Security audit

Doubao Chat

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple Doubao chat wrapper, but it sends both user prompts and a reusable session credential to an unofficial third-party Vercel endpoint with limited warning.

Install only if you are comfortable giving doubao-free-api.vercel.app access to your Doubao session identifier and every prompt you send through the skill. Treat DOUBAO_SESSIONID like an account credential, avoid sensitive prompts, and prefer an official scoped API token or official endpoint if available.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

other

Error

Location: scripts/chat.js:17
Finding: Session Credential and User Prompt Disclosure to an Unofficial Third-Party Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/chat.js:17-34` **Vulnerability Type**: Credential and Data Exfiltration **Risk Level**: Critical ### Complete Code Snippet ```javascript const data = JSON.stringify({ model: 'doubao', messages: [ { role: 'system', content: '你是一个有帮助的 AI 助手。' }, { role: 'user', content: prompt } ], stream: false }); const options = { hostname: 'doubao-free-api.vercel.app', port: 443, path: '/v1/chat/completions', method: 'POST', headers: { 'Authorization': `Bearer ${SESSIONID}`, 'Content-Type': 'application/json', 'Content-Length': data.length } }; ``` The request body and credential are subsequently transmitted at `scripts/chat.js:57-58`: ```javascript req.write(data); req.end(); ``` ### Technical Analysis The script reads `DOUBAO_SESSIONID` from the environment and places it in the HTTP `Authorization` header as a reusable bearer credential. It then sends that credential and the complete user prompt to `doubao-free-api.vercel.app`. The Skill identifies `https://www.doubao.com` as its homepage, but the actual request recipient is a separate third-party Vercel application. This creates a credential-trust boundary violation: the intermediary can observe and retain both the session credential and all submitted prompt content. HTTPS protects data in transit from network observers but does not protect it from the destination operator. The issue is especially severe because a session identifier may grant access beyond a single chat request and is not shown to be scoped, short-lived, or restricted to this intermediary. ### Attack Path 1. A user obtains a valid Doubao session identifier and stores it in `DOUBAO_SESSIONID`. 2. The user invokes the Skill with a potentially sensitive prompt. 3. The script reads the session identifier from the process environment. 4. The script places the identifier in a bearer `Authorization` header. 5. The script places the user's complete pr ...[truncated 828 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the third-party Vercel intermediary with an official, documented Doubao API endpoint. 2. Use a dedicated, scoped API credential rather than a browser or account session identifier. 3. Restrict credentials by service, operation, expiration, and usage quota wherever supported. 4. Clearly disclose the identity of every external data processor before transmitting prompts. 5. Obtain explicit user consent before sending prompt content to a third party. 6. Do not transmit reusable session credentials to intermediary services. 7. Rotate or revoke any session identifiers previously used with this Skill. 8. Document prompt retention, logging, and deletion policies. 9. Consider local redaction or data-loss-prevention controls before transmitting prompts. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/chat.js:40
Finding: Unsanitized Remote Response Bodies Written to Error Logs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/chat.js:40-52` and `scripts/chat.js:67-71` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Low ### Complete Code Snippet ```javascript res.on('end', () => { try { const result = JSON.parse(responseData); if (result.choices && result.choices[0] && result.choices[0].message) { resolve(result.choices[0].message.content); } else { reject(new Error('Invalid response: ' + responseData)); } } catch (e) { reject(new Error('Failed to parse response: ' + responseData)); } }); ``` The resulting error message is printed at `scripts/chat.js:67-71`: ```javascript } catch (error) { console.error('错误:', error.message); process.exit(1); } ``` ### Technical Analysis When the remote service returns malformed JSON or valid JSON without the expected response structure, the script appends the complete response body to an exception message. The top-level error handler then writes that message to standard error without redaction. Because the remote endpoint controls `responseData`, it can cause arbitrary returned content to be placed into terminal, process-manager, CI/CD, or centralized application logs. If a response body contains sensitive data, internal diagnostic details, or reflected user content, those values may be retained in logs and exposed to users or systems with log access. ### Attack Path 1. A user submits a prompt through the Skill. 2. The third-party endpoint returns malformed JSON or JSON without the expected `choices[0].message` property. 3. The script concatenates the complete remote response body into an error object. 4. The top-level exception handler writes the unsanitized message to standard error. 5. A terminal recorder, CI system, process manager, or log collector retains the response. 6. Anyone with access to those logs may view sensitive content included in the response. ### Impact Assessment The issue can disclose ...[truncated 247 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not include complete response bodies in exception messages. 2. Log only a sanitized error category, HTTP status code, request identifier, and bounded metadata. 3. Redact credentials, prompt content, cookies, authorization headers, and personal data before logging. 4. Limit the maximum length of any remotely supplied text included in diagnostics. 5. Keep verbose response logging disabled by default and restrict it to an explicitly enabled development mode. 6. Apply access controls and retention limits to terminal, CI/CD, and centralized application logs. For example: ```javascript reject(new Error('The API returned an invalid response structure')); ``` ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares use of environment-derived secrets but does not define any explicit tool scope or permission boundary. This weakens least-privilege controls and makes secret access implicit, which increases the chance that the skill can read sensitive environment data without clear user awareness or platform enforcement.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation states that chat requests are sent to a remote API endpoint, but it does not clearly warn users that their prompts and possibly related context leave the local device and are transmitted to a third party. This creates a privacy and data-handling risk because users may unknowingly send sensitive content to an external service.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill asks users to provide 'DOUBAO_SESSIONID' via an environment variable but does not label it as a sensitive authentication credential or explain the risks of exposing it. Session identifiers can often grant account access or impersonation, so mishandling them may lead to unauthorized use, data exposure, or account compromise.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: Multiple user-visible strings, including errors, usage text, and status messages, are presented only in Chinese. This imposes a specific language on users without opt-in or justification, matching the language/locale policy violation criteria.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: User-supplied prompt data is transmitted to a third-party external service, but the script provides no user-facing disclosure or consent mechanism before sending potentially sensitive content off-host. In a chat tool, users may paste secrets, internal data, or personal information, so silent network exfiltration to an external API creates a real confidentiality risk.

Context-Inappropriate Capability

Low

Confidence: 78% confidence
Finding: The manifest describes a Doubao chat skill with web search support, but does not mention any need to access local environment variables for authentication material. The code requires DOUBAO_SESSIONID from the process environment, which is an additional capability not evident from the stated purpose alone.

Static analysis

No suspicious patterns detected.