Surf Paipai.AI

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:23 AM UTC
• Version: 1.0.1

Overview

The skill is a plausible paip.ai integration, but its included test script hardcodes credentials and automatically creates remote social content, so users should review it carefully before installing.

Install only if you trust the paip.ai endpoint and are comfortable giving the skill account credentials and permission to make remote account changes. Do not run artifact/scripts/token-manager.sh as-is: it contains embedded credentials, prints token material, and can create a real moment on the service. Any use should remove hardcoded secrets, avoid logging tokens, make location optional, and require explicit confirmation before posting, deleting, uploading, or changing account data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/token-manager.sh:57
• Finding: Hardcoded Account Credentials in Test Script## Vulnerability Details **File Location**: `scripts/token-manager.sh`, line 57 **Vulnerability Type**: Hardcoded plaintext credentials **Risk Level**: High ```bash LOGIN_DATA='{"loginType":1,"username":"[e-mail]","password":"TestPass037!"}' ``` ### Technical Analysis The script embeds an email address and plaintext password directly in source code. Anyone with access to the distributed skill, source repository, package archive, backups, or repository history can retrieve these credentials without executing the script. When the script runs, the credentials are sent to the configured paip.ai login endpoint. If they remain valid, they can be reused independently of the script. Source-controlled secrets are particularly difficult to contain because removing them from the latest revision does not remove copies from prior commits, caches, or released artifacts. ### Attack Path 1. An attacker obtains the skill package or access to its source. 2. The attacker reads `scripts/token-manager.sh`. 3. The attacker extracts the hardcoded username and password from line 57. 4. The attacker submits them to `https://gateway.paipai.life/api/v1/user/login`. 5. If the credentials are valid, the attacker receives an authentication token. 6. The attacker uses the token to access or modify resources authorized for that account. ### Impact Assessment Successful exploitation grants the privileges assigned to the exposed paip.ai account. Based on the documented API, the resulting session could permit access to profile information and could allow modification of account data, publication of social content, interaction with moments, and access to other account-authorized operations. The actual scope depends on whether the credentials remain valid and which server-side permissions are assigned to the account. The exposure does not itself grant local system privileges.
• Remediation: ## Remediation Suggestions 1. Revoke or rotate the exposed password immediately and invalidate all existing sessions for the account. 2. Remove the credentials from the current source and all repository history and released artifacts. 3. Obtain test credentials at runtime through protected environment variables or an approved secret manager. 4. If interactive use is required, read passwords without terminal echo and avoid retaining them on disk. 5. Use a dedicated, least-privileged test account with no production data or sensitive capabilities. 6. Add automated secret scanning to commits and build pipelines. 7. Ensure logs, error messages, and test fixtures never contain plaintext credentials.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/token-manager.sh:59
• Finding: Bearer Token Material Disclosed Through Standard Output## Vulnerability Details **File Location**: `scripts/token-manager.sh`, lines 59-63 **Vulnerability Type**: Sensitive authentication data exposure **Risk Level**: Medium ```bash if echo "$login_response" | grep -q '"code":0'; then token=$(echo "$login_response" | grep -o '"token":"[^"]*"' | cut -d'"' -f4) if [ -n "$token" ]; then success "Login successful! Token retrieved." echo "Token: ${token:0:50}..." ``` ### Technical Analysis After extracting the bearer token from the login response, the script prints its first 50 characters to standard output. Standard output is commonly retained in CI logs, agent transcripts, terminal recordings, centralized log systems, or support bundles. Authentication tokens must be treated as secrets because possession can authorize requests without knowledge of the account password. Although this script truncates the displayed value, 50 characters may expose most or all of a short token or disclose security-relevant token material. The precise exploitability depends on the token's length, format, signature scheme, and server-side validation behavior. ### Attack Path 1. The script runs in a terminal, CI pipeline, automation agent, or another environment that captures standard output. 2. A successful login causes the script to print the first 50 token characters. 3. An attacker obtains access to the resulting logs or transcript. 4. The attacker extracts the disclosed token material. 5. If the output contains a complete usable token, or if the remaining token portion is recoverable or unnecessary, the attacker sends requests with the `Authorization: Bearer` header. 6. Requests are accepted until the token expires or is revoked. ### Impact Assessment A usable bearer token would grant the same API privileges as the authenticated session. Potential scope includes reading account information and performing account-authorized state changes such as publishing content ...[truncated 333 chars]
• Remediation: ## Remediation Suggestions 1. Remove all output containing the token or any substring of it. 2. Report only a non-sensitive status such as `Login successful`. 3. If token correlation is operationally necessary, log a short fingerprint produced by a one-way cryptographic hash rather than token characters. 4. Keep the token only in process memory for the minimum required duration and unset it after use. 5. Configure CI and centralized logging systems to redact authorization headers and token-shaped values. 6. Restrict access to existing logs and delete logs that contain exposed token material. 7. Revoke tokens that may already have been recorded in shared or persistent logs.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/token-manager.sh:74
• Finding: Token Test Automatically Publishes Remote Social Content## Vulnerability Details **File Location**: `scripts/token-manager.sh`, lines 74-77 **Vulnerability Type**: Unintended state-changing remote operation **Risk Level**: Medium ```bash # Test publishing a moment (token required) step "3. Test publishing a moment (token required)" post_data='{"content":"Test moment - published via the token management script","images":[],"videos":[]}' post_response=$(send_request "POST" "/content/moment/create" "$post_data" "$token") ``` ### Technical Analysis The token-management test performs a state-changing API request that creates a social post. It does so automatically after login and retrieval of user information, without a confirmation prompt, an explicit opt-in option, environment isolation, or cleanup. The preceding authenticated `GET /user/current/user` request already verifies that the token is usable. Publishing content is therefore unnecessary for token validation and violates the principle of minimizing side effects in diagnostic scripts. The request body also does not explicitly set a visibility scope, despite the project documentation identifying `publicScope` as part of the publication contract. The resulting behavior depends on server-side validation or defaults. ### Attack Path 1. A user or automated system runs the script expecting it to test login and token retrieval. 2. The script authenticates using the configured account. 3. It verifies the token by retrieving user information. 4. Without additional approval, it sends a `POST` request to `/content/moment/create`. 5. If accepted by the service, a test moment is created under the authenticated account. 6. Repeated executions may create repeated posts because the script performs no deduplication or deletion. ### Impact Assessment The operation can create unwanted remote content under the account's identity. This may cause account pollution, reputational harm, moderation consequences, notifications, or repeate ...[truncated 322 chars]
• Remediation: ## Remediation Suggestions 1. Remove the publication request from the default token-validation flow. 2. Validate authentication exclusively with a read-only endpoint such as `/user/current/user`. 3. If mutation testing is essential, require an explicit command-line option and interactive confirmation. 4. Run state-changing tests only against a dedicated test environment and least-privileged test account. 5. Explicitly configure safe visibility settings instead of relying on server defaults. 6. Record the identifier of every test resource and delete it automatically after validation. 7. Add idempotency or deduplication controls to prevent repeated test content. 8. Clearly document every remote side effect before execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description claims a complete paip.ai skill with multiple user-facing capabilities across login/registration, profile management, agents, rooms, and moments. The actual code chunk only performs a narrow sequence: login with embedded test credentials, retrieve the auth token, fetch current user info, and create a moment. This is materially narrower than the declared scope and includes a notable undeclared behavior pattern: automated use of hardcoded credentials for a specific account. While login and publishing a moment are within the broad theme of the declared description, the code does not substantiate the claimed completeness and instead acts as a token-management/testing script. Therefore, the description does not accurately represent the supplied code chunk.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: The skill directs collection and transmission of highly sensitive data including email, password, bearer token, device identifier, and precise location, yet provides no privacy notice, minimization guidance, or consent flow. This is dangerous because it normalizes sending credentials and location to an external service and may expose users to unnecessary tracking or account compromise if mishandled.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence
• Finding: The skill instructs use of shell/curl-based network operations but declares no explicit tool restrictions or permission scope. In an agent environment, that increases the chance the skill can invoke shell-enabled external requests without clear sandboxing or user-visible authorization boundaries.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger guidance includes broad terms like login, registration, view rooms, and agent list, which are common phrases that may activate the skill unexpectedly. Unintended invocation is risky here because the skill handles account actions, authentication tokens, posting content, and privacy-sensitive data.

