Security audit

ami

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent IMA notes and knowledge-base integration, but it handles private data, uploads, credentials, and arbitrary URLs with under-scoped safeguards.

Review before installing. Use a secure credential store or tightly permissioned files, avoid importing untrusted or internal URLs, and confirm every file or URL upload because private content may be sent to IMA and Tencent COS. The skill should be hardened with explicit upload consent, URL validation, safer secret handling, and structured JSON construction.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: knowledge-base/SKILL.md:273
Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: knowledge-base/SKILL.md:178
Finding: Temporary COS Credentials Exposed Through Process Arguments
Content: View full analysis
" \ --secret-key "" \ --token "" \ --bucket "" \ --region "" \ --cos-key "" \ --content-type "$CONTENT_TYPE" \ --start-time "" \ --expired-time "" ``` ### Technical Analysis The temporary COS Secret ID, Secret Key, and security token are passed as command-line arguments. Depending on the operating system and runtime configuration, command lines can be observed through process inspection facilities, diagnostic tools, monitoring agents, process listings, audit logs, or crash reports. Although these credentials are temporary, they remain security-sensitive for their full validity period. Their effective permissions are determined by the policy attached to the temporary credentials returned by the IMA API. ### Attack Path 1. A legitimate knowledge-base file upload starts. 2. The agent launches `cos-upload.cjs` with temporary credentials in its argument vector. 3. A local user, process-monitoring service, or compromised process observes the command line while the upload is active. 4. The observer extracts the Secret ID, Secret Key, token, bucket, region, and object key. 5. Before expiration, the observer uses those credentials against Tencent COS. 6. The observer performs any COS operation allowed by the temporary credential policy. ### Impact Assessment An attacker could obtain temporary access to the COS resources authorized by the credentials. Depending on their policy, this may permit unauthori ...[truncated 186 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:38
Finding: IMA API Credentials Stored Without Explicitly Restrictive Permissions
Content: View full analysis
~/.config/ima/client_id echo "your_api_key" > ~/.config/ima/api_key ``` ### Technical Analysis The recommended setup writes a long-lived Client ID and API key to plaintext files without setting a restrictive `umask`, directory mode, or file mode. The final permissions therefore depend on the user's existing environment and platform defaults. On a system with permissive defaults, another local account or process may be able to read the credential files. The API key authenticates access to private IMA notes and knowledge bases, making it substantially more sensitive than ordinary application configuration. ### Attack Path 1. A user follows the documented file-based credential setup. 2. The files inherit permissions from the current process's `umask` and filesystem defaults. 3. A local attacker or compromised process checks the predictable paths under `~/.config/ima`. 4. If permissions permit access, the attacker reads the Client ID and API key. 5. The attacker authenticates to the IMA API. 6. The attacker invokes operations available to the victim's credentials, including reading private data or modifying notes and knowledge-base content. ### Impact Assessment Credential theft could expose private notes, note metadata, knowledge-base information, and uploaded content accessible to the affected account. It could also permit creation or modification of notes and knowledge-base entries within the API key's authorization scope. Access persists until the key is revoked, rotated, or expires. ]]>
Remediation: View remediation
~/.config/ima/client_id printf '%s\n' "$API_KEY" > ~/.config/ima/api_key chmod 600 ~/.config/ima/client_id ~/.config/ima/api_key ``` Additional hardening measures: 1. Prefer an operating-system credential manager or secret store over plaintext files. 2. Verify ownership and permissions before reading existing credential files. 3. Refuse to use files that are group-readable, world-readable, or owned by another account. 4. Avoid entering secrets directly into shell commands where shell history may retain them. 5. Document key rotation and revocation procedures. 6. Use narrowly scoped API credentials if IMA supports permission scoping. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: knowledge-base/SKILL.md:151
Finding: Unescaped File Metadata Is Interpolated Into Authenticated JSON Requests
Content: View full analysis
\", \"file_ext\": \"$FILE_EXT\" }" ima_api "openapi/wiki/v1/add_knowledge" "{ \"media_type\": $MEDIA_TYPE, \"media_id\": \"\", \"title\": \"$FILE_NAME\", \"knowledge_base_id\": \"\", \"file_info\": { \"cos_key\": \"\", \"file_size\": $FILE_SIZE, \"file_name\": \"$FILE_NAME\" } }" ``` ### Technical Analysis The workflow correctly parses preflight output as JSON, but then extracts values into shell variables and inserts them directly into new JSON strings. No JSON escaping is applied before interpolation. A filename may legally contain quotation marks, backslashes, or control characters on supported filesystems. Such characters can terminate the intended JSON string, make the request invalid, or inject additional JSON syntax. The request is subsequently sent with the user's IMA credentials. Shell quoting does not provide J ...[truncated 1292 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises very broad activation triggers such as everyday phrases like '帮我记一下' and general document/knowledge actions. This can cause the agent to invoke the skill in ambiguous contexts and route user content or files to an external service when the user may not have intended that, increasing the risk of unintended data disclosure.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: This duplicate finding points to the same credential persistence pattern: storing Client ID and API Key in predictable plaintext paths and reloading them on each run. Persistent plaintext credentials increase the blast radius of any local compromise and make accidental disclosure through backups, dotfile syncing, or support bundles more likely.
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
方式 A — 配置文件（推荐）：

bash
mkdir -p ~/.config/ima echo "your_client_id" > ~/.config/ima/client_id echo "your_api_key" > ~/.config/ima/api_key

