T09 · Insecure Skill Coding Practices
Error
- Location
make_data.py:27- Finding
Hugging Face access token is transmitted to an unofficial mirror
- Content
View full analysis
- Remediation
View remediation
Security audit
model-intel-check(zjh)
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly performs the advertised model benchmark, but it needs Review because it can expose credentials to an unofficial mirror and has under-scoped local/API controls.
Install only if you are comfortable with this skill using model API keys, making outbound benchmark calls, and writing full completions/results locally. Do not run make_data.py with HF_TOKEN unless the mirror behavior is fixed or you use a fine-grained read-only token you are prepared to revoke. Prefer official package/data sources, watch API cost/quota, and stop the local Web UI when finished.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
serve.py:202- Finding
Unauthenticated loopback endpoint permits browser-driven benchmark execution
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
web/index.html:236- Finding
DOM-based cross-site scripting through unescaped configuration and result values
- Content
View full analysis
{s.color=BOOK_COLORS[i%BOOK_COLORS.length];suiteMeta[s.kind]=s;}); $('hero-line').innerHTML= `被测模型 · ${CFG.model}`+ `thinking ${CFG.no_thinking?'关':'开'}`+ `并发 ${CFG.concurrency}`; $('books').innerHTML=CFG.suites.map(s=>`${s.ref_pct!=null?``).join(''); } ``` Result and dataset-derived values are also inserted into HTML: ```javascript for(const[kind,arr]of Object.entries(groups)){ const meta=suiteMeta[kind]||{}; html+=`官方参考 ${s.ref_pct}%`:''} ${bookSVG(s.color[0],s.color[1])}${s.name}共 ${s.count} 题${'★'.repeat(s.stars)}${'☆'.repeat(5-s.stars)}${meta.name||kind} · ${arr.length} 题`; for(const[k,v]of arr){ const changed=prevItems[k]&&prevItems[k].status!==v.status; const ch=v.status==='ok'?'✓':v.status==='miss'?'✗':v.status==='error'?'!':'·'; html+=`'; } $('arena').innerHTML=html; ``` Score labels are handled similarly: ```javascript scores+=`${meta.name||k}${ch}`; } html+='
${ok}/${n} ${pct.toFixed(1)}% `; $('r-scores').innerHTML=scores; ``` ### Technical Analysis The UI interpolates values into HTML strings and assigns them through `innerHTML` without HTML or attribute encoding. Sources include: - `model`, suite names, counts, stars, and referen ...[truncated 1739 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:69- Finding
Runtime dependencies are installed without version or integrity pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Ssd 2
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly recommends using a forged 'User-Agent: curl/8.0.1' to bypass an intermediary WAF block. That is an evasion technique intended to circumvent an access-control or abuse-detection mechanism, and it can facilitate unauthorized or policy-violating requests against third-party infrastructure.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to use environment variables, read local config files, create directories, write result files, access the network, and execute shell commands, but it does not declare any explicit tool or permission scope. That mismatch increases the chance the skill will be invoked with broader capabilities than users expect, enabling unintended access to secrets such as API keys or modification of local files.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to match common user wording like 'benchmark this endpoint' or '智力测试', which can cause the skill to activate in contexts the user did not intend. Over-triggering is dangerous because this skill performs sensitive actions such as reading local configuration, using API keys, running shell commands, and contacting external endpoints.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill documentation is written in Chinese, and there is no indication that the user may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill file is written in Chinese and includes mandatory wording such as '每次报告必须复述', but it does not offer any language or locale choice to the user. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script creates a client and submits jobs through run_one using model kimi-k3, which strongly indicates outbound API calls transmitting question content and possibly related metadata. The file does not include a visible warning, confirmation, or comment disclosing that data is sent to an external service.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document declares
lang="zh-CN", and the visible UI text throughout the page is fixed in Chinese, which indicates the skill experience is constrained to a specific language/locale. The file does not present an opt-in, language selector, or justification that this is a region-specific tool, so this conflicts with the policy against forcing a locale without user choice.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This code creates a timestamped JSONL file under the results directory, which is a file-write operation. While the script's purpose implies rerunning tasks, there is no explicit warning in the docstring or before the write that a new output file will be created.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file’s user-facing documentation and runtime guidance are entirely in Chinese, including usage instructions and operational messages, with no indication that another language is supported. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content