T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/run.py:23- Finding
Untrusted API Base URL Can Exfiltrate Credentials and Submitted Content
- Content
View full analysis
- Remediation
View remediation
Security audit
公众号文章诊断助手
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to perform the advertised article-review task, but users should review it because it sends submitted content and API credentials to a remote service and its runner can be redirected to an arbitrary API endpoint.
Install only if you are comfortable sending article drafts, URLs, uploaded-document references, audience details, goals, and brand constraints to the AI Skills service. Keep AISKILLS_BASE_URL at the default trusted endpoint unless you fully control the replacement service, use HTTPS, and avoid submitting confidential material without approval.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill requires an API key and explicitly calls an external AI Skills API, but it does not declare any tool scope or allowed-tools boundaries. This creates an authorization and transparency gap: a host system or user cannot easily constrain or audit the skill's access to environment variables and network use, increasing the chance of overbroad execution or unintended data handling.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description uses broad trigger language like questions about whether copy can 'move people' without clear activation boundaries. In systems that auto-select skills from natural-language descriptions, this can cause the skill to trigger on loosely related prompts and route user content to an external API unexpectedly.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The usage guidance lists broad scenarios and input types but does not define exclusion conditions, making accidental activation more likely. Because the skill accepts article text, files, and URLs and sends them to a remote service, ambiguous routing can expose sensitive draft content or internal documents to third parties without clear user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation explains that URLs, files, and text are provided to the runner and sent to the AI Skills API, but it does not clearly warn users that potentially sensitive article drafts and linked content will leave the local environment and be transmitted to an external service. This is a meaningful data-handling weakness because users may submit unpublished copy, confidential marketing plans, or proprietary documents under the assumption the analysis is local.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The display name, short description, and default prompt are entirely in Chinese, which indicates the skill is oriented to a specific language without any visible opt-in or alternative locale handling. Under the policy rule, forcing a language or locale without user choice is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
User-facing labels, placeholders, descriptions, enum values, and validation messages are entirely in Chinese throughout the schema, which effectively enforces a specific language for users. The file does not provide any opt-in, alternative locale, or explanation that this skill is intentionally limited to a Chinese-only context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script sends the provided params payload to a remote HTTPS endpoint and includes API and tenant identification headers, but there is no confirmation prompt, print/log disclosure before transmission, or docstring/comment warning users that their input and associated account context will be sent over the network. For a code file, this is a safety-relevant external data transmission lacking visible user disclosure in the file itself.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The billing error message is hard-coded in Chinese, which imposes a specific language on users regardless of their locale or preferences. The file does not provide any opt-in, fallback, or documented justification for this language restriction.
- Content