T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/env.js:19- Finding
Overbroad Parent-Directory Environment File Loading
- Content
View full analysis
- Remediation
View remediation
Security audit
白牛企业信息查询(China Company Search Bainiu)
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to be a legitimate enterprise-data lookup integration, but it has overbroad local secret-file handling and under-disclosed external upload behavior that users should review before installing.
Review before installing. Use a dedicated BAINIU_API_KEY and prefer setting it as an environment variable rather than placing this skill under a project that has a broader .env file. Only upload company lists you are comfortable sending to Bainiu's external API, and treat returned Excel links as potentially sensitive. If the skill returns no result, confirm before using general web search as a fallback.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (28)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims authoritative real-time enterprise-data retrieval and bulk export capability, but the provided content only documents tool discovery and generic wrapper invocations rather than clearly bounded data-access behavior. This mismatch is dangerous because users and downstream agents may trust the skill with sensitive enterprise lookups or file uploads under false assumptions about what is actually implemented, reviewed, or constrained.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/upload_file.js "<txt文件路径>"
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation says mainland China enterprise information must be obtained through this skill, but the error-handling section allows falling back to network search when data is empty. That contradiction can cause policy bypass, inconsistent data provenance, and accidental disclosure of user query targets to external search services when the user expected use of the designated provider only.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file instructs the agent to fall back to WebSearch when this skill returns no data, which directly conflicts with the manifest requirement that Mainland China enterprise information must be obtained through this skill in real time rather than from model knowledge or alternate sources. This can cause the agent to bypass the intended trusted data boundary, leading to inconsistent, unverified, or policy-noncompliant answers for regulated enterprise-information queries.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js /** * 公共环境变量处理模块 * * 提供统一的 .env 文件加载和 API Key 获取功能 */ const fs = require('fs');
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js /** * 公共环境变量处理模块 * * 提供统一的 .env 文件加载和 API Key 获取功能 */ const fs = require('fs');
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js /** * 公共环境变量处理模块 * * 提供统一的 .env 文件加载和 API Key 获取功能 */ const fs = require('fs');
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js /** * 公共环境变量处理模块 * * 提供统一的 .env 文件加载和 API Key 获取功能 */ const fs = require('fs');
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js /** * 公共环境变量处理模块 * * 提供统一的 .env 文件加载和 API Key 获取功能 */ const fs = require('fs');
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js /** * 公共环境变量处理模块 * * 提供统一的 .env 文件加载和 API Key 获取功能 */ const fs = require('fs');
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js /** * 公共环境变量处理模块 * * 提供统一的 .env 文件加载和 API Key 获取功能 */ const fs = require('fs');
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js let currentDir = __dirname; for (let i = 0; i < 5; i++) { const envPath = path.join(currentDir, '.env'); if (fs.existsSync(envPath)) { return envPath; }
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js let currentDir = __dirname; for (let i = 0; i < 5; i++) { const envPath = path.join(currentDir, '.env'); if (fs.existsSync(envPath)) { return envPath; }
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs operators to create a
.envfile and provide aBAINIU_API_KEY, but the manifest declares no explicit tool scope or permissions despite using environment-backed secrets. This weakens least-privilege and reviewability because secret access is implied in documentation rather than constrained in the skill declaration, increasing the chance of overbroad secret exposure or unintended secret handling.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
L004 明确写明“当查询任何关于中国大陆企业信息时，必须通过本skill实时获取”，对特定地域场景施加强制性处理要求。该表述构成地域/locale层面的硬性约束，但文档未说明用户可选择其他方式，也未给出合规或政策上的充分理由。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The trigger scenarios are broad, natural-language examples without crisp activation boundaries, so the skill may be invoked for loosely related requests. In a skill that can perform external enterprise lookups and batch export, over-triggering increases the risk of unnecessary third-party data transmission and unintended use of privileged capabilities.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill supports uploading bulk enterprise-name lists and returns downloadable files, but it does not clearly disclose transmission, storage, retention, or third-party processing details. Even if the data is 'just company names,' batch lists can reveal business intent, customer pipelines, investigations, or other sensitive operational information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file documents handling of a sensitive credential and explicitly tells users to create a
.envfile containingBAINIU_API_KEY, but it does not include any warning about keeping the file out of version control or restricting access. For markdown files, omitting warnings about behaviors that could affect user privacy or system integrity qualifies as a missing user warning.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JavaScript file contains natural-language comments and console output exclusively in Chinese, including the API key setup guide shown to users. The file does not indicate that the skill is intentionally limited to Chinese-speaking users or provide any opt-in/choice of language, which conflicts with the policy against forcing a specific language without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script sends the local text file contents together with an API key to a remote service, but the CLI flow does not present an explicit warning or confirmation that user-supplied enterprise data will leave the local environment. In a data-query skill handling potentially sensitive company lists or identifiers, this can cause inadvertent external disclosure, especially when operators assume the tool only performs local validation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
All user-facing instructional text in the file is written in Chinese, and there is no indication that the skill is region-specific or that users can choose another language. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file contains user-facing operational guidance only in Chinese, which can amount to a language/locale restriction without explicit user opt-in. The file does not state that the skill is China-specific or otherwise justify the locale constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file contains all user-facing instructions and tool descriptions in Chinese, but does not indicate that the skill is region-specific or provide any user opt-in for language/locale. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Natural-language strings in the file, including the top-level documentation and runtime help output, force a specific language/locale for all users. There is no indication that the user can choose another language or that the Chinese-only constraint is a documented, justified regional requirement.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code sends the provided tool ID and all key=value parameters to a remote HTTPS API, which may include user or system data. Although the header comments describe usage and required API key, they do not explicitly warn that supplied parameters are transmitted to an external service.
- Content