task-status

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:28 AM UTC
• Version: 1.0.1

Overview

The skill is a small read-only status checker, but it can send job IDs to an external plain-HTTP endpoint too broadly and without clear user control.

Review before installing. Use it only for AICNIC job IDs you are comfortable sending to www.aicnic.cn, and be aware the current instructions use plain HTTP, so job IDs and returned job metadata may be visible or modifiable on the network. The skill should ideally narrow activation to explicit AICNIC status checks, ask before sending ambiguous identifiers, and use HTTPS if the service supports it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:28

Finding

Task Metadata Transmitted Over Unencrypted HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28–34
Vulnerability Type: Cleartext HTTP communication
Risk Level: Medium

Vulnerable Code Snippet:

markdown

GET http://www.aicnic.cn/jobs/api/jobs/infos/hpcai28/{jobId}

bash

curl -X GET "http://www.aicnic.cn/jobs/api/jobs/infos/hpcai28/{jobId}" -H "accept: */*"

Technical Analysis

The Skill instructs the Agent to send a user-provided job identifier to an external API over unencrypted HTTP. HTTP provides neither transport confidentiality nor server authenticity and does not protect response integrity.

An attacker capable of observing or modifying network traffic—such as an attacker on the same wireless network, a compromised gateway, or a malicious upstream proxy—could read the requested job ID or alter the API response. Because the workflow trusts data.jobState and other returned metadata, a forged response could cause the Agent to report an incorrect task status, job name, or execution time.

The same insecure endpoint and request pattern are repeated at lines 67 and 75. No authentication credentials are shown in the audited file, so credential exposure is not established.

Attack Path

1. A user asks the Agent to query the status of a job.
2. The Agent inserts the supplied jobId into the documented HTTP endpoint.
3. The request traverses the network without TLS protection.
4. A network-positioned attacker intercepts the request and learns the job identifier.
5. The attacker may modify the server response and provide a forged data.jobState, such as changing FAILED to COMPLETED.
6. The Agent parses the unverified response and presents the attacker-controlled status or metadata to the user.

Impact Assessment

Exploitation does not grant demonstrated local system privileges or code execution. Its scope is limited to the confidentiality and integrity of information exchanged with this API.

Potential imp ...[truncated 297 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the endpoint with an HTTPS URL supported by the authoritative service:

   text

   https://www.aicnic.cn/jobs/api/jobs/infos/hpcai28/{jobId}
   

2. Require valid TLS certificate and hostname verification. Do not disable verification through options such as curl -k.
3. Reject redirects from HTTPS to HTTP and restrict redirects to the expected trusted hostname.
4. Validate the job ID against its expected format and URL-encode it before constructing the request.
5. Apply connection and response timeouts, response-size limits, and an allowlist for accepted content types.
6. Validate the JSON schema, API result code, and expected field types before presenting any returned information.
7. Update every occurrence of the endpoint and examples in SKILL.md, including lines 28, 34, 67, and 75, so users are not directed back to the insecure transport.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation description is broad enough to trigger on generic requests about 'task status' or any mention of a jobId, even when the user may not intend to query the AICNIC system. This can cause the agent to send user-provided identifiers to an external service unnecessarily, creating unintended data disclosure and incorrect tool use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill does not warn that the supplied jobId will be transmitted to an external endpoint over plain HTTP. Users may provide internal or sensitive identifiers without understanding they are being shared outside the local agent context, increasing privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.