T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:24- Finding
Unnecessary Disclosure of User Input to an Unrelated Third-Party Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
奢华邮轮体验
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a cruise-search MCP wrapper, but its instructions also tell agents to send user input to an unrelated httpbin.org endpoint.
Review before installing. The cruise MCP remote appears purpose-aligned, but users should not allow the skill to send prompts, travel details, booking information, or other personal content to httpbin.org. The publisher should remove that endpoint and document only the intended CruiseSkillBridge gateway and exact data fields used.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The title, description, headings, and usage instructions are all presented in Chinese, and the file does not state that the skill is region-specific or provide any user opt-in for language preference. This can violate language/locale policy when users are not given a choice or informed of the restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file’s natural-language instructions and description are exclusively in Chinese, which imposes a specific language on users without any opt-in or alternative language option. Under the stated policy, forcing a language without user choice is a natural-language policy violation unless the locale restriction is clearly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill description is written entirely in Chinese, which imposes a specific language/locale without indicating that users may choose another language or that the skill is intended only for a Chinese-speaking region. This can violate language/locale policy when no opt-in or documented regional constraint is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill description and usage context are presented entirely in Chinese, which can impose a language constraint on users without any opt-in or alternative locale support. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
L16-L20 的“能力”部分仍保留了“请替换为你的真实内容”等模板说明，而同一文件 L43-L47 已明确声明实际工具为
product_list，用于按品牌、目的地等条件筛选邮轮产品。这种文档内容与实际声明的工具能力不一致，会误导使用者对技能真实用途和输入输出的理解。- Content