T09 · Insecure Skill Coding Practices
Error
- Location
scripts/gequhai_crawler.py:294- Finding
Hard-Coded Synology NAS Credentials in Source Code
- Content
View full analysis
- Remediation
View remediation
Security audit
Gequhai Music
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its music-download purpose, but it embeds NAS credentials and exposes unauthenticated controls that can change files on a Synology NAS.
Review this carefully before installing. Do not use it as published with real NAS access: remove embedded credentials, rotate the exposed NAS password, require authentication for the service, bind it to localhost or a protected interface, use HTTPS to the NAS, disable wildcard CORS, and require confirmation before any download, rename, move, or overwrite operation.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/gequhai_crawler.py:318- Finding
NAS Passwords and Session Identifiers Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
service/main.py:103- Finding
Unauthenticated API Endpoints Trigger Privileged NAS Operations
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/gequhai_crawler.py:539- Finding
Automatic File Moves Delete Sources and Permit Destination Overwrites
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (54)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the actual behavior is fixed-keyword scraping with local file output instead of general user-driven search/download, then the skill is materially more deceptive than its description suggests. Misrepresented automation that writes files can be abused or accidentally triggered in ways users did not consent to.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the actual behavior is fixed-keyword scraping with local file output instead of general user-driven search/download, then the skill is materially more deceptive than its description suggests. Misrepresented automation that writes files can be abused or accidentally triggered in ways users did not consent to.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the actual behavior is fixed-keyword scraping with local file output instead of general user-driven search/download, then the skill is materially more deceptive than its description suggests. Misrepresented automation that writes files can be abused or accidentally triggered in ways users did not consent to.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the actual behavior is fixed-keyword scraping with local file output instead of general user-driven search/download, then the skill is materially more deceptive than its description suggests. Misrepresented automation that writes files can be abused or accidentally triggered in ways users did not consent to.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
If the actual behavior is fixed-keyword scraping with local file output instead of general user-driven search/download, then the skill is materially more deceptive than its description suggests. Misrepresented automation that writes files can be abused or accidentally triggered in ways users did not consent to.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the actual behavior is fixed-keyword scraping with local file output instead of general user-driven search/download, then the skill is materially more deceptive than its description suggests. Misrepresented automation that writes files can be abused or accidentally triggered in ways users did not consent to.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the actual behavior is fixed-keyword scraping with local file output instead of general user-driven search/download, then the skill is materially more deceptive than its description suggests. Misrepresented automation that writes files can be abused or accidentally triggered in ways users did not consent to.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the actual behavior is fixed-keyword scraping with local file output instead of general user-driven search/download, then the skill is materially more deceptive than its description suggests. Misrepresented automation that writes files can be abused or accidentally triggered in ways users did not consent to.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script contains hard-coded Synology NAS IP, username, and password, then uses them to automatically authenticate and administer the NAS. Anyone with access to the skill source, logs, backups, or package can recover these credentials and gain unauthorized access to the NAS, potentially compromising stored data and other NAS services.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill silently uses embedded NAS credentials to log into a private storage system without any disclosure or consent flow. Even if intended for convenience, hidden automatic authentication to a personal NAS is dangerous because users may not realize the skill has privileged access to internal storage and can perform actions under those credentials.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill can list, rename, and move files on the Synology NAS using generic path parameters, which exceeds the stated purpose of music search/download. Because these functions operate on arbitrary paths and are coupled with authenticated NAS access, misuse or future agent exposure could alter or relocate non-music files across the NAS.
- Content
Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'
High
- Category
- Supply Chain
- Confidence
- 70% confidence
- Finding
Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill declares networked search/download and NAS-related behavior but does not define any explicit tool scope or permissions boundary. In an agent environment, undeclared access to network, file read/write, or environment data increases the chance of over-privileged execution and makes it harder for users and reviewers to understand what the skill can actually do.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger description is broad enough that the skill may activate on common music-related requests, including benign questions that do not imply consent to network access, scraping, or NAS download actions. In context, this is more dangerous because the skill can initiate downloads or external requests tied to a local NAS, which are higher-impact side effects than simple recommendation behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill description does not prominently warn users that requests may result in content being sent to a Synology NAS. Because device-targeted downloads affect local infrastructure and storage, insufficient disclosure can lead to unintended actions on a private system and weakens meaningful user consent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation exposes a hard-coded custom header secret presented as required to access the target API. Publishing a bypass secret or anti-abuse token in a skill both encourages circumvention of service controls and creates a reusable credential that others can abuse, potentially leading to unauthorized API access or account/IP blocking.
- Content
Tainted flow: 'data' from requests.post (line 224, network input) → requests.post (network output)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python } try: resp = requests.post(url, data=data, timeout=15) result = resp.json() if result.get("success"):
Tainted flow: 'data' from requests.post (line 224, network input) → requests.post (network output)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python } try: resp = requests.post(url, data=data, timeout=15) result = resp.json() if result.get("success"):
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code automatically renames downloaded files and moves them into a final NAS directory without prompting the user at execution time. In the context of an agent skill, this creates hidden side effects on user storage and increases the risk of accidental overwrites, file confusion, or unintended modification of NAS contents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
A song download request triggers a chain of side effects: adding a NAS download task, deriving a filename from a remote URL, renaming the downloaded file, and moving it to another directory. This behavior goes beyond simple retrieval and is risky because a user asking to download music may not expect authenticated write operations on their NAS to occur automatically.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The Accept-Language header is hard-coded to "zh-CN,zh;q=0.9", which forces a specific locale preference regardless of user choice. This is a natural-language locale policy concern because the skill does not offer any language or locale selection or explain why a China-specific locale is required.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python result = {"id": song_id} # 提取标题和歌手 match = __import__("re").search(r"window\.mp3_title\s*=\s*['\"]([^'\"]+)['\"]", resp.text) if match: result["title"] = match.group(1)
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python if match: result["title"] = match.group(1) match = __import__("re").search(r"window\.mp3_author\s*=\s*['\"]([^'\"]+)['\"]", resp.text) if match: result["artist"] = match.group(1)
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python if match: result["artist"] = match.group(1) match = __import__("re").search(r"window\.play_id\s*=\s*['\"]([^'\"]+)['\"]", resp.text) if match: result["play_id"] = match.group(1)
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python if match: result["play_id"] = match.group(1) match = __import__("re").search(r"window\.mp3_type\s*=\s*(\d+)", resp.text) if match: result["type"] = int(match.group(1))
Static analysis
No suspicious patterns detected.