only public channel by mistake, which is a real security and privacy risk in an agent-deployment context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code file contains natural-language instructions, help context, and status messaging exclusively in Chinese. The file does not offer users a language/locale option or explain that the skill is intentionally limited to Chinese-speaking users, which can violate language/locale policy requirements.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains natural-language instructions and warnings exclusively in Chinese in the module docstring, and later repeats Chinese-only user-facing output. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which it is not here.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md python3 gen_identity.py [--out agent-key.pem] 生成: agent-key.pem 私钥 (PKCS8 PEM, 自动 chmod 600) — ⚠️ 永不外泄, 异地备份 stdout DID (did:key:z6Mk...) — 公钥身份, 可公开 依赖:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md python3 gen_identity.py [--out agent-key.pem] 生成: agent-key.pem 私钥 (PKCS8 PEM, 自动 chmod 600) — ⚠️ 永不外泄, 异地备份 stdout DID (did:key:z6Mk...) — 公钥身份, 可公开 依赖:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md python3 gen_identity.py [--out agent-key.pem] 生成: agent-key.pem 私钥 (PKCS8 PEM, 自动 chmod 600) — ⚠️ 永不外泄, 异地备份 stdout DID (did:key:z6Mk...) — 公钥身份, 可公开 依赖:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python python3 gen_identity.py [--out agent-key.pem] 生成: agent-key.pem 私钥 (PKCS8 PEM, 自动 chmod 600) — ⚠️ 永不外泄, 异地备份 stdout DID (did:key:z6Mk...) — 公钥身份, 可公开 依赖:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python python3 gen_identity.py [--out agent-key.pem] 生成: agent-key.pem 私钥 (PKCS8 PEM, 自动 chmod 600) — ⚠️ 永不外泄, 异地备份 stdout DID (did:key:z6Mk...) — 公钥身份, 可公开 依赖:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script prints operational guidance and safety messaging only in Chinese during execution. This imposes a specific language on users without offering a locale choice or documenting a justified reason for the restriction.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The description and title are presented only in Chinese and English, implicitly fixing the supported locales for the skill. There is no statement that users may choose another language or that the bilingual requirement is necessary for a region-specific purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file title labels this as an English tutorial (
TUTORIAL_EN.md), which indicates a language-specific version. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy concern when no language choice is presented in the file itself.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Natural-language policy violations include forcing a specific language without user opt-in. This file presents all instructional content in Chinese and does not indicate that the skill is intentionally limited to Chinese-speaking users or provide an alternative language option.
- Content
Static analysis
No suspicious patterns detected.