Datayes 宏观指标

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:28 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for querying Datayes data, but its API client can leak the user's Datayes bearer token across HTTP redirects.

Review this before installing. The skill appears intended for legitimate Datayes macro-data queries, but use a revocable, least-privileged Datayes token and avoid running it until redirect handling is fixed to block cross-origin redirects or strip Authorization on origin changes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/datayes_macro.py:54

Finding

Bearer Token Disclosure Through Unvalidated Cross-Origin Redirects

Content

View full analysis

Vulnerability Details

File Location: scripts/datayes_macro.py, lines 54–66
Vulnerability Type: Authorization credential exposure through unsafe HTTP redirect handling
Risk Level: High

python

req = Request(
    url,
    headers={
        "Authorization": f"Bearer {get_token()}",
        "Accept": "application/json",
        "User-Agent": "datayes-macro-skill/1.0",
    },
)

try:
    with urlopen(req, timeout=DEFAULT_TIMEOUT) as resp:
        return json.load(resp)

Technical Analysis

The request includes the sensitive DATAYES_TOKEN value in an Authorization: Bearer header and is issued using urllib.request.urlopen(). Its default opener automatically processes HTTP redirects.

The implementation validates dynamically resolved API URLs before the initial request, but it does not validate each redirect destination. Consequently, the trusted-host restriction can be bypassed after the first request. A redirect-generated request may retain the Authorization header, causing the token to be transmitted to a destination that was never checked against ALLOWED_HTTP_HOSTS.

The fixed API metadata endpoint is also passed directly to request_json() and therefore has the same redirect-handling exposure. The existing tests only verify initial URL validation and do not cover cross-origin redirects.

Sending the bearer token to authenticated Datayes endpoints is necessary for the Skill's declared functionality. Allowing the credential to follow redirects to arbitrary origins is not necessary and exceeds the intended trusted-domain boundary.

Attack Path

1. An allowed Datayes endpoint is compromised, maliciously configured, or otherwise made to return an HTTP redirect.
2. The redirect points to an attacker-controlled HTTPS origin.
3. urlopen() automatically follows the redirect without invoking validate_http_url() for the new destination.
4. The redirected request retains the bear ...[truncated 677 chars]

Remediation

View remediation

Remediation Suggestions

1. Install a custom HTTPRedirectHandler that rejects redirects for authenticated requests, or manually process redirect responses.
2. If redirects are operationally required, resolve each Location value against the current URL and pass every resulting destination through validate_http_url() before following it.
3. Strip Authorization on every origin change. Compare the normalized scheme, hostname, and effective port rather than only the hostname.
4. Prefer allowing authenticated redirects only when both the original and destination origins are identical. If cross-host Datayes redirects are required, define an explicit, narrowly scoped policy for each permitted transition.
5. Apply the redirect policy to both API metadata requests and business-data requests.
6. Add regression tests covering:
   • rejection of redirects to an untrusted HTTPS host;
   • rejection of redirects from HTTPS to HTTP;
   • removal of authorization credentials on origin changes;
   • permitted same-origin redirects, if they are required;
   • redirect chains in which a later hop leaves the trusted origin.
7. Ensure error messages and debug output never include the bearer token, and document immediate token revocation as the incident-response action if disclosure is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/datayes_macro.py (reported line 244)May include surrounding context.

python

score += 40

    for token in tokens:
        if token in name:
            score += min(30, 8 + len(token) * 2)
        if token in statistic:
            score += 6

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill requires both an environment secret (DATAYES_TOKEN) and network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a governance gap: an agent runtime may permit broader-than-necessary execution or make it harder to enforce least privilege, increasing the chance that secrets or network capabilities are exposed to unintended code paths.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.