T09 · Insecure Skill Coding Practices
Error
- Location
scripts/okki-integration.js:369- Finding
Draft-Controlled Arbitrary File Overwrite During Synchronization
- Content
View full analysis
- Remediation
View remediation
Security audit
Follow-up Engine (CRM Automation)
Security checks for vulnerabilities and agentic risk
Overview
This skill needs review because it can run scheduled sales automation that writes customer data into a CRM, and the implementation has weak safeguards around record matching, logging, and local file writes.
Install only if you intend to let this skill run scheduled B2B follow-up workflows against OKKI CRM. Before enabling live sync or cron, require exact CRM identity matching, reject draft-controlled internal fields such as filepath, mask customer emails in logs, define log retention, and document whether any send, archive, or notification action is actually permitted. Keep it in dry-run mode until those controls are verified.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/okki-integration.js:188- Finding
Ambiguous Customer Matching Can Write Follow-Up Data to the Wrong CRM Record
- Content
View full analysis
0) { return { company_id: result.data[0].company_id || result.data[0].id, name: result.data[0].name, match_type: 'domain_partial', confidence: 0.7 }; } ``` ```js // Partial name match return { company_id: result.data[0].company_id || result.data[0].id, name: result.data[0].name, match_type: 'name_partial', confidence: 0.7 }; ``` ```js async function matchCustomer(draft) { // If draft already has an OKKI company ID, use it directly if (draft.okki_company_id) { log(`Using existing OKKI customer ID: ${draft.okki_company_id}`); return { company_id: draft.okki_company_id, name: draft.customer_name, match_type: 'existing_id', confidence: 1.0 }; } // Try matching by email domain if (draft.customer_email) { const domain = extractDomain(draft.customer_email); if (domain && !isPublicDomain(domain)) { const domainResult = await searchCustomerByDomain(domain); if (domainResult) { return domainResult; } } } // Try matching by customer name if (draft.customer_name) { const nameResult = await searchCustomerByName(draft.customer_name); if (nameResult) { return nameResult; } } return null; } ``` The selected identifier is subsequently used to create a trail: ```js const result = await execOkkiCli([ 'trail', 'add', '--company', companyId, '--content', content, '--type', CONFIG.TRAIL_TYPE.FOLLOW_UP.toString() ]); ``` ### Technical Analysis When no exact domain or company-name match exists, the integration automatically accepts the first search result and assigns it a confidence value of `0.7`. That confidence value is informational only; no ...[truncated 2062 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/okki-integration.js:447- Finding
Unredacted Customer Personal Data Is Written to Logs and Dry-Run Output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (29)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code chunk is narrowly an OKKI synchronization utility. It loads already-created draft files, deduplicates them, looks up matching companies in OKKI, creates follow-up trail entries, updates local draft status, and logs results. The declared description claims a broader automated follow-up scheduling and execution engine that generates personalized follow-up email drafts based on customer stage, last contact date, and strategy, with configurable CRM integration. None of the generation or scheduling behavior appears in this code chunk, and the CRM integration is not configurable here—it is explicitly tied to OKKI via a Python CLI. While syncing follow-up records to a CRM is consistent with part of the description, the actual code materially underdelivers on the declared primary capabilities and is more specialized than described.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md */30 * * * * cd $WORKSPACE/skills/follow-up-engine && node scripts/follow-up-scheduler.js --mode auto >> /tmp/follow-up-scheduler.log 2>&1
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md */30 * * * * cd $WORKSPACE/skills/follow-up-engine && node scripts/follow-up-scheduler.js --mode auto >> /tmp/follow-up-scheduler.log 2>&1
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md */30 * * * * cd $WORKSPACE/skills/follow-up-engine && node scripts/follow-up-scheduler.js --mode auto >> /tmp/follow-up-scheduler.log 2>&1
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md */30 * * * * cd $WORKSPACE/skills/follow-up-engine && node scripts/follow-up-scheduler.js --mode auto >> /tmp/follow-up-scheduler.log 2>&1
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md */30 * * * * cd $WORKSPACE/skills/follow-up-engine && node scripts/follow-up-scheduler.js --mode auto >> /tmp/follow-up-scheduler.log 2>&1
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md */30 * * * * cd $WORKSPACE/skills/follow-up-engine && node scripts/follow-up-scheduler.js --mode auto >> /tmp/follow-up-scheduler.log 2>&1
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 0 * * * * cd $WORKSPACE/skills/follow-up-engine && node scripts/okki-integration.js --sync >> /tmp/okki-integration.log 2>&1
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 0 * * * * cd $WORKSPACE/skills/follow-up-engine && node scripts/okki-integration.js --sync >> /tmp/okki-integration.log 2>&1
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 0 * * * * cd $WORKSPACE/skills/follow-up-engine && node scripts/okki-integration.js --sync >> /tmp/okki-integration.log 2>&1
