扣子Coze CLI工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:51 AM UTC
• Version: 1.0.0

Overview

This Coze CLI skill is coherent, but it gives an agent broad access to install and use an external CLI for uploads, messages, deployments, deletes, and environment changes without enough scoping or safety warnings.

Review this skill before installing. Use it only for intended Coze workspaces and projects, pin and verify the @coze/cli package where possible, avoid sending secrets or confidential source/log files through message or upload commands, and require explicit approval before deploy, delete, env set/delete, config, auth, upgrade, completion setup, or any command that transmits local data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Global Installation of a Third-Party CLI Package

Content

View full analysis

Remediation

View remediation

``` 2. Document the authoritative npm publisher, source repository, and expected package metadata so users can verify provenance before installation. 3. Publish and verify an integrity checksum or cryptographic signature for the reviewed package artifact. 4. Prefer a project-local installation with a committed lockfile over a global installation: ```bash npm install --save-exact @coze/cli@ npx coze --version ``` 5. Where compatible, initially acquire the package with lifecycle scripts disabled and inspect it before enabling execution: ```bash npm install --ignore-scripts --save-exact @coze/cli@ ``` 6. Separate package installation and provenance verification from OAuth authentication. Require users to verify the package version and source before providing credentials. 7. Run the CLI under a least-privileged account and grant only the minimum Coze organization, workspace, and project permissions required for the task. 8. Reconcile the GitHub link in `README.md` with the authoritative repository identified by the official Coze documentation. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 96% confidence

Finding

The 'Send Message to Project' section operationalizes a remote transmission feature and is immediately followed by examples that send direct text, local file context, and piped log data to a project. In this skill context, that makes the exfiltration risk concrete: an agent could forward sensitive local information to an external service under the guise of analysis or debugging.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

Supported types: agent, workflow, app, skill, web, miniprogram, assistant

Send Message to Project

bash

coze code message send "修复登录页面的样式问题" -p <project_id>

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md

---
name: coze-cli
description: Interact with Coze CLI (@coze/cli) — create/deploy Coze projects, manage spaces and organizations, send messages to projects, generate images/audio/video, and automate Coze workflows via terminal. Triggered when user mentions "coze", "coze cli", "扣子 CLI", or any coze command execution.
---

# Coze CLI Skill

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: coze-cli
description: Interact with Coze CLI (@coze/cli) — create/deploy Coze projects, manage spaces and organizations, send messages to projects, generate images/audio/video, and automate Coze workflows via terminal. Triggered when user mentions "coze", "coze cli", "扣子 CLI", or any coze command execution.
---

# Coze CLI Skill

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

---
name: coze-cli
description: Interact with Coze CLI (@coze/cli) — create/deploy Coze projects, manage spaces and organizations, send messages to projects, generate images/audio/video, and automate Coze workflows via terminal. Triggered when user mentions "coze", "coze cli", "扣子 CLI", or any coze command execution.
---

# Coze CLI Skill

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 92% confidence

Finding

The 'Send Message to Project' workflow explicitly includes sending prompts with local file context and piping local logs into a remote Coze project. In an agent-integrated environment this is a real exfiltration risk, because local source files, logs, tokens, stack traces, or proprietary data could be transmitted to an external service with minimal friction.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

coze code project get <project_id> # detail

text

### Send Message to Project

```bash
coze code message send "修复登录页面的样式问题" -p <project_id>

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrase definition is broad enough to activate on generic mentions of 'coze' or any coze command execution, which increases the chance the skill runs in contexts the user did not clearly intend. Over-broad activation can cause the agent to suggest or execute privileged CLI operations, including project messaging and deployment, without sufficiently explicit user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section explicitly encourages sending local file contents and piped terminal data to a remote Coze project, but it does not warn that logs, source files, or other inputs may contain secrets, personal data, or internal code. In an agent setting, this creates a realistic exfiltration path because users may not realize that local context or stdin is being transmitted off-host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents setting and deleting environment variables, including API keys, without warning that these values are sensitive credentials or that deletion/change operations may disrupt production systems. In an automated agent workflow, this can lead to accidental secret exposure, unsafe secret handling, or destructive configuration changes without adequate operator awareness.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation trigger is broad enough to fire on essentially any mention of Coze or Coze command execution, which can cause the skill to be invoked in contexts where the user did not clearly request potentially sensitive CLI actions. In a terminal-capable agent, over-broad activation increases the chance of unintended deployments, messaging, org/space changes, or file operations being suggested or executed under ambiguous user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documents state-changing and potentially sensitive operations including deployment, environment variable modification, and file upload, but does not require warnings, confirmation, or secret-handling guidance. In an agent setting, this omission is dangerous because it normalizes actions that can leak secrets, alter production behavior, or transmit local files to external services without the user appreciating the impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown cheat sheet includes a project deletion command but provides no caution that the action is destructive or may be irreversible. Under the markdown-file criteria, user-facing documentation should warn about behaviors that can affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document includes a command to delete environment variables but does not warn that this can disrupt deployments or remove important configuration. For markdown skills, destructive or integrity-affecting actions should be accompanied by a clear caution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown documents uploading a local file to a remote service but does not disclose that local file contents will be transmitted externally. This is a privacy-relevant behavior that should be clearly called out in user-facing documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The cheat sheet exposes detailed logging options, including full diagnostic logs and log-file output, but does not warn that logs may contain sensitive project, request, or environment details. In markdown documentation, privacy- or integrity-impacting behaviors should include user cautions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.