T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/kuro_login.py:237- Finding
Authentication Token and Personal Account Data Stored and Exposed in Plaintext
- Content
View full analysis
- Remediation
View remediation
Security audit
kurobbs-wiki
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its stated Kuro BBS wiki and account-assistant purpose, but it needs review because it stores and can print login tokens in plaintext and uses browser automation to bypass site protections for post media.
Install only if you are comfortable with a game helper handling your Kuro BBS login token and storing account data locally. Avoid using my account unless you intend to expose the raw token in logs, consider deleting ~/.kurobbs-wiki-cache after use, use pinned dependencies in a virtual environment, and treat the post-media feature as browser-based scraping that may contact additional services.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
README.en.md:50- Finding
Unpinned Playwright Package and Browser Binary Installation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/kuro_login.py:323- Finding
Undisclosed Public-IP Requests to Third-Party Services
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (66)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## 🔄 更新流程（skill 改版后） 1. 在 `skills/kurobbs-wiki/` 里改源文件（走 self-modify） 2. 复制改动的文件到 `temp/_kurobbs_release/` 3. `git add -A && git commit && git push origin main` 4. 各市场会自动抓取 GitHub 更新（ClawHub 等需手动重传的另说）
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented capabilities extend beyond lookup into profiling, pair scoring, team enumeration, guide-pool inference, protected-post scraping, media download, and detailed account-state retrieval. This overbreadth undermines informed consent and makes it easier for an agent to invoke data-processing and local-storage behaviors the user did not reasonably expect from the stated purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented capabilities extend beyond lookup into profiling, pair scoring, team enumeration, guide-pool inference, protected-post scraping, media download, and detailed account-state retrieval. This overbreadth undermines informed consent and makes it easier for an agent to invoke data-processing and local-storage behaviors the user did not reasonably expect from the stated purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documented capabilities extend beyond lookup into profiling, pair scoring, team enumeration, guide-pool inference, protected-post scraping, media download, and detailed account-state retrieval. This overbreadth undermines informed consent and makes it easier for an agent to invoke data-processing and local-storage behaviors the user did not reasonably expect from the stated purpose.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/wikiquery.py` — 查询 CLI（tree / map / list / detail / search / post），纯标准库实现，无第三方依赖（`post` 子命令例外：内部调用 `post_fetch.py`，依赖 playwright）。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python URL_GET_SMS_CODE_H5 = BASE + "/user/getSmsCodeForH5" # 发短信验证码（需极验 geeTestData） URL_SDK_LOGIN = BASE + "/user/sdkLogin" # 验证码登录 → token URL_ACCOUNT_SEEK_ROLE = BASE + "/gamer/role/list" # 用 token 拿绑定的角色列表 URL_ROLE_ACCESS_TOKEN = BASE + "/aki/roleBox/requestToken" # 换 B-At access token URL_ROLE_DATA = BASE + "/aki/roleBox/akiBox/roleData" # 拿拥有角色详情（需 B-At + multipart） PARAM_SERVER_ID = "76402e5b20be2c39f095a152090afddc" # ApiConfig.PARAM_SERVER_ID
