Security audit

Yuque Mcp Tool

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended to read Yuque documents, but it asks users to hand a browser session cookie to unpinned external MCP code with limited warning about credential and document exposure.

Install only if you trust the package source and MCP client. Treat `_yuque_session` like a password: keep it out of chats, screenshots, repositories, and shared configs, prefer a scoped read-only token if Yuque supports one, and rotate/log out the session if it may have been exposed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:65
Finding: Unpinned External MCP Package Receives a Sensitive Yuque Session Credential
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation instructs users to extract the _yuque_session cookie and place it into MCP client configuration without clearly emphasizing that this is a highly sensitive bearer credential that can grant account-backed access to Yuque content. Because the skill is specifically designed for AI-agent access and may run inside clients that log configuration, prompts, tool calls, or environment variables, inadequate warning materially increases the risk of credential theft, account misuse, and broad document exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly enables an AI agent to read Yuque knowledge-base content, including technical documents, requirements, and meeting notes, but does not prominently warn that connecting this tool exposes document contents to the AI client and any downstream model/provider handling prompts. In this context, the omission is security-relevant because the tool's primary function is bulk access to potentially sensitive internal documentation via MCP.
Content: No source excerpt is available for this finding.

Rp1

Low

Category: MCP Rug Pull
Confidence: 60% confidence
Finding: pip install without ==version installs the latest release, which could include malicious changes.
Content: No source excerpt is available for this finding.

Rp1

Low

Category: MCP Rug Pull
Confidence: 60% confidence
Finding: pip install without ==version installs the latest release, which could include malicious changes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.