T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/bicqa.py:94- Finding
API Credential Forwarding to Arbitrary HTTPS Hosts
- Content
View full analysis
- Remediation
View remediation
Security audit
BIC-QA
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed BIC-QA API client for database and operating-system Q&A, with expected local credential and session storage but no hidden execution or unrelated behavior.
Install only if you intend to use BIC-QA and are comfortable sending database or OS troubleshooting questions to its API. Keep the API key file private, avoid putting BICQA_STATE_DIR or BICQA_STATE_FILE in shared or version-controlled directories, and do not enable BICQA_ALLOW_CUSTOM_BASE_URL unless you fully trust the custom endpoint because it will receive your API key and question content.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/bicqa.py:180- Finding
Sensitive State Written Through a Predictable Temporary File
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill invokes Python scripts, reads environment variables and local files, persists session state, and makes outbound network requests, but it declares no explicit tool/permission scope. In agents that honor capability declarations, this creates an overbroad or ambiguous trust boundary: the skill may gain access to shell, filesystem, secrets, and network without clear least-privilege constraints or user visibility.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description is entirely written as a Chinese-only invocation and usage description, with no indication that users may choose another language. Under the policy for natural-language violations, forcing a specific language without opt-in is reportable unless the locale restriction is clearly documented and justified, which it is not here.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
不要把 Key 写进 SKILL.md、脚本、命令历史或回复里。 配置方式（bash / WSL / macOS）：
bash mkdir -p ~/.bic/config && chmod 700 ~/.bic/config printf '%s' '<你的Key>' > ~/.bic/config/api_key && chmod 600 ~/.bic/config/api_key
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 74% confidence
- Finding
The skill explicitly stores long-lived credentials and conversation/session state on disk under the user's home directory. Even with restrictive permissions, persistent local storage increases the blast radius of compromise on multi-user systems, shared hosts, backups, developer workstations, or when paths are overridden to insecure locations; additionally, state files may contain sensitive operational queries or identifiers.
- Content
不要把 Key 写进 SKILL.md、脚本、命令历史或回复里。 配置方式（bash / WSL / macOS）：
bash mkdir -p ~/.bic/config && chmod 700 ~/.bic/config printf '%s' '<你的Key>' > ~/.bic/config/api_key && chmod 600 ~/.bic/config/api_key
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash mkdir -p ~/.bic/config && chmod 700 ~/.bic/config printf '%s' '<你的Key>' > ~/.bic/config/api_key && chmod 600 ~/.bic/config/api_keyWindows PowerShell：
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python "NO_API_KEY", "未找到 BIC-QA API Key。请到 https://www.bic-qa.com 注册获取，然后二选一：\n" " 1) export BIC_API_KEY='<你的Key>'\n" " 2) printf '%s' '<你的Key>' > ~/.bic/config/api_key && chmod 600 ~/.bic/config/api_key", )
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
在 HTTP 请求头中固定设置
Accept-Language: zh-CN，会将语言/区域偏好强制为中文环境。文件中没有看到允许用户选择语言、关闭该行为或说明该限制仅适用于特定合规区域的机制，因此符合语言/locale 策略违规情形。- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This API reference uses Chinese throughout and does not indicate that users may choose another language or that the Chinese-only presentation is a justified regional constraint.
- Content
Static analysis
No suspicious patterns detected.