T09 · Insecure Skill Coding Practices
Error
- Location
lib/client.js:57- Finding
Unrestricted Network Destination for Sensitive API Traffic
- Content
View full analysis
- Remediation
View remediation
Security audit
Shuzhi Open
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate Shuzhi API integration, but it needs review because it handles contracts, identity data, credentials, and remote deletion actions with weak scoping and disclosure safeguards.
Install only if you trust the Shuzhi service and can protect the workspace. Use test credentials where possible, do not commit config.json with real secrets, verify baseUrl before each run, avoid passing ID-card numbers or phone numbers directly on the command line, and treat terminal output/logs as sensitive. Review remote delete commands carefully because they act on service-side records.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
config.json:1- Finding
API Credentials Are Designed to Be Stored in a Plaintext Project Configuration File
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sign/workflow.js:442- Finding
Electronic-Signature Workflow Prints Personal Information to Terminal Logs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (68)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sign/workflow.js --contract "合同文件路径" --signers '[{"signerNo":"甲方","type":"enterprise",...}]'
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sign/workflow.js --contract "合同文件路径" --signers '[{"signerNo":"甲方","type":"enterprise",...}]'
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sign/workflow.js --contract "合同文件路径" --signers '[{"signerNo":"甲方","type":"enterprise",...}]'
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sign/workflow.js --contract "合同文件路径" --signers '[{"signerNo":"甲方","type":"enterprise",...}]'
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sign/sign-flow.js create --file params.json
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sign/sign-flow.js create --file params.json
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sign/sign-flow.js create --file params.json
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sign/sign-flow.js create --file params.json
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sign/sign-flow.js create --file params.json
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sign/sign-flow.js create --file params.json
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill documents network-capable operations against external APIs but does not declare any explicit tool scope, permissions, or allowed-tools boundaries. In an agent setting, this can cause overbroad execution authority or unclear consent around outbound requests, especially because the skill handles legal documents, identity data, and evidence-related workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The automated evidence section asks for URLs, batch identifiers, and evidence metadata for remote collection, but does not explicitly tell the user that this information will be sent to an external service. That omission weakens informed consent and can expose confidential case details or targets to third-party processing without clear notice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The e-signature workflow collects highly sensitive personal and enterprise identity data, including ID-card numbers and phone numbers, but does not clearly warn users about privacy risks, retention, sharing, or transmission to an external service. In this context, silent collection and handling of regulated identity data increases the risk of privacy violations, excessive disclosure, and noncompliant processing.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill simultaneously forbids self-computation of evidenceHash and later prescribes a fixed computation formula. This direct conflict is dangerous because developers may either compute a value when they should not, or hesitate and produce inconsistent evidence records, affecting downstream legal or audit reliability.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The certificate field mapping is internally contradictory: it labels blockchainHash as one source while the note says to use a different field. That inconsistency can lead implementers to bind the wrong blockchain value into legally significant certificates, undermining integrity, traceability, and later verification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This JSON includes multiple natural-language labels and descriptions such as product names, statuses, and endpoint descriptions entirely in Chinese. Because the file provides no documented locale restriction, fallback, or user opt-in, it appears to impose a specific language by default, which matches the language/locale policy violation category.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Comments and user-visible error text in this file are written exclusively in Chinese, including the initialization and credential error messages. Under the locale policy rule, hard-coding a single language without opt-in or documented regional justification can be a policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This code sends arbitrary request payloads to a remote endpoint using
fetch, and the request is authenticated withappKey/appSecret-derived headers. While the comments describe the function as a unified request method, there is no user-facing warning, confirmation, or visible logging here to disclose that data provided inbodywill be transmitted over the network.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The upload function serializes caller-provided business data and sends it via a network request to the 'chain' upload API. Although there is a code comment describing the function, there is no user-facing warning, confirmation, or explicit disclosure that potentially sensitive data will be transmitted to an external blockchain-related service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This module creates and manages remote evidence-collection tasks via multiple
request(...)calls, which likely transmit task data and identifiers to an external service. Although the file has brief technical docstrings, it does not include any user-facing warning, confirmation, or disclosure about sending potentially sensitive evidentiary data over the network.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The enterprise.delete method performs a deletion through a remote request, but this file contains no confirmation step, warning, or user-facing disclosure that the operation is destructive. For safety-critical operations, the code should provide some visible indication or rely on documented warnings elsewhere.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The person.create method sends a user's name and ID card number via a network request, which is sensitive personal data. Although the parameters are documented, there is no confirmation prompt, user-facing log, or explicit warning in this file that personal identity information will be transmitted to an external signing service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The person.delete method invokes a remote delete action with no confirmation prompt, logging, or explanatory warning in the code. Because deletion may be irreversible, users should be explicitly informed before the action is taken.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The enterpriseSeal.delete method issues a remote deletion request but does not contain any confirmation, warning comment intended for users, or visible disclosure of the destructive effect. This creates a risk of accidental irreversible removal of seal data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The personSeal.delete method deletes a personal signature/seal via a network request without any visible confirmation or warning in the code. Since signature artifacts are sensitive and deletions may be hard to undo, this should be disclosed to the user.
- Content
Static analysis
No suspicious patterns detected.