Security audit

SkillHub.cn 技能一键发布指南

Security checks for vulnerabilities and agentic risk

Overview

This skill is a publishing guide, but it embeds real-looking credentials and tells agents to use them for external login, publishing, memory access, and document upload.

Do not install or use this skill as published. Treat the embedded tokens and API keys as compromised, rotate them, replace all credential values with placeholders, remove instructions to read MEMORY.md for secrets, and require explicit user approval before any external login, publish, or upload action.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:42
Finding: Hardcoded SkillHub Authentication Token
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:171
Finding: Hardcoded IMA Client Credentials
Content: View full analysis
SKILL.md', content: body }, { clientId: '66f4b780fc9d552fb2d6bb1a785fda3f', apiKey: '+3mGg42wQRJga5eDYvGzMSBF6xn9k4q6HGFAjcM1864WOX8np0UYvBBHiWtspRPkAJA3dh04Bg==' }).then(r => console.log(r)); ``` ### Technical Analysis The document embeds an IMA client identifier and API key directly in an executable JavaScript example. These values are included in a package whose purpose is publication and sharing, making them available to every recipient. An API key is a bearer secret unless the service enforces additional controls. An attacker can copy the credential pair and call the associated API independently of this Skill. Encoding characters in the key do not provide encryption or protection. ### Attack Path 1. An attacker obtains `SKILL.md` from the package or a published registry entry. 2. The attacker copies the `clientId` and `apiKey`. 3. The attacker reproduces requests against the IMA API using the exposed credentials. 4. The service processes those requests with the permissions assigned to the compromised client. 5. The attacker abuses available operations until the credential is revoked or server-side restrictions block the requests. ### Impact Assessment The attacker may obtain all IMA API privileges associated with the exposed client. Confirmed example functionality includes importing documents. Depending on the account's actual API scope, abuse could cause unauthorized content creation, data disclosure, quota consumption, reputational damage, or modification of resources accessible to that client. The exact maximum scope cannot be established from this single file, but the credentials must be considered compromised. ]]>
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:40
Finding: Instructions Direct the Agent to Retrieve Secrets from Persistent Memory
Content: View full analysis
⚠️ 此 Token 只能从 Agent 的 MEMORY.md 中获取，禁止写入任何发布包、SKILL.md、README.md、代码文件或 IMA 笔记。 ``` ### Technical Analysis The Skill directs an Agent to use the broad persistent state file `MEMORY.md` as a credential store and retrieval source. A publishing operation only needs a specific, narrowly scoped publication credential; it does not require general access to long-term Agent memory. General memory may contain unrelated secrets, personal information, instructions, or state from other tasks. Normalizing memory inspection for authentication breaks least-privilege boundaries and creates a reusable technique through which malicious or compromised instructions can discover sensitive data. The file compounds this issue by displaying a token that it claims should be retrieved only from memory. ### Attack Path 1. The Agent loads the publication instructions. 2. The instructions tell the Agent to inspect `MEMORY.md` for credentials. 3. The Agent accesses persistent state that may contain more data than the publication task requires. 4. A malicious extension of the workflow, compromised tool, or external upload step captures retrieved memory content or credentials. 5. The recovered information is used to access external accounts or influence later Agent operations. ### Impact Assessment The immediate privilege gained is access to persistent Agent state beyond the narrow needs of Skill publication. The ultimate impact depends on the contents of `MEMORY.md`; it may expose unrelated API tokens, account identifiers, private task context, or persistent instructions. If recovered cre ...[truncated 237 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:165
Finding: External Document Upload Can Transmit Secrets Embedded in the Skill Body
Content: View full analysis
\\SKILL.md', 'utf8'); const body = content.replace(/^---\n[\s\S]*?---\n/, ''); imaApi('openapi/note/v1/import_doc', { content_format: 1, title: '<技能名称> SKILL.md', content: body }, { clientId: '66f4b780fc9d552fb2d6bb1a785fda3f', apiKey: '+3mGg42wQRJga5eDYvGzMSBF6xn9k4q6HGFAjcM1864WOX8np0UYvBBHiWtspRPkAJA3dh04Bg==' }).then(r => console.log(r)); ``` ### Technical Analysis The workflow reads an entire `SKILL.md`, removes only its YAML frontmatter, and passes the remaining body to an externally integrated API. It does not scan or redact secrets before transmission. In this project, the SkillHub token and IMA credentials are present in the Markdown body rather than exclusively in frontmatter. Consequently, applying the documented archival procedure to this file preserves those values in `body` and submits them through `imaApi`. The implementation of the locally required `ima_api.cjs` module is not included in the audited project, so the exact network endpoint and additional behavior cannot be independently verified. Nevertheless, the explicit import operation establishes that document content is intended to leave the source file through an external API integration. ### Attack Path 1. The Agent follows the optional archival step. 2. The script reads `SKILL.md` in full. 3. The regular expression removes only the frontmatter. 4. Hardcoded credentials elsewhere in the document remain in `body`. 5. The script supplies `body` to `imaApi` for document import. 6. The external service, API intermediaries, logs, or users with access to th ...[truncated 639 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:31
Finding: Unpinned Global Installation of Third-Party CLI Packages
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Ssd 3

