T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:23- Finding
API Credential Exposure Through URL Query Strings and Plaintext Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
Amazon Analyse
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Amazon analysis purpose, but it uses third-party API credentials unsafely and exposes broader account-changing tools than the stated task needs.
Install only if you are comfortable sending ASINs, keywords, and related analysis inputs to Sorftime. Use a scoped, revocable API key, avoid putting real keys directly in command lines or committed .mcp.json files, and do not allow the skill to modify keyword collections unless you explicitly asked for that action and can verify the exact change.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (26)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README instructs users to configure and use a third-party Sorftime MCP endpoint with an API key, but it does not provide an explicit privacy or network-transmission warning. This matters because product queries, analysis inputs, and potentially generated content may be sent to an external service, creating confidentiality, compliance, and credential-handling risks.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The README explicitly documents sending requests to
https://mcp.sorftime.comwith an API key, confirming external network transmission to a third-party service. In the context of a competitor-analysis skill, such transmission is functionally necessary, but it still poses data exposure and dependency risks if users are unaware of what leaves their environment.- Content
Sorftime MCP API
bash curl -X POST "https://mcp.sorftime.com?key=YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{...}}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs automatic writing of a Markdown report to a local
reports/directory without clearly surfacing that a file will be created as a side effect. Silent local file creation is risky because it persists potentially sensitive competitive research and user-supplied inputs without explicit consent or awareness.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill name/description and the full operating instructions are written in Chinese, indicating the skill is intended to operate in Chinese by default. There is no explicit statement that users may choose another language, nor any documented justification that the skill is restricted to Chinese for compliance or region-specific reasons.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The skill explicitly directs the agent to send data to an external service (
mcp.sorftime.com) via HTTP requests. External transmission is expected for this workflow, but it remains security-relevant because user inputs and queried product identifiers leave the local environment and may be logged, retained, or combined with API credentials by the remote service.- Content
调用格式:
bash curl -s -X POST "https://mcp.sorftime.com?key=YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":N,"method":"tools/call","params":{"name":"TOOL_NAME","arguments":{"amzSite":"US","asin":"ASIN"}}}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
The workflow normalizes repeated external POST requests, SSE response handling, Unicode decoding, and temporary-file use for large responses. In context, this increases exposure because the skill combines third-party transmission with local persistence, creating more opportunities for inadvertent leakage of fetched data, logs, or temp artifacts.
- Content
md | `category_tree` | 类目结构 | **重要提示**： - 所有数据需通过 curl POST 请求获取 - 返回格式为 SSE (event: message + data: JSON) - 中文内容使用 Unicode 转义，需要解码 - 大数据量会保存到临时文件
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is presented as a narrowly scoped Amazon ASIN analysis workflow, but the document later broadens the reachable capability surface to TikTok research, 1688 sourcing, and other unrelated operations. This scope expansion increases the chance that an agent will invoke unnecessary external tools or handle data outside the user's expected context, creating over-collection and misuse risks.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Keyword collection management operations such as add, move, and remove are state-changing actions unrelated to generating a competitor listing analysis report. Including them in the same skill creates an unnecessary permission surface and could lead an agent to modify persistent user data without clear intent or consent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Cross-platform TikTok analysis and 1688 supply-chain research exceed the stated purpose of a single Amazon competitor listing analysis skill. This broadened scope makes the skill more dangerous because it normalizes unrelated external data retrieval and can prompt collection, correlation, or transmission of more data than the user requested.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
The file documents routine transmission of product identifiers and API-authenticated requests to an external service, which is an external data flow. In this skill context that behavior is expected, but it still creates a real security/privacy boundary: user-supplied ASINs, search keywords, and associated metadata are sent to a third-party endpoint, and the same examples also encourage including credentials in the URL, increasing exposure risk.
- Content
md # Sorftime MCP 工具参考 (curl 调用格式) **注意**：Sorftime MCP 使用 SSE 协议，所有工具调用格式如下：
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The examples place the API key in the URL query string, which is commonly logged by shells, proxies, web servers, browser history, process listings, and monitoring tools. Although this is documentation rather than executable code, it normalizes an unsafe credential-handling pattern and can lead users to leak real secrets during normal use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file includes concrete save commands that create a persistent report file under
reports/, but it does not warn users that the report may contain sensitive business data and should be stored, shared, or retained carefully. Under the markdown-specific warning criterion, behaviors affecting user data or privacy should be disclosed.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The document instructs use of an external endpoint and embeds authentication material directly in the request URL, creating a concrete external transmission pattern with credential exposure risk. In the context of an agent skill that may automate outbound requests, this makes accidental secret leakage and unreviewed third-party data transfer more plausible.
- Content
调用方式
bash curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":N,"method":"tools/call","params":{"name":"TOOL_NAME","arguments":{...}}}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The example places the API key in the URL query string, which is commonly captured in browser history, proxy logs, server access logs, monitoring tools, and debugging output. For a skill that performs external API calls and writes reports, this increases the chance of accidental credential disclosure and subsequent unauthorized API use.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill manifest describes competitor listing analysis and automatic report generation, but this referenced API section exposes state-changing keyword library management actions such as add, move, and remove favorites. Managing persistent keyword collections is not an obvious requirement for generating a one-off ASIN analysis report, so this capability is unjustified by the stated purpose.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest claims the skill analyzes Amazon competitor listings across copy, reviews, keywords, and market dynamics. The documented 1688 product search is for finding procurement sources and cost analysis on a separate wholesale platform, which is a different business function from Amazon listing analysis.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest is narrowly framed around Amazon competitor listing analysis triggered with an Amazon ASIN. The documented TikTok product, influencer, video, trend, and category endpoints enable analysis of a separate ecommerce platform and significantly broaden the skill's capability beyond its stated Amazon scope.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The document lists a broad set of callable operations without clear activation boundaries, allowed workflows, or explicit mapping between user intent and specific tools. In an agentic setting, this ambiguity can lead to over-broad tool selection, including unintended use of unrelated or state-changing functions, especially when the skill is invoked for a simple ASIN analysis task.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The referenced MCP document exposes state-changing operations for a personal Amazon keyword library, including add, move, and delete actions, even though the skill’s stated purpose is competitor ASIN analysis and report generation. This scope mismatch increases the chance that the agent could invoke unrelated account-modifying capabilities during analysis workflows, causing unauthorized or accidental changes to user data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document includes a destructive keyword-deletion capability with no warning, approval gate, or confirmation guidance. If exposed to an agent without safeguards, a mistaken inference, prompt injection, or ambiguous instruction could permanently remove items from the user’s keyword library and disrupt business workflows.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language content of the skill documentation is presented entirely in Chinese, which can amount to a language policy violation when no opt-in or alternative language is offered. There is no indication that the skill is intentionally limited to a Chinese-speaking audience for compliance or region-specific reasons.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README states that analysis reports are automatically saved into the project under
reports/, but it does not clearly warn users that invoking the skill will perform a local write operation. While the described behavior is expected for this skill, undocumented file writes reduce informed consent and can surprise users in sensitive repositories or automated environments.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
这里的内联说明把分析步骤建立在
product_report之上，但全文列出的可用接口并没有这个工具，只有category_report。这会让读者误解技能实际依赖的能力，与文档其余部分形成直接不一致。- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
All instructional text in the file is presented in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
All headings and operational guidance in the file are presented in Chinese, and the document does not offer an alternate language or note that the locale is intentionally region-specific. This can be a natural-language policy concern when a skill effectively forces a language without user opt-in.
- Content
Static analysis
No suspicious patterns detected.