T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:25- Finding
Potential Disclosure of User Input to an Unrelated Placeholder Service
- Content
View full analysis
- Remediation
View remediation
Security audit
邮轮产品 NPM 工具
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a remote cruise-product API wrapper, but its published instructions still include an unrelated test endpoint that could receive user input.
Review before installing. Use it only if you are comfortable with queries being sent to the listed remote cruise gateway, and do not send credentials, tokens, personal data, or confidential business content. The publisher should remove the httpbin.org placeholder and document what data the gateway receives, logs, and retains.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs users to send POST requests to external endpoints and mentions gateway forwarding, logging, and statistics, but it does not clearly warn that submitted data may be transmitted through third-party infrastructure and recorded. This creates a privacy and data-handling risk because users may unknowingly send sensitive prompts, credentials, or business data to external services.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The entire skill description is presented only in Chinese, with no indication that users may select another language or that the skill is intended exclusively for a Chinese-speaking or region-specific audience. This can violate a language/locale policy when documentation effectively forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The title, description, and operational instructions are entirely in Chinese, which can amount to a language-policy issue when no user opt-in or locale justification is provided. There is no indication that the skill is region-specific or that users may choose another language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description is written entirely in Chinese, but the file does not indicate that the skill is intended only for Chinese-speaking users or offer any language/locale choice. This can violate language or locale policy expectations when skills should not implicitly force a specific language without opt-in.
- Content
Static analysis
No suspicious patterns detected.