T09 · Insecure Skill Coding Practices
Error
- Location
tools/miaomiao_client.py:19- Finding
API Credentials and Conversation Data Can Be Forwarded to an Arbitrary Server
- Content
View full analysis
- Remediation
View remediation
Security audit
秒秒AI助理
Security checks for vulnerabilities and agentic risk
Overview
The skill is a broad third-party AI assistant, and while external API use fits its purpose, its broad auto-triggering, configurable destination, and raw debug logging need review before installation.
Review this before installing if you may handle private prompts, documents, locations, shipment numbers, travel plans, or account-sensitive data. Use it only when users clearly intend to call the external assistant, keep debug logging disabled, protect the .env file, avoid setting MIAOMIAO_API_URL to untrusted hosts, and reconcile the documented LINKAI_* variables with the SDK's MIAOMIAO_* variables before deployment.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
tools/miaomiao_client.py:22- Finding
Debug Mode Logs Complete User Prompts and API Responses
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger phrases are extremely broad, including terms like '任意问题、聊天' and common everyday intents such as weather, news, search, summary, and maps. In an agent ecosystem, this can cause the skill to activate for a large share of unrelated user requests, leading to overreach, unintended third-party calls, and silent routing of user content to this external assistant.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 秒秒AI助理 功能调用示例 运行前请确保已安装依赖: pip install python-dotenv 并在项目根目录配置好 .env 文件 """ from miaomiao_client import MiaoMiaoClient, chat
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
When debug mode is enabled, the code prints the full JSON payload and response body, which can include user prompts, conversation history, generated content, and potentially secrets embedded in prompts or returned by the service. Logs are often retained, aggregated, or accessible to operators, making this a meaningful confidentiality risk beyond the immediate API call.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
该变更说明列出“生成图片、画图、AI绘图等”作为图像请求识别关键词，其中“画图”等表述较宽泛，且“等”进一步扩大了触发范围，但未说明明确边界或排除条件。作为 markdown 文件中的自然语言触发描述，这种不具体的触发条件可能导致在多轮对话中将普通请求误判为图像生成请求。
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README advertises internet-facing capabilities and an external API workflow but does not warn that user prompts, searches, summaries, and other content may be sent to a third-party service. This creates a privacy and data-handling risk because users and integrators may unknowingly transmit sensitive information off-platform.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The skill explicitly sends requests to an external endpoint at api.link-ai.tech, which means user content can leave the local trust boundary. In context, this is expected functionality, but it remains security-relevant because it introduces data exposure, dependency, and supply-chain risk if the endpoint, transport, or handling practices are not fully disclosed and controlled.
- Content
md ## API文档 ### 接口地址 `POST https://api.link-ai.tech/v1/chat/completions` ### 请求参数 | 参数 | 类型 | 必选 | 描述 |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says to invoke the skill whenever the user needs a broad set of practical functions or mentions related keywords, creating a very loose auto-trigger surface. Overbroad activation can route unrelated user requests to an external multi-capability agent, causing unintended data disclosure, surprising behavior, or use of network-backed features without clear user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The automatic trigger section lists many categories for automatic invocation but provides no activation constraints, confirmation requirements, or examples of when not to invoke. In a skill that can contact an external AI service and potentially handle user content, this increases the chance of accidental invocation and unnecessary exposure of prompts or sensitive data to third-party APIs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The examples send prompts and, in the multi-turn case, full conversation history to an external AI service via
chat()andclient.chat_with_history()without any visible warning that user content will leave the local environment. This is a real privacy issue because developers may copy these patterns into production or testing workflows and unintentionally transmit personal, confidential, or regulated data to a third-party service.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The class docstrings and user-facing exception/debug strings are written only in Chinese, which imposes a specific language experience without opt-in or explanation. Under the language/locale policy, this is a natural-language constraint that should either offer choice or be clearly documented as intentionally region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The client sends user prompts and, in some paths, full conversation history to a third-party remote API without any built-in disclosure, consent flow, or minimization. In an agent skill context, this can expose sensitive user content unexpectedly, especially when the skill is invoked for general-purpose assistance and users may not realize their data is leaving the local environment.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
整个变更日志均以中文呈现，且未说明这是面向特定中文区域用户的文档，或是否提供其他语言版本。根据语言/locale 政策，若技能相关说明默认强制单一语言而没有用户选择或明确限定场景，可能构成自然语言策略问题。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
All visible natural-language instructions, feature descriptions, and examples are presented only in Chinese, with no statement that the skill supports multiple languages or that Chinese is an intentional locale choice. This can constitute a language/locale policy issue when the skill implicitly forces one language without offering user choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
SQP-3 applies to all file types and covers language/locale policy violations. The natural-language strings, comments, and examples consistently assume Chinese-language use, with no indication that this is optional or limited to a region-specific deployment.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The client automatically reads the application code and API key from environment variables, which is access to sensitive credentials. Although this is common implementation behavior, the file does not include any warning or disclosure that credentials will be loaded from the environment.
- Content