T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run.py:25- Finding
Unrestricted API Base URL Override Can Expose Credentials and Request Data
- Content
View full analysis
- Remediation
View remediation
Security audit
抖音热点总榜
Security checks for vulnerabilities and agentic risk
Overview
The skill’s Douyin hotlist purpose is coherent, but its runner can send the API key and request data to any AISKILLS_BASE_URL value without validating the destination.
Install only if you intend to use the AI Skills hosted API for Douyin hotlist lookup. Keep AISKILLS_BASE_URL unset or set only to the trusted https://ai-skills.ai service, and treat AISKILLS_API_KEY as a paid credential because a bad base URL configuration could expose it.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill requires an API key and invokes a remote API, which means it uses both environment access and network access, yet it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap: a host may permit broader execution than intended, making secret access and outbound requests less transparent and harder to govern.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The listed usage scenarios include generic phrases like '现在最热门的是什么' and '今天大家都在关注什么', which are common conversational requests and not narrowly scoped triggers. The file does not provide exclusion conditions or more specific invocation boundaries, increasing the risk of unintended activation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill enables implicit invocation without any visible trigger constraints or narrowing conditions, so the platform may auto-select it in broader contexts than intended. For a skill that surfaces real-time hot topics, ambiguous activation can cause unnecessary data access, unexpected tool use, or prompt-routing into this skill when user intent is not sufficiently clear.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This manifest file uses the question "现在最热门的是什么？" as an invocation phrase, which is broad and could match everyday conversation rather than a narrowly scoped skill request. The file does not provide explicit trigger constraints, exclusions, or negative examples to clarify when this skill should activate versus when it should not.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The visible natural-language fields are presented only in Chinese, including the user-facing question and skill name, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-language audience. This may violate language/locale policy expectations when no opt-in or justification is documented.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The billing error path returns a hard-coded Chinese message regardless of the user's language preference. This imposes a specific locale without opt-in and may violate language/locale policy expectations for a general-purpose skill runner.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This code sends the provided params payload to a remote API endpoint and includes tenant identification and API-key-based authentication headers. There is no confirmation prompt, user-facing log, or inline warning in this file that user input and environment-derived metadata will be transmitted over the network.
- Content
Static analysis
No suspicious patterns detected.