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 0 * * * * cd $WORKSPACE/skills/follow-up-engine && node scripts/okki-integration.js --sync >> /tmp/okki-integration.log 2>&1
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 0 * * * * cd $WORKSPACE/skills/follow-up-engine && node scripts/okki-integration.js --sync >> /tmp/okki-integration.log 2>&1
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README asserts a strong safety guarantee ('严禁自动发送') while other parts of the workflow describe automatic first replies being triggered and only an approval gate before sending. This kind of contradictory documentation can mislead operators into over-trusting the skill's behavior, increasing the chance of unintended outbound customer communication if implementation or review controls are weaker than implied.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill references environment variables and scheduled execution but does not declare any explicit tool scope or permissions boundary. This makes the skill's operational capabilities implicit, increasing the risk of over-privileged execution, accidental secret exposure, or unsafe runtime assumptions when integrated into an agent platform.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The title and core description include Chinese text while the manifest metadata is in English, but the document does not state that the skill is region-specific or provide any user opt-in for language preference. This can violate language/locale policy by implicitly forcing a specific language for part of the user-facing skill documentation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest claims the skill is for follow-up scheduling and draft generation, but this configuration also enables a direct sending path via
send_reminder. That expands the trust boundary from assistive drafting to externally visible action, increasing the risk of unauthorized customer contact, spam, or policy bypass if the send path is triggered without clear user consent and enforcement controls.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The lost-stage workflow performs
archive_and_notify, which introduces side effects beyond the stated purpose of scheduling follow-ups and drafting emails. Undisclosed notification and archival behavior can affect records handling, trigger messages to internal channels, and create privacy or workflow integrity issues if users did not expect this automation.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The manifest fixes business hours to the Asia/Shanghai timezone, which imposes a specific locale assumption. Because the file does not document user choice, opt-in, or a region-specific justification, this may violate the language/locale policy for skills expected to operate across users or regions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
auto_draft_enabledcombined with configured direct-send behavior means the skill can automate customer follow-up actions without any visible warning in the manifest. Even if approval is required for some sends, users may misunderstand the degree of automation, leading to unintended outbound communications, compliance issues, or reputational harm.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This JSON contains user-facing natural-language content in multiple places, including Chinese values such as stage names and suggested actions alongside English email subjects and intents. Because the file does not state that the skill is limited to a specific locale or that language is selected based on user preference, it risks violating a language/locale policy by producing communications in a fixed or inconsistent language without opt-in.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes a follow-up engine for scheduling reminders, generating follow-up drafts, and syncing follow-up records with CRM systems. This file instead defines a comprehensive customer lifecycle state machine covering quotation, sample shipping, negotiation, payment, closed-won, and archival/lost handling, which is broader sales process automation rather than just follow-up execution.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The stated purpose is automated outbound sales follow-ups and CRM sync, but this config reacts to logistics tracking events, finance payment events, and archival review flows. Those capabilities imply cross-functional operational workflow handling beyond what is obviously required to schedule follow-ups or draft emails.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code embeds its natural-language description and operational messages entirely in Chinese, including the declared feature summary and many runtime logs. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly justified or configurable.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The code sends follow-up content containing customer name, email, stage, and subject to an external OKKI system via the CLI/API. Although the file comments describe the integration purpose, there is no confirmation prompt or explicit user-facing disclosure at the point of transmission that personal/customer data will be sent externally.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The E2E test hard-codes checks for developer-specific filesystem paths outside the skill directory, including a local OKKI CLI path and another skill workspace. This creates environment-coupled behavior that can leak host layout details in logs, fail unpredictably on other machines, and establishes undeclared trust/dependency relationships beyond the follow-up engine’s stated scope.
- Content