T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mcp_client.py:31- Finding
Cloud credentials and sensitive workbooks are transmitted to a fixed server over plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
LZ Create - 多云迁移到腾讯云
Security checks for vulnerabilities and agentic risk
Overview
This skill performs a coherent cloud migration workflow, but it asks users to send cloud credentials and infrastructure data to a fixed remote server over plaintext HTTP with limited disclosure and weak session scoping.
Review before installing. Use only short-lived, read-only, tightly scoped cloud credentials, avoid pasting secrets into command lines, prefer a trusted HTTPS or self-hosted MCP endpoint, and assume uploaded questionnaires, scan results, generated files, and session IDs may be accessible to the remote service during the session lifetime.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mcp_client.py:435- Finding
Cloud secrets are accepted through command-line arguments
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/mcp_client.py:381- Finding
Remote workspace access appears to rely solely on reusable session identifiers
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs users to provide AK/SK/token credentials and send them to a remote MCP server at a hard-coded external IP address for scanning and AI processing, but it provides no explicit warning about credential transmission, third-party handling, retention, or trust boundaries. In this context, the omission is especially dangerous because the skill is specifically designed to access cloud environments across multiple providers, so misuse or compromise could expose sensitive infrastructure data and credentials.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script accepts cloud AccessKey/SecretKey/SessionToken values on the CLI, injects them into an Excel file, base64-encodes that file, and uploads it to a hard-coded remote MCP server over plain HTTP. This exposes highly sensitive credentials to interception in transit, storage on an external server, shell history/process inspection on the local host, and unintended reuse by the remote service.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill exposes capabilities to read/write files and communicate with a remote MCP server, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it harder for users or the platform to understand and constrain what the skill may access or transmit.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger description is broad enough to activate on common cloud, Terraform, or migration discussions, which can cause the skill to engage when the user did not intend to use a remote migration workflow. In this skill, accidental invocation is more dangerous because the workflow involves credential handling, remote scanning, and generation of artifacts through an external server.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill states that complete-form will overwrite the questionnaire stored in the session, but it does not present this as a user-facing warning about destructive modification. This can lead to silent loss of prior questionnaire state, causing integrity issues and potentially propagating incorrect AI-filled data into later design and Terraform outputs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The module docstring and command/help descriptions are entirely in Chinese, and the script does not provide an alternate language or opt-in locale choice. This can violate language/locale policy when a skill forces a specific language without giving users a documented option.
- Content
Static analysis
No suspicious patterns detected.