T09 · Insecure Skill Coding Practices
Error
- Location
scripts/agentic.py:96- Finding
Renewed Bearer Token Is Exposed in Standard Output
- Content
View full analysis
- Remediation
View remediation
Security audit
DeepLink Agentic
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed remote real-estate research client, but it handles account tokens and public sharing in ways that can expose sensitive data.
Install only if you trust the publisher and the agentic.dichanai.com service with your real-estate prompts, selected uploads, task history, and account token. Avoid using share or delete unless you intend that result, treat any printed NEW_TOKEN value as a secret, and prefer a pinned dependency or controlled environment before use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:13- Finding
Third-Party Dependency Is Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The documented purpose presents the skill as a real-estate research tool, but the actual described capabilities include destructive and privacy-sensitive operations such as delete, share/publicize tasks, token inspection/renewal, profile access, update checks, and generic workspace/file management. This mismatch is dangerous because users or orchestrators may grant trust appropriate for 'research' while the skill can also expose private task contents publicly, remove data, manipulate scheduled jobs, and handle authentication material.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The renewed bearer token is printed directly to stdout, which can be captured by shell history, CI logs, terminal recording, monitoring agents, or other local users. Anyone obtaining that token can impersonate the user until expiry and access the associated account and data.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The share command changes task visibility to public without an up-front privacy warning or confirmation, so a user can expose sensitive research materials with a single command by mistake. In this skill's context, tasks may include proprietary reports, client requests, and uploaded documents, making accidental disclosure particularly harmful.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Manual token renewal also emits the new credential directly to stdout, creating the same credential leakage risk through logs, transcripts, and process output capture. Because this is an authentication bearer token, disclosure can immediately enable unauthorized API access.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares executable behavior that uses environment secrets and network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. That weakens the trust boundary for users and host agents, because a seemingly simple research skill can exfiltrate prompts/files to a remote service using AGENTIC_TOKEN without an enforceable least-privilege declaration.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The CLI implements far broader capabilities than the stated deep real-estate research purpose, including task deletion, public sharing, profile access, token lifecycle actions, file management, and workspace administration. This expands the attack surface and violates least-privilege expectations for a narrowly described skill, making misuse or accidental destructive/privacy-impacting actions more likely.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Natural-language strings throughout the file, including the top-level description and command help text, are fixed to Chinese with no locale selection or opt-in mechanism. This is a language policy concern because the skill imposes a specific language on all users regardless of preference or environment.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Automatic token-expiry handling and renewal are credential-management functions, not core research functions, and they materially increase the sensitivity of the skill. Because the code obtains new bearer tokens and then handles them in-process, any misuse, logging, or terminal capture can expose credentials with account-wide impact.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The share command publishes a task via a public URL even though public dissemination is not justified by the skill's stated research purpose. Since research tasks may contain proprietary market analysis, uploaded files, or sensitive business context, exposing them publicly can lead to confidentiality loss.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The profile command retrieves account information unrelated to the advertised research workflow, creating unnecessary access to potentially sensitive user metadata. In a skill expected to handle research tasks only, this unnecessary capability increases data exposure risk without clear business need.
- Content
Static analysis
No suspicious patterns detected.