other
Error
- Location
scripts/chat.js:17- Finding
Session Credential and User Prompt Disclosure to an Unofficial Third-Party Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Doubao Chat
Security checks for vulnerabilities and agentic risk
Overview
This skill is a simple Doubao chat wrapper, but it sends both user prompts and a reusable session credential to an unofficial third-party Vercel endpoint with limited warning.
Install only if you are comfortable giving doubao-free-api.vercel.app access to your Doubao session identifier and every prompt you send through the skill. Treat DOUBAO_SESSIONID like an account credential, avoid sensitive prompts, and prefer an official scoped API token or official endpoint if available.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/chat.js:40- Finding
Unsanitized Remote Response Bodies Written to Error Logs
- Content
View full analysis
{ try { const result = JSON.parse(responseData); if (result.choices && result.choices[0] && result.choices[0].message) { resolve(result.choices[0].message.content); } else { reject(new Error('Invalid response: ' + responseData)); } } catch (e) { reject(new Error('Failed to parse response: ' + responseData)); } }); ``` The resulting error message is printed at `scripts/chat.js:67-71`: ```javascript } catch (error) { console.error('错误:', error.message); process.exit(1); } ``` ### Technical Analysis When the remote service returns malformed JSON or valid JSON without the expected response structure, the script appends the complete response body to an exception message. The top-level error handler then writes that message to standard error without redaction. Because the remote endpoint controls `responseData`, it can cause arbitrary returned content to be placed into terminal, process-manager, CI/CD, or centralized application logs. If a response body contains sensitive data, internal diagnostic details, or reflected user content, those values may be retained in logs and exposed to users or systems with log access. ### Attack Path 1. A user submits a prompt through the Skill. 2. The third-party endpoint returns malformed JSON or JSON without the expected `choices[0].message` property. 3. The script concatenates the complete remote response body into an error object. 4. The top-level exception handler writes the unsanitized message to standard error. 5. A terminal recorder, CI system, process manager, or log collector retains the response. 6. Anyone with access to those logs may view sensitive content included in the response. ### Impact Assessment The issue can disclose ...[truncated 247 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares use of environment-derived secrets but does not define any explicit tool scope or permission boundary. This weakens least-privilege controls and makes secret access implicit, which increases the chance that the skill can read sensitive environment data without clear user awareness or platform enforcement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation states that chat requests are sent to a remote API endpoint, but it does not clearly warn users that their prompts and possibly related context leave the local device and are transmitted to a third party. This creates a privacy and data-handling risk because users may unknowingly send sensitive content to an external service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill asks users to provide 'DOUBAO_SESSIONID' via an environment variable but does not label it as a sensitive authentication credential or explain the risks of exposing it. Session identifiers can often grant account access or impersonation, so mishandling them may lead to unauthorized use, data exposure, or account compromise.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Multiple user-visible strings, including errors, usage text, and status messages, are presented only in Chinese. This imposes a specific language on users without opt-in or justification, matching the language/locale policy violation criteria.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
User-supplied prompt data is transmitted to a third-party external service, but the script provides no user-facing disclosure or consent mechanism before sending potentially sensitive content off-host. In a chat tool, users may paste secrets, internal data, or personal information, so silent network exfiltration to an external API creates a real confidentiality risk.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The manifest describes a Doubao chat skill with web search support, but does not mention any need to access local environment variables for authentication material. The code requires DOUBAO_SESSIONID from the process environment, which is an additional capability not evident from the stated purpose alone.
- Content