T09 · Insecure Skill Coding Practices
Warning
- Location
bimwing_client.py:55- Finding
Plaintext Credential Storage with Incomplete Packaging Protection
- Content
View full analysis
- Remediation
View remediation
Security audit
BIMWing 三维模型在线浏览
Security checks for vulnerabilities and agentic risk
Overview
The skill’s BIMWing upload behavior is mostly disclosed and purpose-aligned, but it persists account passwords in plaintext while claiming a missing gitignore safeguard.
Install only if you are comfortable sending selected model files to BIMWing and creating share links there. Prefer environment variables over saved credentials, avoid shared machines, and verify or add a .gitignore for config.local.json before using persistent login storage.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 分享时只发 `SKILL.md` + `bimwing_client.py` + `bimwing_browser.py` + 空的 `config.json` + `.gitignore`。
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill describes capabilities to read environment variables, read and write local files, make network requests, and invoke local scripts, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap: an agent or reviewer cannot enforce least privilege up front, increasing the chance of unintended access to sensitive local files, credentials, or account data during execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script automatically logs into a third-party website using supplied credentials and uploads a local file to that remote service, but the code itself provides no runtime confirmation, warning, or consent step before transmitting sensitive data. In this skill’s context, remote upload is the intended functionality, so this is not inherently malicious; however, it still creates a real security/privacy risk because users may invoke it without fully appreciating that credentials and potentially sensitive BIM/CAD files are being sent off-host.
- Content
Static analysis
No suspicious patterns detected.