T09 · Insecure Skill Coding Practices
Error
- Location
archive/20260405_110200_5426.json:4- Finding
Sensitive Court Records and Active Delivery Parameters Bundled in the Skill Package
- Content
View full analysis
- Remediation
View remediation
Security audit
法院短信识别与文书下载
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent court-document purpose, but it ships sensitive legal archive records and gives the agent broad handling of court links, passwords, verification codes, downloads, and persistent records without enough controls.
Do not install this package as published unless the bundled archive records are removed or fully synthetic. If used after remediation, treat it as a sensitive legal-record automation: confirm target folders before writes, avoid storing raw SMS or court access parameters, prefer user-entered authentication over extracted passwords/codes, require HTTPS-only downloads, and pin any Playwright/MCP dependencies.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:215- Finding
Court Document Identifiers and Files Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:165- Finding
API-Controlled Document Names Permit Path Traversal Outside the Staging Directory
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:128- Finding
Unpinned npm Packages Are Downloaded and Executed
- Content
View full analysis
/dev/null ``` ### Technical Analysis The instructions install and execute packages without exact versions, a lockfile, or integrity verification. The effective dependency contents can change after the Skill has been reviewed. `npm install -g playwright` retrieves the latest version selected by the registry at execution time. The MCP configuration invokes `npx` with an unpinned package name, which may fetch and execute package content dynamically. Package installation can execute lifecycle scripts, while the resulting MCP server runs with the Agent user's privileges. This creates a supply-chain trust boundary that is not controlled by the audited artifact. ### Attack Path 1. A user follows the Skill's fallback installation or MCP configuration instructions. 2. npm resolves the current package version from the configured registry. 3. A malicious registry response, compromised package release, package-account takeover, or unsafe future release supplies modified code. 4. npm lifecycle code or the MCP package executes under the Agent user's account. 5. The malicious dependency reads accessible files, modifies the workspace, captures legal records, or communicates with external systems. ### Impact Assessment A compromised dependency executes with the privileges of the user running npm, `npx`, or the MCP server. Potential scope includes: - Read and write access to the project and user-accessible files. - Access to archived ...[truncated 409 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (24)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs extracting credentials and verification codes from court messages for use in accessing external platforms. This is dangerous because SMS-delivered secrets are authentication factors; automating their capture and reuse broadens the trust boundary and can enable unauthorized document access if logs, archives, prompts, or downstream tools are compromised.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file begins entirely in Chinese and provides no indication that the skill offers language or locale choice, nor that it is explicitly limited to a Chinese-only or region-specific audience. Under the policy for natural-language violations, forcing a specific language without user opt-in should be flagged unless the locale constraint is clearly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs automatic creation of case directories and archiving actions without clear user acknowledgment. In a legal-document workflow, silent filesystem writes can expose sensitive case metadata, create records in the wrong workspace, and cause accidental disclosure or retention of confidential matter names and parties.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The skill directs transmission of user-supplied court-link parameters to external court APIs via
curl. Although contacting the court service is part of the intended function, it still constitutes external transmission of sensitive legal identifiers and may disclose case-related metadata outside the local environment without a clear user-facing consent step.- Content
"playwright": { "command": "npx", "args": ["@anthropic-ai/mcp-playwright"] }
text > **⛔ 大多数情况下不需要 Playwright**：zxfw 平台方案一直接 curl 调用 API，无需浏览器。仅 gdems/jysd 平台或**方案一失败后**才需要方案二/三。禁止在方案一执行期间同时打开浏览器。 #### 方案一 — API 直连（优先）
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This step downloads PDFs from externally returned signed URLs, which sends case-linked requests and writes potentially sensitive legal documents locally. In context this behavior is intended, but it remains security-relevant because it combines external network access with automatic ingestion of confidential files and no explicit consent or verification of destination handling.
