T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wework_combined_service.py:485- Finding
Archived Enterprise Conversations Exposed Through Unauthenticated API
- Content
View full analysis
- Remediation
View remediation
Security audit
企业微信存档服务
Security checks for vulnerabilities and agentic risk
Overview
This skill is meant to archive Enterprise WeChat conversations, but it ships hard-coded WeCom secrets and can expose archived messages through unauthenticated public-facing APIs.
Do not install this as-is on a real Enterprise WeChat tenant. Treat all embedded WeCom tokens/secrets as compromised, remove them, require the service to load protected user-supplied secrets, add authentication and authorization to every archive/query/debug endpoint, avoid exposing admin APIs through the public tunnel, disable debug endpoints, stop logging message contents, and add encryption, retention, and access-control enforcement before production use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wework_combined_service.py:43- Finding
Hard-Coded WeCom Credentials Override the Documented Configuration
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wework_combined_service.py:217- Finding
Decrypted Conversation Content Is Logged and Duplicated in Plaintext Storage
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
config/wework_config_template.json:22- Finding
Advertised IP Allowlisting and Rate Limiting Are Not Enforced
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (55)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented purpose says the skill provides callback and archive services, but the analyzed behavior reportedly includes additional active capabilities such as using built-in WeWork credentials to obtain access tokens, proactively sending messages, exposing debug signature endpoints, and serving message/statistics APIs. Undisclosed functionality is dangerous because operators may deploy the skill with broader trust than intended, enabling data exposure, unauthorized messaging, or abuse of embedded credentials.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
3. 访问令牌管理
3.1 获取Access Token
text GET https://qyapi.weixin.qq.com/cgi-bin/gettoken 参数: corpid, corpsecret
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README promotes deployment of a service that archives enterprise WeChat conversations and stores them in SQLite, but it does not prominently warn that this data is highly sensitive, may contain personal or confidential business content, and requires strict access control, retention, and legal review. In the context of an agent skill meant for quick deployment, this omission can lead operators to expose or retain sensitive chat data without adequate safeguards.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documented query and management endpoints include direct access to messages, per-user and per-room archives, statistics, configuration, and backups, yet the README does not clearly warn that these endpoints can disclose archived messages and sensitive configuration if left unauthenticated or weakly protected. Because the skill is designed to expose the service via Cloudflare/public callback infrastructure, weak operator assumptions around these endpoints materially increase the risk of privacy breaches and secret leakage.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documentation declares a service that installs software, exposes network endpoints, reads/writes configuration and databases, and runs shell scripts, but it does not define any explicit tool scope or permissions boundary. In an agent/skill ecosystem this increases the chance of overbroad execution and unintended access because consumers cannot tell in advance what capabilities the skill requires or should be restricted to.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly supports storing and querying archived enterprise chat content, but the documentation does not prominently warn about privacy, consent, retention, access control, or regulatory implications. Because archived workplace communications are highly sensitive, omission of these safeguards can lead to unauthorized surveillance, over-collection, insider misuse, and compliance violations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The configuration steps instruct users to place multiple high-value secrets into a local JSON file without warning about secure storage, file permissions, rotation, or exclusion from version control. Exposure of callback tokens, AES keys, corp secrets, or archive secrets could allow message forgery, callback spoofing, unauthorized API use, or access to archived communications.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
3. 创建隧道
bash # 创建隧道 cloudflared tunnel create wework-tunnel # 查看隧道ID cloudflared tunnel list
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
3. 创建隧道
bash # 创建隧道 cloudflared tunnel create wework-tunnel # 查看隧道ID cloudflared tunnel list
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This SQL file contains natural-language comments and output strings entirely in Chinese, including operator-facing status messages. Because the file does not provide an opt-in language choice or document that it is intentionally limited to a Chinese-speaking environment, it violates the language/locale policy criterion.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The inserted log messages and SELECT output strings shown to operators are fixed in Chinese, which forces a specific language experience. Without a documented regional justification or a configurable language option, this is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The template explicitly enables message storage, attachment storage, user tracking, and room tracking by default in a service whose stated purpose includes enterprise chat archiving. Even if this is intended functionality, collecting and retaining communications and identifiers without documented consent, notice, access controls, or jurisdiction-specific privacy safeguards creates real privacy and compliance risk if deployed as-is.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest description says the skill is an enterprise WeWork integration service focused on normal callbacks and conversation archive functionality. This file claims additional operational features such as one-click deployment, Cloudflare Tunnel public exposure, and database management/maintenance tooling, which go beyond that functional description rather than serving as unavoidable implementation details of callback/archive handling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The deployment instructions encourage exposing the service to the public internet and running convenience scripts without any warning about authentication, network hardening, rate limiting, secret handling, or attack surface. In the context of an enterprise callback and archive service that processes sensitive WeCom data, omission of these warnings can lead operators to deploy an internet-reachable service insecurely.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb sudo dpkg -i cloudflared-linux-amd64.deb # CentOS/RHEL sudo yum install https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-x86_64.rpm
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb sudo dpkg -i cloudflared-linux-amd64.deb # CentOS/RHEL sudo yum install https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-x86_64.rpm
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb sudo dpkg -i cloudflared-linux-amd64.deb # CentOS/RHEL sudo yum install https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-x86_64.rpm
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb sudo dpkg -i cloudflared-linux-amd64.deb # CentOS/RHEL sudo yum install https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-x86_64.rpm
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb sudo dpkg -i cloudflared-linux-amd64.deb # CentOS/RHEL sudo yum install https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-x86_64.rpm
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb sudo dpkg -i cloudflared-linux-amd64.deb # CentOS/RHEL sudo yum install https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-x86_64.rpm
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb sudo dpkg -i cloudflared-linux-amd64.deb # CentOS/RHEL sudo yum install https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-x86_64.rpm
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb sudo dpkg -i cloudflared-linux-amd64.deb # CentOS/RHEL sudo yum install https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-x86_64.rpm
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb sudo dpkg -i cloudflared-linux-amd64.deb # CentOS/RHEL sudo yum install https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-x86_64.rpm
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md sudo dpkg -i cloudflared-linux-amd64.deb # CentOS/RHEL sudo yum install https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-x86_64.rpm # 通用二进制安装 curl -L --output cloudflared https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md sudo dpkg -i cloudflared-linux-amd64.deb # CentOS/RHEL sudo yum install https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-x86_64.rpm # 通用二进制安装 curl -L --output cloudflared https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64
Static analysis
No suspicious patterns detected.