T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:24- Finding
Unnecessary Use of Sensitive Investment Holdings for Summary Personalization
- Content
View full analysis
- Remediation
View remediation
Security audit
Liurun Fetcher
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed WeChat article summarizer, but it asks to use and persist investment holdings and has unsafe network-fetching code.
Review this before installing if your agent can access Trade Arena or other financial data. Do not grant portfolio access or enable scheduled runs unless you explicitly want that behavior, and prefer fixing the fetch helpers to require HTTPS, allowlist WeChat/Sogou hosts, and limit redirects before use.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
fetch_article.js:27- Finding
HTTPS Destinations Are Accessed Through the Plaintext HTTP Client in fetch_article.js
- Content
View full analysis
{ const urlObj = new URL(url); const options = { hostname: urlObj.hostname, port: urlObj.port || 80, path: urlObj.pathname + urlObj.search, method: 'GET', headers: { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8', 'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8', 'Referer': 'https://wx.sogou.com/', ...headers }, timeout: CONFIG.timeout }; const req = http.request(options, (res) => { ``` The module imports `http`, not `https`, and defaults to port 80 even though configured destinations use `https://`. ### Technical Analysis Node.js does not automatically upgrade `http.request()` to TLS merely because the original string supplied to `new URL()` used the HTTPS scheme. The request options omit `protocol`, use the plaintext HTTP client, and select port 80 when no explicit port is present. Consequently, requests intended for `https://wx.sogou.com` or `https://mp.weixin.qq.com` are made as plaintext HTTP connections to port 80. Depending on server behavior, this can cause requests to fail, be redirected, or return content without the integrity and confidentiality guarantees expected from HTTPS. An on-path attacker can observe search terms and modify HTTP responses. Because retrieved content is parsed and saved locally, altered responses can influence generated summaries or cause attacker-selected content to be archived. ### Attack Path 1. The script constructs an HTTPS Sogou or WeChat URL. 2. `httpGet( ...[truncated 833 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
fetch_v2.js:16- Finding
HTTPS Destinations Are Accessed Through the Plaintext HTTP Client in fetch_v2.js
- Content
View full analysis
{ const urlObj = new URL(url); const req = http.request({ hostname: urlObj.hostname, port: urlObj.port || 80, path: urlObj.pathname + urlObj.search, method: 'GET', headers: { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': 'text/html,*/*', 'Accept-Language': 'zh-CN,zh;q=0.9', 'Referer': 'https://wx.sogou.com/' }, timeout: 10000 }, res => { ``` ### Technical Analysis The second fetch implementation repeats the same transport error: it invokes `http.request()` and defaults to port 80 for URLs constructed with the HTTPS scheme. The URL protocol is parsed but never used to select a TLS-capable client. This violates the confidentiality and integrity expectations associated with the configured Sogou URLs and permits network-level response manipulation. ### Attack Path 1. `main()` constructs an `https://wx.sogou.com/...` URL. 2. `fetch()` removes the effective security properties of that URL by using `http.request()`. 3. The request is transmitted to port 80 without TLS. 4. An on-path attacker changes the search results or returned article page. 5. The altered response is parsed and may be written to an article or debug file. ### Impact Assessment An on-path attacker can monitor search activity and manipulate remotely sourced content. Modified HTML can control which links are processed and what text is stored, although the reviewed script does not execute JavaScript obtained from the response. ]]>- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
fetch_article.js:47- Finding
Unrestricted Redirect Following Permits SSRF and Transport Downgrade in fetch_article.js
- Content
View full analysis
{ // 处理重定向 if ([301, 302, 303, 307, 308].includes(res.statusCode) && res.headers.location) { resolve(httpGet(res.headers.location, headers)); return; } ``` ### Technical Analysis The request helper recursively follows any absolute URL supplied through the HTTP `Location` header. It does not validate: - The redirect protocol. - The destination hostname. - Resolved IP addresses. - Private, loopback, link-local, or reserved address ranges. - The number of redirects. - Whether HTTPS is downgraded to HTTP. A malicious or compromised upstream service can therefore redirect the script to an arbitrary network location. This includes services reachable only from the machine running the Skill, such as localhost administration interfaces, private network services, or cloud instance metadata endpoints. There is also no redirect-depth limit, allowing a redirect loop to consume resources until failure. Relative redirects are not resolved against the prior URL and would cause `new URL()` to throw, creating a separate reliability defect. The response is not sent back to a remote attacker directly, but portions may be logged, parsed, or saved as debug files. This creates blind SSRF capabilities and possible local disclosure through generated artifacts. ### Attack Path 1. The script requests a Sogou result or article URL. 2. The upstream response, or an on-path attacker exploiting the plaintext transport defect, returns a redirect with an attacker-selected absolute `Location`. 3. `httpGet()` follows the URL without validating its destination. 4. The request reaches a local, private-network, link-local, or otherwise unauthorized endpoint. 5. The response is parsed as article d ...[truncated 756 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
