T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_poster.py:10- Finding
OpenRouter API Key Disclosed to an Unrelated Ofox Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Poster Maker
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent AI poster generator, but its script can send an OpenRouter API key to Ofox, so users should review it before use.
Review the script before installing. Do not use an OpenRouter key with the current version; use a dedicated Ofox key with spending limits, avoid sensitive prompt content, and rotate any OpenRouter key previously used with this script.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction "中文必须清晰" states a hard requirement for Chinese, which imposes a specific language policy without indicating user choice or opt-in. Under the policy rules, forcing a language or locale is a natural-language policy violation unless the constraint is explicitly optional or justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file repeatedly instructs that all output text must be in Chinese, which constitutes a language/locale constraint. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is clearly justified or optional.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
This code makes an outbound request to an external image-generation service and includes user-supplied prompt content plus an API bearer token. In the context of a poster-generation skill, external transmission is expected, but it still creates data exposure risk if users provide sensitive content or do not realize a third party will process their inputs.
- Content
python def generate(prompt, size, api_key): payload = json.dumps({"model":"google/gemini-3-pro-image-preview","prompt":prompt,"size":size,"response_format":"b64_json"}).encode() req = urllib.request.Request("https://api.ofox.ai/v1/images/generations",data=payload, headers={"Content-Type":"application/json","Authorization":f"Bearer {api_key}"}) with urllib.request.urlopen(req, timeout=180) as resp: data = json.loads(resp.read().decode())
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script sends the full prompt text to a third-party image-generation API, but it does not clearly warn users that their prompt content will leave the local environment. If prompts contain confidential business data, personal data, or proprietary creative material, this can cause unintended disclosure to the external provider.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The fallback instructions are specifically written around rendering Chinese text and present that locale as the default operating mode. Because no user choice or documented region-specific limitation is provided, this can be interpreted as an unjustified forced language constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file contains user-facing instructions exclusively in Chinese, with no indication that the user can select another language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The docstring and CLI descriptions use Chinese-only natural language, which can amount to forcing a specific language without user opt-in. The file does not indicate that this is a region-specific tool or provide any option for alternative language support.
- Content