T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/china_travel.py:21- Finding
Hard-Coded Proxy Authentication Token
- Content
View full analysis
- Remediation
View remediation
Security audit
중국 여행 팁
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its China travel purpose, but it forwards user travel queries to a remote proxy while shipping a hard-coded proxy token and inconsistent credential disclosure.
Review before installing. The skill appears intended for China travel assistance, not local system access, but it sends your travel queries to an external proxy and includes a reusable proxy token in source. Avoid entering passport details, booking references, addresses, or other sensitive itinerary data. The publisher should remove and rotate the embedded token, use runtime secrets as declared, and make locale and data-handling behavior clearer.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill declares access to the bash tool and relies on networked behavior via a proxy/API flow, but it does not define an explicit tool scope such as allowed-tools or permissions. That creates unnecessary ambiguity about what external actions the skill may perform and weakens least-privilege controls, especially because user queries are forwarded off-platform to a proxy service.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction says to always include
--locale=ko, which mandates Korean responses regardless of the user's preferred language. This is a natural-language locale policy issue because the skill does not provide any opt-in or alternative language choice.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill sends user-supplied travel queries to a remote proxy without any user-facing disclosure, even though those queries may contain sensitive itinerary details such as destinations, dates, lodging preferences, and travel patterns. This creates a privacy and transparency risk because users are not informed that their data is being transmitted to a third-party service for processing.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code embeds a reusable proxy token in the client and sends it over the network, while the docstring misleadingly claims the token is injected server-side. Hardcoded client-side secrets are easily recoverable from source, packaged skills, logs, or process inspection, allowing unauthorized third parties to abuse the proxy service or impersonate this client.
- Content