fetch_v2.js:32- Finding
Unrestricted Redirect Following Permits SSRF and Transport Downgrade in fetch_v2.js
- Content
View full analysis
{ if ([301,302,303].includes(res.statusCode) && res.headers.location) { resolve(fetch(res.headers.location)); return; } ``` ### Technical Analysis The compact fetch implementation recursively follows redirect destinations without validating the scheme, hostname, resolved address, or redirect count. An upstream server or network attacker can direct the process to endpoints that should not be reachable as part of public article retrieval. Because the helper also uses plaintext HTTP, an on-path attacker does not need to compromise Sogou to inject a redirect. The combination of the two defects makes SSRF exploitation substantially more practical. ### Attack Path 1. The script requests a public Sogou URL. 2. A malicious upstream response or network interceptor supplies a 301, 302, or 303 response. 3. The `Location` header points to an internal or local endpoint. 4. `fetch()` recursively requests that endpoint. 5. Status, timing, parsing behavior, and locally saved debug data may disclose information about the target. 6. Repeated redirects can additionally cause resource exhaustion. ### Impact Assessment The request inherits the host's network position and can probe services unavailable to an external attacker. Potential targets include localhost interfaces, private network applications, and link-local metadata endpoints. The practical disclosure scope depends on endpoint behavior and access to the generated local files. ]]>- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (15)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger conditions are broad and ambiguous, using generic phrases like '刘润', '公众号摘要', and '每日商业新闻' without clear user-intent confirmation. This can cause unintended activation, leading the agent to browse external sites and fetch content when the user did not explicitly request this behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill writes both raw article content and generated summaries to local files without stating that behavior to the user at runtime or obtaining consent. This creates a data governance and privacy risk, especially because the summary may incorporate user-specific context such as holdings, causing unexpected persistence of sensitive or copyrighted material.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill artifact is written as a Chinese-only summary template and provides no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation unless the locale limitation is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The entire skill file is written as a Chinese-only article summary and does not indicate that other languages are supported or that Chinese is an explicit user-selected option. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The HTTP request headers hard-code
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8, which imposes a specific language preference for all requests. This is a natural-language policy concern because the skill does not offer the user any choice or document why Chinese locale enforcement is required.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file presents all user-facing content exclusively in Chinese, and there is no indication that the user can choose another language or has opted into this locale. Under the policy check for language or locale constraints, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file contains user-facing natural language exclusively in Chinese, including the title, headings, and summary content. Under the language/locale policy rule, forcing a specific language without user opt-in can be a policy violation when no choice or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This markdown file presents the entire skill output in Chinese and does not indicate that language is selectable or user-driven. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This markdown file is entirely in Chinese and presents its content as the default output format, with no indication that users can opt into another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file contains user-facing natural language exclusively in Chinese, including the title, headings, and content, with no indication that the skill is region-specific or that users may opt into another language. Under the language/locale policy check, forcing a specific language without user opt-in can be a policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The entire document is presented only in Chinese, including headings, warnings, and content, with no indication that language selection is optional. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file presents all user-facing content in a single forced language. Under the stated policy, language or locale constraints should either offer user opt-in/choice or be clearly documented as region-specific and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The entire skill file is presented only in Chinese, including the title, summary, and metadata, with no indication that users may choose another language or that the content is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without opt-in can constitute a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code formats execution time using
toLocaleString('zh-CN'), which hard-codes a specific locale for user-facing output. The file does not provide any user opt-in or configurability for locale selection.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The HTTP request hard-codes the Accept-Language header to 'zh-CN,zh;q=0.9', which imposes a specific locale preference. Under the policy, language or locale constraints should not be forced unless the user is given a choice or the regional limitation is clearly justified.
- Content
Static analysis
No suspicious patterns detected.