T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/recall.py:160- Finding
Bearer Credential and Sensitive Query Exposure over Unencrypted HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
librag-recall
Security checks for vulnerabilities and agentic risk
Overview
This skill coherently calls a configured LibRAG knowledge-base recall API, with some disclosure and transport-safety caveats users should understand.
Install only if you intend to send knowledge-base questions to your configured LibRAG service. Keep the API key private, prefer a loopback or HTTPS base_url, avoid confidential questions if the endpoint or logs are not trusted, and rotate the key if it may have been exposed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill invokes a Python script that reads local configuration and performs outbound network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and increases the chance the skill is invoked with broader capabilities than users or the host expect, especially since it handles secrets like an API key and can contact arbitrary endpoints from config.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The name and description explicitly position the skill for Chinese scenarios only ("zh", "适用于中文场景下") without indicating that users may choose another language or that the restriction is mandatory for compliance reasons. This can violate language/locale policy expectations when no opt-in or justification is provided.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger phrases are broad, natural-language requests such as '去知识库里查一下' and '从文档中找到答案', which can easily overlap with ordinary user intent and cause accidental invocation. In this skill, unintended activation is more concerning because execution reads local config and sends the user's query plus a stored API key to an external service, potentially exposing data or causing unauthorized retrieval from a knowledge base.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code sends the user-provided question and multiple request parameters to a remote API endpoint, and includes a bearer API key in the request headers. The script has no confirmation prompt, warning print, or inline user-facing disclosure before transmitting that data, so users may not realize their query content is being sent off-host.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The display name and description explicitly present the skill as Chinese-only ("中文召回", "做中文知识库检索") with no indication that users can opt into another language or locale. This can violate language/locale policy when a skill appears to force a specific language without documented justification or user choice.
- Content