Security audit

cybersecured-agent-risk-advisory

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent risk-assessment purpose, but it grants and transmits broad sensitive local-security information and documents unsafe credential handling.

Review carefully before installing. Use only trusted HTTPS endpoints, avoid --no-verify-ssl, do not send real API keys over test HTTP endpoints, inspect and redact the assessment directory before submission, and avoid running the scan from cloud instances where metadata services or broad local agent configuration may be accessible.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/questionnaire-guide.md:98
Finding: Cloud Instance Metadata Service Probing
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/data-storage.md:9
Finding: Plaintext API Key Stored in a Predictable Global Configuration File
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:49
Finding: Authentication Permitted over Cleartext HTTP or Unverified TLS
Content: View full analysis
/trope \ auth login --api-key cds-aiai-xxxxxx cybersecured-agent --api-base-url https:///trope \ --no-verify-ssl auth login --api-key cds-aiai-xxxxxx ``` The same insecure patterns are repeated in the authentication workflow at `SKILL.md:135-149`. ### Technical Analysis The first command permits sending an API key over unencrypted HTTP. Any party able to observe or modify traffic between the Agent and the configured endpoint can capture the credential and alter server responses. The second command uses HTTPS but disables certificate verification. Encryption without endpoint authentication does not prevent an active man-in-the-middle attacker from presenting an arbitrary certificate, terminating TLS, reading the API key, and impersonating the backend. The Skill states that a configured base URL is reused by later commands, including Agent binding and assessment submission. Therefore, the insecure endpoint can affect both authentication and the subsequent transfer of sensitive environment inventory. ### Attack Path 1. The user configures a development or test endpoint using HTTP or `--no-verify-ssl`. 2. The Agent sends the API key to that endpoint. 3. An attacker on the local network, proxy path, DNS path, or compromised gateway intercepts the connection. 4. The attacker captures the API key and impersonates the backend. 5. Subsequent binding and assessment requests continue using the same endpoint. 6. The attacker receives sensitive assessment information or returns manipulated application and status data. ### Impact Assessment An attacker can obtain the service API key, authenticated session material, Agent identifiers, and submitted assessment contents. The attacker may also manip ...[truncated 207 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/risk-factors-format.md:12
Finding: Excessive Runtime, Configuration, Plugin, and Asset Reconnaissance
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:99
Finding: Automatic Execution of an Unpinned Third-Party Package
Content: View full analysis
=2.1.0", "install": "uv tool install cybersecured-agent-cli" } ``` ### Technical Analysis The Skill instructs the Agent to upgrade the package every time the service starts and does not pin an exact version or integrity hash. Consequently, the executable behavior reviewed during the Skill audit can change whenever a new package version is published. The dependency is installed from PyPI and then receives access to the user’s API key, framework configuration, installed Skills, MCP plugin information, local assessment files, and network connectivity. A compromised publisher account, malicious release, or compromised transitive dependency could therefore execute code with the privileges of the Agent process. The audit found no evidence that the current package is malicious. The vulnerability is the unsafe supply-chain policy and automatic trust of future releases. ### Attack Path 1. An attacker compromises the package publisher, release pipeline, or a transitive dependency. 2. The attacker publishes a malicious version satisfying `>=2.1.0`. 3. The Skill starts and executes `uv tool upgrade cybersecured-agent-cli`. 4. The malicious package is installed without an exact-version or hash check. 5. The user or Agent invokes the CLI. 6. The package executes with the Agent user’s local privileges. 7. It can access the persisted service credential, scan artifacts, framework configuration, and reachable files or network services. ### Impact Assessment The dependency executes with the sa ...[truncated 398 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (29)

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/data-storage.md (reported line 25)May include surrounding context.
md
"codex:v0:32-char-hash": { "agent_id": "uuid", "framework": "codex", "config_path": "/Users/example/.codex/config.toml", "machine_id": "os:masked", "nickname": "Codex 工作台助手", "legacy_fingerprints": ["codex:sha256:32-char-hash"]

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/risk-factors-format.md (reported line 83)May include surrounding context.
md
"codex:v0:32-char-hash": { "agent_id": "uuid", "framework": "codex", "config_path": "/Users/example/.codex/config.toml", "machine_id": "os:masked", "nickname": "Codex 工作台助手", "legacy_fingerprints": ["codex:sha256:32-char-hash"]