External Transmission

Medium

• Category: Data Exfiltration

Content

All `curl` requests must set timeout parameters:
```bash
# Set a 5-minute timeout (300 seconds)
curl --max-time 300 --connect-timeout 300 [other parameters]

# Example: login request
curl --max-time 300 --connect-timeout 300 -X POST "https://gateway.paipai.life/api/v1/user/login" \

• Confidence: 78% confidence
• Finding: The skill explicitly instructs external transmission to a third-party API using curl, including authentication material and potentially user content. External transmission is expected for an integration skill, but it remains security-relevant because it sends sensitive data off-platform and, paired with shell usage, may bypass safer built-in request controls.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: This is a markdown file, so missing-warning checks apply to descriptions of behaviors that could affect user data or system integrity. The reference lists irreversible or sensitive actions such as account cancellation and file upload, but provides no accompanying warning about deletion consequences, data handling, or privacy implications.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The CreateMoment request includes precise longitude, latitude, location text, and an `isOpenLocation` flag, which can affect user privacy. The markdown describes these fields but does not warn users that enabling location sharing may expose sensitive real-world location information.

External Transmission

Medium

• Category: Data Exfiltration

Content

fi
    
    if [ -n "$data" ]; then
        curl -s -X "$method" "${BASE_URL}${endpoint}" "${headers[@]}" -d "$data"
    else
        curl -s -X "$method" "${BASE_URL}${endpoint}" "${headers[@]}"
    fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script is presented as a token-management test, but it performs a real state-changing action by creating a public/content object ('moment') after login. This violates least surprise and can cause unintended posting to a real user account, especially because the script uses hard-coded credentials and targets a production-looking API endpoint.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script performs a state-changing publish action automatically once authentication succeeds, without any user confirmation, dry-run mode, or warning that content will be created. In a skill context, this is more dangerous because users may run helper scripts expecting diagnostics, not actions that modify remote account state.

Natural-Language Policy Violations

Low

• Confidence: 74% confidence
• Finding: The sample `CurrentUserResp` hard-codes `language` as `zh-cn`, which can indicate a fixed locale expectation. Because no user opt-in, locale choice, or region-specific justification is provided in the surrounding text, this may conflict with language/locale policy expectations.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: The variable RESPONSE_LANG is fixed to "zh-cn", and that locale is then sent on all requests via the X-Response-Language header. This forces a specific language setting without any opt-in, configurability, or explanation that the skill is intentionally region-specific.

Static analysis

No suspicious patterns detected.