T09 · Insecure Skill Coding Practices
Error
- Location
index.js:12- Finding
Hardcoded SkillPay API Credential Exposed in Source and Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
Crypto Short Signal Generator
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent paid crypto-signal purpose, but its payment and API implementation exposes a hardcoded financial API key and trusts caller-supplied billing identity.
Review before installing. The publisher should remove and rotate the embedded SkillPay key, require injected secrets, bind billing to authenticated platform identity, validate requests before any charge, pass the advertised price explicitly, add idempotency/duplicate-charge protections, disclose what user data is sent to SkillPay, and pin reviewed dependencies.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
index.js:80- Finding
Caller-Controlled User Identifier Is Trusted for Billing and Paid API Access
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:25- Finding
Broken Billing Workflow Uses a Zero Charge and Bills Before Input Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file hardcodes a live-looking API key fallback and exposes billing and core analysis logic despite comments claiming these are private and not public. If this code is distributed with the skill, attackers can recover the secret, abuse the billing API, and replicate or tamper with the supposedly protected backend behavior.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The manifest states that the SkillPay API key should be supplied via environment variables, yet a live-looking secret is embedded directly in the configuration. Hardcoded secrets are easily leaked through source distribution, logs, or package reuse, allowing unauthorized parties to use the payment integration, impersonate the skill, or incur fraudulent charges.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
A hardcoded payment API key is present in the skill configuration, which exposes a credential tied to financial operations. Because this is a crypto/payment-oriented skill, misuse of the leaked key could directly affect billing flows, generate fraudulent payment requests, or enable unauthorized API consumption, making the context more dangerous than an ordinary non-financial integration.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This README presents the skill name, usage instructions, pricing, outputs, and warnings entirely in Chinese. That effectively forces a specific language for all users without offering a language/locale choice or documenting that the skill is intended only for a Chinese-language audience.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code sends the user's identifier and skill identifier to an external billing endpoint via HTTP, which is a network transmission of user/system data. Although comments describe billing internally, there is no visible confirmation prompt, log, or user-facing disclosure warning that this transmission occurs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest presents the skill name, description, category, tags, examples, and disclaimer entirely in Chinese, with no indication that users can choose another language or locale. This is a natural-language policy concern because the skill appears to enforce a single language experience without explicit user opt-in or documented regional limitation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The code sends user identifiers and requested token symbols to an external paid API, and separately sends billing data to a third-party billing service. In this context, the risk is elevated because a hardcoded fallback API key is present, making unauthorized use of those external endpoints more feasible if the source is exposed, and because data is transmitted off-platform without any visible minimization or consent controls.
- Content
js const SKILL_ID = process.env.SKILL_ID || 'crypto-short-signal'; // 付费层 API 地址 (可以部署在 SkillPay Cloud 或你的服务器) const PAID_API_URL = process.env.PAID_API_URL || 'https://api.skillpay.me/skills/crypto-short-signal/analyze'; const headers = { 'X-API-Key': API_KEY,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill charges the user before validating input and without any explicit confirmation or visible pre-charge warning in this code path. In an agent setting, this can lead to unintended charges, especially when malformed or empty input is submitted, and can be abused through repeated invocations that debit balances without delivering useful service.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example output sets
risk_levelto the Chinese value高inside an otherwise English-language skill description and response schema. This suggests the skill may force a specific language or locale in outputs without user opt-in or documented language selection.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
Natural-language strings and comments indicate the skill is oriented to Chinese only, and all user-facing messages returned by the API are in Chinese. There is no indication that the user can choose language or that the locale restriction is explicitly documented as an intentional regional constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
User-facing messages and descriptions in this file are written in Chinese, and there is no indication that users can choose another language or that the skill is intentionally limited to Chinese-speaking users. That can violate language/locale policy when a specific language is imposed without opt-in or justification.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The module header at L4-L6 says the public layer 'only contains billing interfaces and basic validation' and that core logic is elsewhere. However, the code also returns product metadata and strong marketing claims such as '提前 7 天知道哪些币要暴跌 30%+' in normal execution, which goes beyond the stated limited role of just billing/validation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The package description is written entirely in Chinese, which indicates a fixed language choice in the skill's user-facing metadata. There is no accompanying opt-in, alternative locale, or justification that this skill is intended only for a Chinese-speaking or region-specific audience.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
The dependency uses a caret range (^1.13.6), which allows future minor/patch updates to be installed without review. In a security-sensitive skill, this weakens supply-chain integrity and can unexpectedly introduce vulnerable or malicious dependency versions during install or deployment.
- Content
json "author": "Denny Huang", "license": "MIT", "dependencies": { "axios": "^1.13.6" }, "engines": { "node": ">=18.0.0"
Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
The manifest declares axios without an exact pinned version, while known advisories exist for some axios releases. Because the actual installed version is not fixed or evidenced by a lockfile here, consumers may resolve to an affected release, creating risk such as SSRF, credential leakage, or request/response manipulation depending on how the library is used elsewhere in the skill.
- Content