T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:139- Finding
Hard-Coded Volcengine API Credential Exposed in Skill Documentation
- Content
View full analysis
- Remediation
View remediation
Security audit
Wechat Article Auto Gen
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its stated WeChat article-generation purpose, but it publishes a credential-like API key and gives unsafe, unscoped scraping code that users should review before installing.
Review before installing or using this skill. Rotate and remove the exposed API key, replace it with a protected environment variable or secret store, restrict scraping to approved public WeChat article hosts, add timeouts and response limits, and get user confirmation before sending third-party article content or prompts to external AI services. Treat the built-in compliance check as a limited keyword screen, not legal or platform-policy validation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:343- Finding
Unrestricted User-Controlled URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
if brand_elements: prompt += " MUX 品牌元素，紫色橙色配色"
text return prompt.strip()text #### 批量生成
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill instructs users to scrape third-party articles and send prompts or content to external image/LLM services, but it provides no warning about network transmission, copyright, privacy, or external handling of data. This increases the chance that proprietary source articles, business data, or personal information are sent to third parties without informed consent.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The workflow labels a step as a compliance check and then retries recursively until it passes, but the described check is only a shallow phrase scan. This can create false assurance that rewritten marketing content is compliant while also risking unbounded recursion or repeated retries when content never satisfies the simplistic rules.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The function docstring claims to check content compliance, but it only searches for a tiny hardcoded list of phrases. In this skill's context, that mismatch can mislead operators into trusting unsafe or noncompliant output, especially for regulated advertising claims.
- Content
Static analysis
No suspicious patterns detected.