- Content
md # 3. 解析文书列表，逐个下载 PDF echo "$resp" | jq -r '.data[] | "\(.c_wsmc)\t\(.wjlj)"' | while IFS=$'\t' read -r name url; do curl -sL -o "/tmp/court-sms-staging/${name}.pdf" "$url" done # 4. 验证下载结果
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill directs extraction and use of court-platform account credentials and SMS verification codes from user messages to authenticate to external systems. Handling live credentials and one-time codes inside an automation flow significantly increases the risk of unauthorized access, credential misuse, and accidental disclosure, especially because the same skill also archives processing details.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill requires saving complete processing details into an internal skill archive directory without explicit user warning. Because the processed content includes court SMS details, case numbers, party names, document metadata, and possibly authentication artifacts, this creates a hidden secondary store of highly sensitive legal data that users may not expect or protect appropriately.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs retention of complete processing details from court messages and downloaded documents in an internal archive. In this legal context, those records are likely to contain sensitive personal data, case information, and potentially traces of access tokens or delivery identifiers, creating a significant confidentiality and compliance risk if the archive is exposed.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest limits the skill to receiving court SMS, extracting information, downloading court documents, and archiving them into case directories. The optional fifth step adds a separate document-management pipeline that scans directories, merges multiple PDFs, standardizes page sizes, adds bookmarks, and renames files based on user preferences, which goes materially beyond the described SMS-to-download-to-archive workflow.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This JSON archive contains user-facing natural-language content and document metadata exclusively in Chinese, but it does not document that the skill is China-specific or that Chinese is an intentional locale constraint. Under the policy rule, forcing a specific language without opt-in or explicit justified scoping can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This JSON archive stores user-facing and summary text entirely in Chinese, including the raw SMS and archived summary, with no indication that the skill offers a language/locale choice or that it is explicitly limited to a Chinese legal workflow. Under the policy rule, a locale-specific constraint should be clearly documented or user-selected rather than implicitly enforced.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The archive format explicitly requires storing full raw SMS content and detailed API responses for court notifications, which can contain case numbers, party names, court identifiers, delivery timestamps, and document metadata. In this legal context, retaining unnecessary raw content and full upstream responses materially increases privacy, confidentiality, and secondary disclosure risk if the archive is accessed, synced, logged, or backed up.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The format instructs preservation of download URL parameters and archive paths linked to specific legal matters, which may expose sensitive tokens, case linkage data, and personally identifiable legal metadata. Because this skill processes court SMS and document-delivery records, these identifiers can enable unauthorized correlation of users to cases or reuse of access parameters if logs or archives are leaked.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file's descriptions, extraction instructions, prompts, and document labels are written exclusively in Chinese and assume Chinese-language SMS and court artifacts, but there is no explicit user opt-in or documented locale-policy justification in the file. Under the stated policy, forcing a specific language or locale without user choice can be a natural-language policy violation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The post-processing trigger is defined in broad natural language and activates when any document-type group in an archive directory exceeds a small threshold. In this skill, which handles legal documents, that can cause unrelated PDFs from the same matter or directory to be incorrectly grouped, merged, renamed, or surfaced for action, creating integrity and privacy risks for case files.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This file is a plain-text file, so only SQP-1 and SQP-3 apply. Line 25 adds a Chinese-language sentence in an otherwise English license file, which imposes a language choice without any opt-in or explanation that the skill is intentionally locale-specific.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The primary workflow states that if no matching case is found, the skill should automatically create a new case directory without asking the user. Later troubleshooting guidance contradicts this by saying the '无匹配案件' case should present three options: choose existing, create new, or temporarily store, which is an active contradiction about whether user confirmation is required.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON manifest-like archive contains descriptive fields about SMS parsing, downloading, and archiving, but provides no explicit trigger phrases, invocation boundaries, or exclusion conditions. For manifest files, the absence of any trigger-scope constraints can make downstream activation behavior ambiguous if this file is used to drive skill invocation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The natural-language strings in the file, including the raw SMS and archived summary, are presented only in Chinese and do not indicate any user opt-in or documented locale limitation. Under the policy, forcing a specific language without choice or justification can be a language/locale policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JSON example uses only Chinese-language descriptions and output naming such as "原告证据.pdf" and Chinese bookmark formats, which indicates a fixed language/locale behavior in the skill's user-facing configuration. The file does not mention any user opt-in for language selection or explain that the skill is intentionally limited to a Chinese legal workflow.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The entire attribution document is written in Chinese and does not provide an alternative language, opt-in, or explanation that the skill is intended only for a Chinese-language or region-specific audience. Under the policy rule for natural-language violations, forcing a specific language without user choice can be a locale-policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This markdown file contains user-facing reporting instructions exclusively in Chinese, which can amount to a language/locale policy issue when no user opt-in or alternative language is provided. The content does not document that the skill is limited to a Chinese-language context or that users can choose another language.
- Content
Static analysis
No suspicious patterns detected.