Critical

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The file embeds a live-looking API token intended for reuse in authentication commands. This is a textbook secret disclosure with immediate account-compromise potential, especially dangerous in a skill because an agent may automatically copy and use it.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The document states that tokens and API keys must never appear in the publishable package, yet it contains real-looking credentials elsewhere in the same file. That contradiction normalizes unsafe secret handling and creates an immediate risk of credential disclosure if this file is shared, uploaded, indexed, or executed by an agent following the guide.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: This section explicitly says the token must only come from MEMORY.md and must not be written into SKILL.md, but then discloses the token directly in SKILL.md. This is a direct secret exposure that can enable unauthorized access to the external SkillHub account or namespace.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The guide instructs agents to retrieve and use a secret from MEMORY.md during a real publishing workflow. Directing an agent to access and operationalize secrets is highly sensitive, and here it is compounded by the fact that the same secret is also disclosed in the document itself.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This section exposes an explicit token and pairs it with concrete login commands, making misuse straightforward. The absence of strong warnings or safeguards is particularly dangerous because the content is formatted as operational instructions that invite immediate execution.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This workflow instructs agents to authenticate with the disclosed token and publish externally. Even if the token were later invalidated, the pattern teaches unsafe behavior: autonomous external actions using embedded secrets with no verification or approval boundary.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The login and publish examples include a live-looking bearer token in command lines. Command examples are especially dangerous because users or agents may copy-paste them verbatim, causing credential reuse, logging, shell history exposure, and unauthorized publication activity.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The alternate CLI path repeats the same exposed token and instructs authentication against a real registry. Repetition increases the chance that agents or humans will treat the credential as approved for operational use, expanding the blast radius of the leak.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The later workflow repeats instructions to use the same token, reinforcing credential reuse and external action execution. Repeated secret-bearing steps increase the likelihood of accidental disclosure, copied misuse, and agent automation against real services.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The IMA archival example embeds a real-looking client ID and API key pair in source code. Publishing credentialed example code in documentation can directly enable unauthorized API use, data access, abuse of the service, and downstream compromise if the same credentials are reused elsewhere.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The IMA example discloses a real-looking client credential pair without protective handling guidance. In a skill document, such examples are especially risky because they can be scraped, copied into code, or invoked by automation against a live endpoint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The display name and the entire operational guidance are presented solely in Chinese, and the document frames itself as a universal guide for 'any agent'. For a generally applicable skill, forcing a single language without opt-in or justification can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The summary encourages other agents to follow the guide directly, implying unconditional execution. Because the guide includes authentication and publication steps, this increases the risk of autonomous misuse or accidental deployment by agents lacking proper authorization.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Stating that any agent can execute the guide without consulting other materials creates an overly broad activation scope for a skill that performs external publication and credential use. In this context, broad invocation is dangerous because the document also includes secrets and operational steps that can trigger real-world changes.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The self-check warns against token leakage in dry-run output while the same file still contains exposed credentials. This inconsistency undermines the safety checklist and may cause operators to overlook the more obvious secret already embedded in the guide.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:177