Cloud Metadata Access

High

Category: Server-Side Request Forgery
Confidence: 99% confidence
Finding: The guide also instructs access to Alibaba Cloud's metadata endpoint 100.100.100.200, which carries the same SSRF and sensitive-metadata exposure risk. Even read-only probing can disclose cloud identity and potentially privileged instance details that should remain inaccessible to routine skill flows.
Content: Scanner excerpt · references/questionnaire-guide.md (reported line 117)May include surrounding context.
md
**填写条件：** 仅当 2.1.3 部署方式为 `云服务器` 时填写，否则 value 设为 `null`，reasoning 说明"部署方式非云服务器，无需填写"。 **判断方法：** - 尝试访问云实例元数据服务（如 `http://100.100.100.200/latest/meta-data/` 为阿里云，`http://169.254.169.254/latest/meta-data/` 为 AWS）。 - 检查环境变量中是否包含云厂商标识（如 `ALIBABA_CLOUD_ACCESS_KEY_ID`、`AWS_REGION`）。 - 检查 `/etc/cloud/cloud.cfg` 等配置文件。

Cloud Metadata Access

High

Category: Server-Side Request Forgery
Confidence: 99% confidence
Finding: The guide also instructs access to Alibaba Cloud's metadata endpoint 100.100.100.200, which carries the same SSRF and sensitive-metadata exposure risk. Even read-only probing can disclose cloud identity and potentially privileged instance details that should remain inaccessible to routine skill flows.
Content: Scanner excerpt · references/questionnaire-guide.md (reported line 117)May include surrounding context.
md
**填写条件：** 仅当 2.1.3 部署方式为 `云服务器` 时填写，否则 value 设为 `null`，reasoning 说明"部署方式非云服务器，无需填写"。 **判断方法：** - 尝试访问云实例元数据服务（如 `http://100.100.100.200/latest/meta-data/` 为阿里云，`http://169.254.169.254/latest/meta-data/` 为 AWS）。 - 检查环境变量中是否包含云厂商标识（如 `ALIBABA_CLOUD_ACCESS_KEY_ID`、`AWS_REGION`）。 - 检查 `/etc/cloud/cloud.cfg` 等配置文件。

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The sample explicitly demonstrates exposing cloud metadata access results and credential-related environment information in output text. This is dangerous because it turns sensitive infrastructure fingerprints into user-visible content and may aid follow-on attacks against the hosting environment.
Content: No source excerpt is available for this finding.

Cloud Metadata Access

High

Category: Server-Side Request Forgery
Confidence: 99% confidence
Finding: The sample reasoning not only references a metadata endpoint but presents successful access as a model answer, reinforcing unsafe behavior. This makes the skill more dangerous because it encourages actual runtime retrieval and disclosure of sensitive metadata during normal operation.
Content: Scanner excerpt · references/questionnaire-guide.md (reported line 548)May include surrounding context.
json
{ "value": "云服务器", "reasoning": "我检查了当前运行环境，发现可以通过 HTTP 访问 100.100.100.200/latest/meta-data/ 获取实例信息，返回的内容包含'aliyun'字样，且环境变量中存在 ALIBABA_CLOUD_ACCESS_KEY_ID。这些特征明确表明当前运行在阿里云 ECS 实例上，因此判断部署方式为云服务器。" }

