T09 · Insecure Skill Coding Practices
Error
- Location
scripts/okki-sync.js:397- Finding
Outgoing email synchronization can associate sensitive content with the wrong CRM customer
- Content
View full analysis
- Remediation
View remediation
Security audit
OKKI Email Sync
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent CRM-sync purpose, but it automatically writes sensitive email and quote data into OKKI and local temp files with weak customer-matching safeguards that can misfile data.
Install only in an environment where OKKI credentials are least-privileged, executable paths are controlled, and operators explicitly accept automatic CRM logging of email excerpts and quotation details. Require stronger customer-match validation or human review before enabling automatic writes, and move deduplication and unmatched logs out of shared /tmp storage.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/okki-sync.js:207- Finding
Unverified partial-domain results can route email and quotation data to an unrelated CRM company
- Content
View full analysis
0) { return { company_id: result.data[0].company_id || result.data[0].id, name: result.data[0].name, match_type: 'domain_partial', confidence: 0.7 }; } ``` The surrounding search initially attempts an exact match: ```javascript const exactMatch = result.data.find(company => { const companyDomain = extractDomain(company.website || company.email || ''); return companyDomain === domain; }); if (exactMatch) { return { company_id: exactMatch.company_id || exactMatch.id, name: exactMatch.name, match_type: 'domain_exact', confidence: 0.95 }; } ``` If no exact match exists, the implementation accepts the first keyword-search result without any additional verification. ### Technical Analysis `searchByDomain` calls the OKKI CLI with the email domain as a general keyword. When no returned company has a website or email domain exactly equal to the requested domain, the function nevertheless selects `result.data[0]`. There is no validation that the first result: - Owns the requested domain - Has a verified email address on that domain - Is uniquely associated with the keyword - Meets a minimum trustworthy confidence threshold - Is the intended recipient of the synchronized communication The hardcoded confidence value of `0.7` does not represent a validated similarity score and is not used to prevent automatic writes. Consequently, any nonempty inexact keyword result is treated as sufficient authorization to write email or quotation details into that company's CRM record. ### Attack Path 1. An email address uses a non-public domain that does not exactly match any returned CRM company's website or email. 2. The domain is submitted to `company list -k` as a keyword. ...[truncated 1528 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/okki-sync.js:35- Finding
Predictable shared temporary files permit state tampering, information disclosure, and symlink-based file writes
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **主文件：** `scripts/okki-sync.js`（同步镜像至 `$WORKSPACE/skills/imap-smtp-email/okki-sync.js`）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **主文件：** `scripts/okki-sync.js`（同步镜像至 `$WORKSPACE/skills/imap-smtp-email/okki-sync.js`）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **主文件：** `scripts/okki-sync.js`（同步镜像至 `$WORKSPACE/skills/imap-smtp-email/okki-sync.js`）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **主文件：** `scripts/okki-sync.js`（同步镜像至 `$WORKSPACE/skills/imap-smtp-email/okki-sync.js`）
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README describes automatic synchronization of emails and quotation events into OKKI and mentions local files used for deduplication and unmatched logs, but it does not present this as an explicit user-facing warning about data handling and persistence. In a skill that processes potentially sensitive business communications, this omission can lead to unintentional disclosure, retention, or compliance issues because operators may enable it without realizing customer email content and metadata are being written to CRM records and local filesystem logs.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill describes environment-dependent behavior and integration with external scripts and services, but it does not declare any explicit tool scope, permissions, or allowed-tools boundaries. In an agent ecosystem, that can cause overbroad execution assumptions and unintended access to environment-backed resources, especially because the module references workspace paths, CLI execution, temp files, and CRM synchronization.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill automatically writes email content and quotation events into an external CRM and also logs unmatched cases locally, but the user-facing description does not clearly warn about this data disclosure and retention. Because the synced fields include message bodies, recipients, attachments metadata, and quotation details, users may unknowingly expose sensitive customer, commercial, or personal data to third-party systems and local logs.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module executes external Python programs whose paths are controllable via environment variables (OKKI_CLI_PATH, VECTOR_SEARCH_PATH, PYTHON_VENV_PATH). In an agent or automation environment, this allows path substitution to attacker-controlled code, turning a CRM sync skill into a generic code-execution primitive with access to process environment, filesystem, and CRM credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The vector-search fallback transmits email address, subject, and a body excerpt to an external search script without transparency or trust guarantees. In context, that script path is also configurable, so sensitive message content may be exposed to untrusted code or secondary storage outside the intended CRM workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill sends email metadata and body excerpts into OKKI trail records without any consent, minimization, or policy check. Because email bodies may contain sensitive business, personal, or regulated data, automatic forwarding to CRM can create unauthorized data propagation and retention risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill writes quotation details, including product and pricing information, directly into CRM records without an approval or notice mechanism. Quotations often contain commercially sensitive data, so silent synchronization can leak confidential pricing and deal terms into broader CRM visibility scopes.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill contains core operational description and instructions in Chinese, while not stating that the skill is intended only for Chinese-speaking users or offering an alternative language. This can amount to a language/locale policy issue because the documentation effectively forces one language without opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file’s natural-language documentation, console output, and CLI usage messages are presented in Chinese only, with no indication that users may choose another language. This can violate language/locale policy when a skill imposes a specific language without opt-in or documented justification.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The stated purpose is operational synchronization into OKKI CRM. The exported and CLI-accessible runTest routine performs environment/connectivity checks against OKKI and the vector-search backend, which is auxiliary diagnostics rather than core sync behavior. While not inherently dangerous, it is outside the manifest's stated user-facing purpose.
- Content