T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:67- Finding
QWeather API Credential Exposed Through Unvalidated Host and URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
light-chaser
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent travel-photography planner, but it asks the agent to handle a weather API key in a way that could expose the credential.
Review before installing if you plan to add a real QWeather API key. Use a low-privilege key with quotas, keep config.env private, verify the host is a legitimate QWeather domain, and expect destination/date details to be sent to search or weather services during use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest says to use the skill whenever the user mentions broad phrases like '旅行拍照', '打卡', '旅拍', '摄影攻略', or '出行拍摄计划'. These are common conversational topics rather than narrowly scoped invocation conditions, and the file provides no exclusion conditions or negative examples to clarify when the skill should not activate.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs reading a local config.env file to obtain API credentials, which creates unnecessary secret-handling behavior inside the skill logic. In an agent environment, this expands the skill's access surface and can normalize local secret access without user awareness, increasing the risk of credential misuse or accidental leakage through logs, prompts, or downstream tool calls.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
All API examples hard-code
lang=zh, which imposes a Chinese-language locale regardless of user preference. The file does not offer language choice or state that the skill is intentionally limited to Chinese-speaking users or a China-specific compliance context.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill documentation uses Chinese throughout and does not indicate that the language is optional, user-selectable, or justified as a region-specific constraint. The policy requires flagging language or locale restrictions when a specific language is effectively forced without user opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README states that when API credentials are absent, the skill will fall back to network search for weather data, but it does not clearly warn that user queries, travel plans, or location context may be transmitted to third-party services. In a travel photography skill, those prompts can contain sensitive itinerary and location information, so the undocumented fallback creates a privacy and data-handling risk even if the technical impact is limited.
- Content