企业-真实业务穿透工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:25 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent company-analysis purpose, but it automatically sends company queries to a plaintext HTTP service and the helper code prints full request and response data.

Review this skill before installing. It is not showing malicious intent, persistence, or credential theft, but it should only be used if you are comfortable sending company names and enterprise IDs to the listed external service over plaintext HTTP and having API responses potentially appear in logs. Prefer an updated version that uses HTTPS, asks before external lookups, and disables verbose logging by default.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: ent_main_business.py:4

Finding

Enterprise API Data Transmitted Over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: ent_main_business.py:4-7, 40-46
Vulnerability Type: Cleartext transmission of enterprise identifiers and API responses
Risk Level: Medium

Vulnerable Code

python

config = {
    "host": "http://agent-data.ihdwork.com",
    "base_path": "/handi-ai",
    "endpoint": "/ent-analysis/main-business"
}

python

response = requests.post(
    url=url,
    headers=headers,
    data=json.dumps(payload),
    timeout=10
)

The same insecure endpoint is prescribed for both API operations in SKILL.md:45-53 and SKILL.md:90-99:

python

config = {
    "host": "http://agent-data.ihdwork.com",
    "base_path": "/handi-ai",
    "endpoint": "/common-api/search-ent"
}

response = requests.get(url, params=params, timeout=10)

python

config_main = {
    "host": "http://agent-data.ihdwork.com",
    "base_path": "/handi-ai",
    "endpoint": "/ent-analysis/main-business"
}

response = requests.post(
    url,
    headers=headers,
    data=json.dumps(payload),
    timeout=10
)

Technical Analysis

Both the documented workflow and executable implementation use an http:// endpoint. Consequently, the enterprise name or identifier in each request and all business information in the response are transmitted without transport encryption or authenticated server identity.

An attacker able to observe or alter the relevant network path could read query data, modify returned business records, inject fabricated response fields, or impersonate the API server. Because the returned data is intended to support enterprise-analysis reports, tampered responses may be treated as authoritative input and produce inaccurate conclusions.

Attack Path

1. A user invokes the Skill to search for or analyze an enterprise.
2. The Skill sends the enterprise name or ent_id to agent-data.ihdwork.com over plaintext HTTP.
3. An ...[truncated 1020 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the endpoint with an https:// URL and ensure the service presents a certificate trusted for agent-data.ihdwork.com.
• Retain TLS certificate verification; do not use verify=False or suppress certificate errors.
• Reject configuration values using plaintext HTTP rather than silently accepting insecure endpoints.
• Apply the HTTPS requirement consistently to both the enterprise-search and main-business endpoints in SKILL.md.
• Consider response authentication or signing if report integrity is especially sensitive.
• Validate the expected response schema and status code before treating a response as successful.
• Restrict outbound network access so the Skill can contact only the approved HTTPS API host.

T09 · Insecure Skill Coding Practices

Warning

• Location: ent_main_business.py:34

Finding

Complete Enterprise Request and Response Data Exposed Through Console Logging

Content

View full analysis

Vulnerability Details

File Location: ent_main_business.py:34-48, 52-54
Vulnerability Type: Excessive logging of request identifiers and complete API responses
Risk Level: Medium

Vulnerable Code

python

try:
    print(f"=== 查询企业主营业务 (企业ID: {ent_id}) ===")
    print(f"URL: {url}")
    print(f"请求头: {headers}")
    print(f"请求体: {json.dumps(payload, ensure_ascii=False)}")
    
    # 发送POST请求
    response = requests.post(
        url=url,
        headers=headers,
        data=json.dumps(payload),
        timeout=10
    )
    
    print(f"\n状态码: {response.status_code}")
    print(f"响应文本: {response.text}")
    
    # 尝试解析JSON
    try:
        result = response.json()
        print("\n解析后的JSON响应:")
        print(json.dumps(result, ensure_ascii=False, indent=2))

Technical Analysis

The function unconditionally writes the enterprise ID, request body, complete raw response, and parsed JSON response to standard output. This occurs during normal operation rather than only when explicitly enabled for debugging.

Standard output is commonly captured by Agent runtimes, CI systems, process supervisors, notebook histories, terminal logs, or centralized observability platforms. Data that would otherwise exist only during the API transaction can therefore be retained, replicated, and exposed to users or services with access to those logs.

Printing both response.text and the parsed JSON also duplicates the returned information, increasing its exposure. The implementation does not redact identifiers, limit response fields, control retention, or distinguish sensitive data from safe operational metadata.

Attack Path

1. A user or automated process invokes get_ent_main_business() with an enterprise identifier.
2. The function prints the identifier and complete serialized request body.
3. The external API response is printed in full as both raw text and formatted JSON.

...[truncated 909 chars]

Remediation

View remediation

Remediation Suggestions

• Remove unconditional logging of request bodies, enterprise IDs, raw responses, and parsed response objects.
• Use a standard logging framework with explicit severity levels instead of direct print() calls.
• Keep verbose logging disabled by default and require an explicit debug setting.
• Redact or hash enterprise identifiers before logging when correlation is necessary.
• Log only minimal operational metadata, such as request duration, sanitized endpoint name, status class, and a non-sensitive correlation ID.
• Define access controls and short retention periods for application logs.
• Prevent logs from being exported to unapproved third-party systems.
• Add automated tests or static-analysis rules that detect logging of payloads and complete HTTP responses.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

整份技能说明及示例均以中文固定表达，且未说明这是仅面向中文场景的受限技能，也未提供根据用户偏好切换语言的选项。按照语言/locale 政策，这种默认强制单一语言而无用户选择可能构成自然语言策略违规。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to match ordinary conversational requests about what a company does, which can cause the skill to activate unexpectedly. This creates a security and privacy risk because the skill may initiate downstream enterprise lookups and external data retrieval without sufficiently explicit user intent for tool use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to send company identifiers and user-provided company names to external HTTP endpoints, but it does not require disclosure or consent before making those network requests. Unexpected external transmission of user-supplied query data can violate user expectations, privacy policies, or platform data-handling requirements, and the risk is heightened because the documented host uses plain HTTP rather than HTTPS.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This Python file contains user-facing strings, comments, and docstrings entirely in Chinese, including runtime prints such as query status and errors. Under the policy rule for natural-language violations, forcing a specific language without opt-in or explanation is a locale-policy issue when no alternative language choice is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.