T09 · Insecure Skill Coding Practices
Warning
- Location
main.py:130- Finding
Sensitive Reviewed Text Is Transmitted in the URL Query String
- Content
View full analysis
- Remediation
View remediation
Security audit
通过调用成均智能的HTTP API接口，检测文本中的敏感信息、语法错误、标点符号问题等
Security checks for vulnerabilities and agentic risk
Overview
The skill appears legitimate, but it should be reviewed because submitted text is sent to a third-party API in a way that can expose it through URL logging.
Install only if you are comfortable sending reviewed text to Chengjun's external API. Avoid submitting secrets, private personal data, regulated data, or confidential drafts unless you have approval, and prefer a fixed version that sends text in the POST body with clear privacy and retention terms.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README explicitly states that user-provided text is sent to an external HTTP API for inspection, but it does not clearly warn users that their content leaves the local environment or describe privacy, retention, or third-party handling implications. This can lead to accidental disclosure of sensitive, regulated, or confidential text if users assume processing is local or do not understand the data-sharing boundary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The top-level description emphasizes content checking but does not clearly and prominently warn that user-provided text is sent to an external third-party service. Users or calling agents may therefore disclose confidential, personal, or proprietary text under the mistaken assumption that processing is local.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md > > **服务信息**： > > - 生产环境 Base URL: https://api.vsbclub.com/ > - 获取Token: https://platform.vsbclub.com/ ## 功能特性
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md > > **服务信息**： > > - 生产环境 Base URL: https://api.vsbclub.com/ > - 获取Token: https://platform.vsbclub.com/ ## 功能特性
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md > > **服务信息**： > > - 生产环境 Base URL: https://api.vsbclub.com/ > - 获取Token: https://platform.vsbclub.com/ ## 功能特性
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The example invocation is phrased as a natural-language request that can easily overlap with ordinary user messages, increasing the chance the skill is triggered on sensitive text without an explicit consent boundary. Because this skill sends submitted content to a third-party HTTP API, an overly broad trigger can cause unintended external transmission of private or regulated data.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The first
check_contentfunction is documented with获取访问token('get access token'), and its body also attempts token/credential retrieval logic. However, this name is later redefined by a secondcheck_contentimplementation that actually performs text detection. This is an active contradiction in code documentation and intent signaling, not merely an omission.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill sends user-supplied text to a third-party remote service (
api.vsbclub.com) for processing, but this file provides no disclosure, consent flow, or data-minimization controls. If users submit sensitive, proprietary, or regulated content, this can cause unintended data exfiltration to an external processor and compliance/privacy issues.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill's name, description, and installation instructions are entirely in Chinese, with no indication that language selection is optional or that the skill is intended only for a Chinese-speaking or China-specific context. This can violate language/locale policy because it imposes a specific language without user opt-in or explicit justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This Python file contains multiple comments and printed user-facing messages exclusively in Chinese, such as the import/test status messages and credential setup instructions. Because the skill does not offer a language/locale choice or explain that it is intentionally region-specific, it creates a natural-language locale policy issue under the requirement to avoid forcing a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
Natural-language instructions, headings, and usage guidance are presented only in Chinese, which effectively enforces a specific language for users of the skill. The file does not offer an alternative language, note that the skill is intended only for Chinese-speaking users, or provide any opt-in for this locale constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Multiple error and status strings are written only in Chinese, such as the API key configuration error and other returned messages, which imposes a specific language on users. The file does not provide any language selection, fallback, or explanation that the skill is intentionally limited to Chinese-speaking users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file contains only Chinese-language comments and does not indicate any user option for language or locale. Under the policy, natural-language content that enforces a specific language without opt-in can be considered a locale/language policy violation.
- Content