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python URL_GET_SMS_CODE_H5 = BASE + "/user/getSmsCodeForH5" # 发短信验证码（需极验 geeTestData） URL_SDK_LOGIN = BASE + "/user/sdkLogin" # 验证码登录 → token URL_ACCOUNT_SEEK_ROLE = BASE + "/gamer/role/list" # 用 token 拿绑定的角色列表 URL_ROLE_ACCESS_TOKEN = BASE + "/aki/roleBox/requestToken" # 换 B-At access token URL_ROLE_DATA = BASE + "/aki/roleBox/akiBox/roleData" # 拿拥有角色详情（需 B-At + multipart） PARAM_SERVER_ID = "76402e5b20be2c39f095a152090afddc" # ApiConfig.PARAM_SERVER_ID
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python URL_GET_SMS_CODE_H5 = BASE + "/user/getSmsCodeForH5" # 发短信验证码（需极验 geeTestData） URL_SDK_LOGIN = BASE + "/user/sdkLogin" # 验证码登录 → token URL_ACCOUNT_SEEK_ROLE = BASE + "/gamer/role/list" # 用 token 拿绑定的角色列表 URL_ROLE_ACCESS_TOKEN = BASE + "/aki/roleBox/requestToken" # 换 B-At access token URL_ROLE_DATA = BASE + "/aki/roleBox/akiBox/roleData" # 拿拥有角色详情（需 B-At + multipart） PARAM_SERVER_ID = "76402e5b20be2c39f095a152090afddc" # ApiConfig.PARAM_SERVER_ID
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python URL_GET_SMS_CODE_H5 = BASE + "/user/getSmsCodeForH5" # 发短信验证码（需极验 geeTestData） URL_SDK_LOGIN = BASE + "/user/sdkLogin" # 验证码登录 → token URL_ACCOUNT_SEEK_ROLE = BASE + "/gamer/role/list" # 用 token 拿绑定的角色列表 URL_ROLE_ACCESS_TOKEN = BASE + "/aki/roleBox/requestToken" # 换 B-At access token URL_ROLE_DATA = BASE + "/aki/roleBox/akiBox/roleData" # 拿拥有角色详情（需 B-At + multipart） PARAM_SERVER_ID = "76402e5b20be2c39f095a152090afddc" # ApiConfig.PARAM_SERVER_ID
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python URL_GET_SMS_CODE_H5 = BASE + "/user/getSmsCodeForH5" # 发短信验证码（需极验 geeTestData） URL_SDK_LOGIN = BASE + "/user/sdkLogin" # 验证码登录 → token URL_ACCOUNT_SEEK_ROLE = BASE + "/gamer/role/list" # 用 token 拿绑定的角色列表 URL_ROLE_ACCESS_TOKEN = BASE + "/aki/roleBox/requestToken" # 换 B-At access token URL_ROLE_DATA = BASE + "/aki/roleBox/akiBox/roleData" # 拿拥有角色详情（需 B-At + multipart） PARAM_SERVER_ID = "76402e5b20be2c39f095a152090afddc" # ApiConfig.PARAM_SERVER_ID
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python URL_GET_SMS_CODE_H5 = BASE + "/user/getSmsCodeForH5" # 发短信验证码（需极验 geeTestData） URL_SDK_LOGIN = BASE + "/user/sdkLogin" # 验证码登录 → token URL_ACCOUNT_SEEK_ROLE = BASE + "/gamer/role/list" # 用 token 拿绑定的角色列表 URL_ROLE_ACCESS_TOKEN = BASE + "/aki/roleBox/requestToken" # 换 B-At access token URL_ROLE_DATA = BASE + "/aki/roleBox/akiBox/roleData" # 拿拥有角色详情（需 B-At + multipart） PARAM_SERVER_ID = "76402e5b20be2c39f095a152090afddc" # ApiConfig.PARAM_SERVER_ID
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python URL_GET_SMS_CODE_H5 = BASE + "/user/getSmsCodeForH5" # 发短信验证码（需极验 geeTestData） URL_SDK_LOGIN = BASE + "/user/sdkLogin" # 验证码登录 → token URL_ACCOUNT_SEEK_ROLE = BASE + "/gamer/role/list" # 用 token 拿绑定的角色列表 URL_ROLE_ACCESS_TOKEN = BASE + "/aki/roleBox/requestToken" # 换 B-At access token URL_ROLE_DATA = BASE + "/aki/roleBox/akiBox/roleData" # 拿拥有角色详情（需 B-At + multipart） PARAM_SERVER_ID = "76402e5b20be2c39f095a152090afddc" # ApiConfig.PARAM_SERVER_ID
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code explicitly describes using Playwright/browser automation to bypass an Aliyun WAF and retrieve protected post details. A deliberate WAF-bypass capability is risky because it expands the skill from normal API usage into anti-protection circumvention, which can enable access patterns and automation beyond the user's stated wiki-query needs.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/wikiquery.py:1269