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: This duplicate finding points to the same credential persistence pattern: storing Client ID and API Key in predictable plaintext paths and reloading them on each run. Persistent plaintext credentials increase the blast radius of any local compromise and make accidental disclosure through backups, dotfile syncing, or support bundles more likely.
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
方式 A — 配置文件(推荐):

bash
mkdir -p ~/.config/ima echo "your_client_id" > ~/.config/ima/client_id echo "your_api_key" > ~/.config/ima/api_key

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The helper function sends arbitrary JSON bodies plus API credentials to an external network endpoint. Although the domain is restricted to the declared official service, this still creates a real exfiltration boundary: sensitive user note content, knowledge-base data, or uploaded metadata may be transmitted off-host whenever the skill is triggered.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
# All requests go ONLY to the official IMA API (ima.qq.com) ima_api() { local path="$1" body="$2" curl -s -X POST "https://ima.qq.com/$path" \ -H "ima-openapi-clientid: $IMA_CLIENT_ID" \ -H "ima-openapi-apikey: $IMA_API_KEY" \ -H "Content-Type: application/json" \

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
md
## 模块决策表 | 用户意图 | 模块 | 读取 | | ------------------------------------------------------------------------------------------ | -------------- | ------------------------- | | 搜索笔记、浏览笔记本、获取笔记内容、创建笔记、追加内容 | notes | `notes/SKILL.md` | | 上传文件、添加网页链接、搜索知识库、浏览知识库内容、获取知识库信息、获取可添加的知识库列表 | knowledge-base | `knowledge-base/SKILL.md` |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill content is written as mandatory operating instructions in Chinese, and the examples and user-facing messages throughout the file assume Chinese output. There is no indication that users may choose another language or that the locale restriction is justified as a region-specific requirement, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The upload workflow sends local file contents to COS and then associates them with the knowledge base, yet the skill only discusses operational steps and progress messaging, not a clear user warning that the local file will be transmitted to external services. In contexts involving personal notes, internal documents, or regulated data, this omission increases the risk of users unintentionally disclosing sensitive information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs the agent to fetch user-provided URLs, download remote content to a temporary directory, inspect headers, and then upload the content into external storage and the knowledge-base service, but it does not require an explicit user-facing disclosure that file contents will transit through third-party systems. This can cause unintended exfiltration of sensitive documents or authenticated resources, especially when the user may not realize that URL dereferencing and re-upload will copy the full content outside the immediate chat context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file describes use of ima-openapi-clientid and ima-openapi-apikey, which are sensitive credentials. Under the missing-warning criterion for markdown files, the description lacks any warning about credential handling, storage, or accidental disclosure in logs, examples, or shared requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The quick-decision section tells the skill to upload files and add web content to the knowledge base, which can affect user data, privacy, and remote system state. The markdown does not include a user-facing warning that uploaded files, URLs, and related metadata will be sent to ima.qq.com/COS and stored in the knowledge base.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/references/api.md (reported line 140)May include surrounding context.
md
### MediaType（媒体类型枚举） | 值 | 名称 | content_type / 说明 | | --- | -------------- | ------------------------------------------------------------------------------------------------------------- | | 1 | PDF | `application/pdf` | | 2 | 网页 | N/A（直接 AddKnowledge，`web_info.content_id=<url>`） |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill content is written entirely in Chinese and directs user-facing prompts in Chinese, such as the confirmation examples and warnings. Under the policy, forcing a specific language without giving the user a choice is a natural-language policy violation unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/references/api.md (reported line 152)May include surrounding context.
md
## 接口决策表 | 用户意图 | 调用接口 | 关键参数 | | --------------------------------------------------------------------------------------------------------- | ---------------------------- | ----------------------------------------------------------------------------- | | 搜索/查找笔记 | `search_note_book` | `query_info`（QueryInfo 对象） | | 查看笔记本列表 | `list_note_folder_by_cursor` | `cursor`(必填，首页传`"0"`) + `limit`(必填) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · notes/SKILL.md (reported line 15)May include surrounding context.
md