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The asset collection section asks the agent to identify access credentials, sensitive data types, and infrastructure it can reach. Even though it says not to output credential contents, prompting credential discovery and infrastructure enumeration still produces a high-value target map that could facilitate privilege escalation, secret hunting, or later compromise if mishandled.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases are broad enough to match common language about buying insurance, checking status, or reporting incidents, which can cause the skill to activate in situations the user did not intend. Because this skill can lead to authentication, local scanning, data collection, and backend submission, overbroad invocation materially raises the chance of unwanted sensitive actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs framework auto-detection and collection of local environment signals such as environment variables, config directories, and process-chain artifacts that go beyond the user-visible insurance/application workflow. In this context, that expands local data access and fingerprinting surface without clear minimization or explicit consent boundaries, creating unnecessary privacy and reconnaissance risk if the collected metadata is transmitted or retained.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to run local package installation and upgrade commands (uv tool install / upgrade) even though the skill's stated purpose is advisory and service handling. Allowing a skill to modify the local system and pull code from external package sources increases supply-chain and integrity risk, especially when performed automatically or without a tight approval step.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs submission of locally collected assessment and incident data to a backend without a clear, prominent warning that sensitive security details, environment information, and possible breach data will be transmitted off-device. In a security/insurance context, these submissions can include highly sensitive operational details, making lack of explicit disclosure and consent particularly dangerous.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions state that returned plan codes must be converted to Chinese names and explicitly forbid directly showing the code, but they do not provide any user language choice or note that the skill is intentionally Chinese-only. This is a natural-language locale policy issue because the skill forces a specific language presentation without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The natural-language fields in the manifest are entirely in Chinese, including the description, requirements, and trigger phrases. Because the file does not indicate that the skill is region-specific or provide any user opt-in for language/locale, it appears to impose a specific language unconditionally, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill content is written as a mandatory Chinese-language questionnaire guide and instructs the agent to produce natural-language reasoning in that format, but it does not provide an opt-in or alternative language path. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Mandating 'complete reasoning evidence' for every answer pressures the agent to reveal internal evidence sources such as env vars, filesystem paths, logs, and security settings. In this skill context, that can cause the questionnaire output itself to become a sensitive data exfiltration artifact.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The requirement to include complete reasoning evidence derived from environment inspection and prior interactions can directly expose sensitive operational context in the generated questionnaire. Such disclosures may include security posture, infrastructure details, and traces of protected user or organizational information.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide encourages the agent to summarize historical user requests as supporting evidence for answers. In a risk-service skill, that can leak confidential workload patterns, proprietary projects, or sensitive user-submitted content that is unrelated to the application itself.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The guide explicitly instructs the agent to probe local/cloud environment details, including cloud metadata endpoints, environment variables, and config files, in order to answer a questionnaire. That exceeds the minimum information needed for a service application workflow and can induce unauthorized infrastructure discovery or SSRF-style access to sensitive instance metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions tell the agent to inspect local environment, metadata services, APIs, and configuration sources without any user notice, consent gate, or scope restriction. This creates a risky pattern where sensitive system probing is normalized as part of ordinary questionnaire completion.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The example reasoning normalizes disclosure of concrete environment artifacts such as metadata responses, env-var names, and filesystem paths. Providing such examples increases the likelihood that downstream outputs will reveal exploitable infrastructure details and credential-handling patterns.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The title and description define the questionnaire in Chinese and instruct the AI agent to fill it automatically in that locale, while the schema later requires a natural-language reasoning string. There is no indication that other languages are allowed or that the Chinese-only constraint is optional or justified as region-specific, which creates a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The reasoning field requires a complete natural-language description, and in context the schema's surrounding instructions are Chinese-only. Because the schema does not provide a language choice or explain that the locale is intentionally restricted for compliance or regional use, it can be interpreted as forcing one language for generated content.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions explicitly direct enumeration of installed skills and plugins across Codex, Claude Code, and MCP-related configurations. That creates a cross-tool inventory of the user's agent ecosystem, which can reveal capabilities, integrations, and potential attack paths that are not necessary for a narrow risk-advisory function.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 94% confidence
Finding: The skill directs scanning of common skill directories including Codex and Claude Code locations to enumerate installed skills. Enumerating these directories reveals installed capabilities and potentially security-relevant tooling, which increases reconnaissance value for an attacker and exceeds least-privilege collection.
Content: Scanner excerpt · references/risk-factors-format.md (reported line 23)May include surrounding context.
md
| 文件名 | 说明 | |--------|------| | `cli-scan-system.json` | 操作系统、硬件、Python 版本等系统信息 | | `cli-scan-skills.json` | 已安装的 skills 列表（扫描常见技能目录，包含 Codex `~/.codex/skills` 与 Claude Code `~/.claude/skills`） | | `cli-scan-plugins.json` | 已安装的 plugins 列表（扫描 MCP 配置） | **无需手动收集这些文件。**

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 94% confidence
Finding: The skill directs scanning of common skill directories including Codex and Claude Code locations to enumerate installed skills. Enumerating these directories reveals installed capabilities and potentially security-relevant tooling, which increases reconnaissance value for an attacker and exceeds least-privilege collection.
Content: Scanner excerpt · references/risk-factors-format.md (reported line 23)May include surrounding context.
md
| 文件名 | 说明 | |--------|------| | `cli-scan-system.json` | 操作系统、硬件、Python 版本等系统信息 | | `cli-scan-skills.json` | 已安装的 skills 列表(扫描常见技能目录,包含 Codex `~/.codex/skills` 与 Claude Code `~/.claude/skills`) | | `cli-scan-plugins.json` | 已安装的 plugins 列表(扫描 MCP 配置) | **无需手动收集这些文件。**

Static analysis

Detected: suspicious.exposed_resource_identifier

Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.

Critical

Code: suspicious.exposed_resource_identifier
Location: references/questionnaire-guide.md:117