T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/run.py:26- Finding
Configurable API Base URL Can Expose Credentials and User Data
- Content
View full analysis
- Remediation
View remediation
Security audit
bilibili B站评论分析
Security checks for vulnerabilities and agentic risk
Overview
The skill appears purpose-built for Bilibili comment analysis, but it needs review because its runner can send the configured API key and submitted links to any base URL supplied through the environment.
Review before installing. Use this only when you intend to submit a Bilibili link for remote analysis by the AI Skills service, and do not set AISKILLS_BASE_URL unless you fully trust the destination. Prefer the default HTTPS AI Skills endpoint and keep the API key limited or revocable.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill requires an API key and is documented to run a script that parses links, creates an analysis task, and polls a remote service, which clearly implies network and environment-variable access. Without an explicit tool scope or permission declaration, users and hosting platforms cannot reliably constrain what the skill is allowed to access, increasing the chance of over-broad execution and unintended data exfiltration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill asks users to submit Bilibili video links for comment analysis and uses an external API service, but the description does not clearly warn that provided links and derived comment/content data will be transmitted off-platform for processing. This creates a privacy and consent issue because users may unknowingly send potentially sensitive business, audience, or content-analysis data to a third party.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill can be implicitly invoked and its description/prompt are broad, so an agent may route unrelated or weakly related user requests into this skill without clear user intent. In this context, that can cause unintended processing of user-provided B站 links or surrounding content, producing irrelevant analysis, privacy-sensitive inference about audiences, or unexpected downstream actions based on the wrong tool selection.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The schema hard-codes Chinese text for the field title, description, and placeholder. This creates a language/locale policy concern because the skill presents a specific language without any visible opt-in or alternative locale support.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The user-facing fields, including the example question, skill name, tags, profession labels, industry labels, and form text, are all presented only in Chinese. Because this manifest provides no indication that language is selectable or that the skill is intentionally limited to Chinese-speaking users, it creates a natural-language locale constraint without user opt-in.
- Content