## 接口决策表 | 用户意图 | 调用接口 | 关键参数 | | --------------------------------------------------------------------------------------------------------- | ---------------------------- | ----------------------------------------------------------------------------- | | 搜索/查找笔记 | `search_note_book` | `query_info`（QueryInfo 对象） | | 查看笔记本列表 | `list_note_folder_by_cursor` | `cursor`(必填，首页传`"0"`) + `limit`(必填) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/references/api.md (reported line 142)May include surrounding context.
md
| 用户意图 | 调用接口 | 关键参数 | | --------------------------------------------------------------------------------------------------------- | ---------------------------- | ----------------------------------------------------------------------------- | | 搜索/查找笔记 | `search_note_book` | `query_info`（QueryInfo 对象） | | 查看笔记本列表 | `list_note_folder_by_cursor` | `cursor`(必填，首页传`"0"`) + `limit`(必填) | | 浏览某笔记本里的笔记,当用户表述"最新"、"最近"之类的通用限定，没有指明笔记本时，都应该直接在全部笔记里去拉 | `list_note_by_folder_id` | `folder_id`(选填,空为全部笔记本) + `cursor`(必填，首次传`""`) + `limit`(必填) | | 读取笔记正文 | `get_doc_content` | `doc_id` + `target_content_format`(必填，推荐`0`纯文本) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · notes/SKILL.md (reported line 17)May include surrounding context.
md
| 用户意图 | 调用接口 | 关键参数 | | --------------------------------------------------------------------------------------------------------- | ---------------------------- | ----------------------------------------------------------------------------- | | 搜索/查找笔记 | `search_note_book` | `query_info`（QueryInfo 对象） | | 查看笔记本列表 | `list_note_folder_by_cursor` | `cursor`(必填，首页传`"0"`) + `limit`(必填) | | 浏览某笔记本里的笔记,当用户表述"最新"、"最近"之类的通用限定，没有指明笔记本时，都应该直接在全部笔记里去拉 | `list_note_by_folder_id` | `folder_id`(选填,空为全部笔记本) + `cursor`(必填，首次传`""`) + `limit`(必填) | | 读取笔记正文 | `get_doc_content` | `doc_id` + `target_content_format`(必填，推荐`0`纯文本) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · notes/SKILL.md (reported line 18)May include surrounding context.
md
| 用户意图 | 调用接口 | 关键参数 | | --------------------------------------------------------------------------------------------------------- | ---------------------------- | ----------------------------------------------------------------------------- | | 搜索/查找笔记 | `search_note_book` | `query_info`（QueryInfo 对象） | | 查看笔记本列表 | `list_note_folder_by_cursor` | `cursor`(必填，首页传`"0"`) + `limit`(必填) | | 浏览某笔记本里的笔记,当用户表述"最新"、"最近"之类的通用限定，没有指明笔记本时，都应该直接在全部笔记里去拉 | `list_note_by_folder_id` | `folder_id`(选填,空为全部笔记本) + `cursor`(必填，首次传`""`) + `limit`(必填) | | 读取笔记正文 | `get_doc_content` | `doc_id` + `target_content_format`(必填，推荐`0`纯文本) | | 新建一篇笔记（用户明确说"新建/创建笔记"时走此接口） | `import_doc` | `content` + `content_format`(必填，固定`1`) + 可选 `folder_id` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · notes/SKILL.md (reported line 20)May include surrounding context.
md
| 搜索/查找笔记 | `search_note_book` | `query_info`（QueryInfo 对象） | | 查看笔记本列表 | `list_note_folder_by_cursor` | `cursor`(必填，首页传`"0"`) + `limit`(必填) | | 浏览某笔记本里的笔记,当用户表述"最新"、"最近"之类的通用限定，没有指明笔记本时，都应该直接在全部笔记里去拉 | `list_note_by_folder_id` | `folder_id`(选填,空为全部笔记本) + `cursor`(必填，首次传`""`) + `limit`(必填) | | 读取笔记正文 | `get_doc_content` | `doc_id` + `target_content_format`(必填，推荐`0`纯文本) | | 新建一篇笔记（用户明确说"新建/创建笔记"时走此接口） | `import_doc` | `content` + `content_format`(必填，固定`1`) + 可选 `folder_id` | | 往已有笔记追加内容（⚠️ **敏感操作**：用户必须明确指定目标笔记，否则先确认再操作） | `append_doc` | `doc_id` + `content` + `content_format`(必填，固定`1`) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · notes/references/api.md (reported line 91)May include surrounding context.
md
#### SearchedDoc | 字段 | 类型 | 说明 | | ---------------- | --------------------- | ------------------------------------------------------------------------------------------ | | `doc` | DocBasicInfo | 笔记 basic 数据，见 [DocBasicInfo](#docbasicinfo) | | `highlight_info` | map\<string, string\> | 该条笔记匹配的高亮词，key: `doc_title`（文档标题），value: 包含 `<em>高亮词</em>` 的字段值 |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger guidance for search is overly broad (e.g., generic terms like ‘搜索’/‘查找’) and can cause the skill to activate on ambiguous everyday requests. In a note/knowledge-base skill, accidental invocation can expose notebook names, search hits, or note contents from a user’s private data source when the user did not clearly intend to access it.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The file is Chinese-language documentation and explicitly says to show errmsg directly to the user. Because this constrains user-visible messaging to the service-provided language without any opt-in or locale handling, it may violate the language/locale policy described in SQP-3.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.