T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:135- Finding
Shell Command Injection Through User-Controlled Lead Fields
- Content
View full analysis
- Remediation
View remediation
Security audit
找月嫂
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real maternity-service lead submission workflow, but it handles sensitive phone and pregnancy-related information with logging, endpoint-disclosure, and command-construction risks that users should review before installing.
Review this as a lead-generation skill rather than a full matching tool. Before installing, be comfortable sending phone number, SMS code, city, due-date timing, service period, and budget to the service backend, and avoid using it where process logs are retained or shared until verification-code and response logging are fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
dist/cli.js:78- Finding
SMS Verification Codes Are Written to Process Logs
- Content
View full analysis
{ return '"' + field + '":"' + maskPhone(phone) + '"'; }); } function postRequest(endpoint, bodyObj) { const fullUrl = BACKEND_URL + endpoint; const parsed = new url.URL(fullUrl); const transport = parsed.protocol === 'https:' ? https : http; const bodyStr = JSON.stringify(bodyObj); const options = { hostname: parsed.hostname, port: parsed.port || (parsed.protocol === 'https:' ? 443 : 80), path: parsed.pathname + parsed.search, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(bodyStr), }, timeout: TIMEOUT_MS, }; log('POST', fullUrl, 'body:', maskBodyForLog(bodyStr)); ``` The backend response is also logged in full at `dist/cli.js:114`: ```js log('Response status:', res.statusCode, 'body:', body); ``` ### Technical Analysis The request logger attempts to mask `mobile` and `telephone` fields, but it does not redact the `code` field used by the `verify_code` command. A verification request is serialized in a form equivalent to: ```json {"mobile":"13912345678","code":"123456"} ``` After `maskBodyForLog` processes it, the phone number is masked but the active verification code remains visible. The code is then written to standard error. Standard error is commonly captured by agent hosts, container runtimes, continuous integration systems, process supervisors, and centralized logging services. Consequently, a short-lived authentication factor is copied into systems that may have broader readership and longer retention than the original verification workflow. Logging complete response bodies also creates a prospective exp ...[truncated 1299 chars]- Remediation
View remediation
other
Warning
- Location
references/commands.md:12- Finding
Documented Personal-Data Destination Does Not Match the Executed Endpoint
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Outbound request logging masks phone numbers but does not mask the verification code, so one-time authentication codes are written to stderr in cleartext. Anyone with access to local logs, terminal history capture, CI output, or agent execution traces could reuse the code during its validity window to complete verification and potentially submit or manipulate leads tied to the victim's phone number.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file contains a natural-language policy requirement that users must ensure their AI assistant has completed security filing in mainland China. This imposes a locale-specific constraint on all users of the skill, but the skill does not clearly present itself as a China-only or region-restricted tool with explicit opt-in or scope limitation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI is hardcoded to transmit highly sensitive personal data, including phone numbers, due dates, and lead information, to a remote backend without any explicit user consent prompt, destination disclosure, or runtime confirmation. In the context of a maternity care booking skill, this data is especially privacy-sensitive and could be submitted unintentionally by users or calling agents who do not realize the information is leaving the local environment.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The hardcoded backend host
jz-user-recruitweb-betaaand the documentedsubmitLeadflow indicate the skill is oriented around collecting user leads and phone verification. That is materially different from a user-facing assistant that 'quickly finds suitable 月嫂' and supports intelligent matching across cities and budgets.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes a booking assistant that helps users find suitable 月嫂, recommend options by city, due date, service period, and budget, and match local resources. This file documents only three backend operations: sending an SMS code, verifying the code, and submitting a lead; there is no documented capability for searching, matching, recommending, or returning 月嫂 candidates to the user.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill documentation instructs collection and transmission of sensitive personal data, especially phone numbers and pregnancy-related service details such as due date, to remote APIs without any user-facing privacy notice, consent step, retention statement, or disclosure of who receives the data. In this context, the skill targets expectant/new mothers, making the data especially sensitive and increasing the risk of undisclosed lead harvesting, profiling, spam, or misuse.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document is entirely written in Chinese and prescribes fixed Chinese strings to display to users, such as the error messages and prompts throughout the tables. Because the file does not indicate that the skill is China/Chinese-specific or provide any user opt-in for language selection, this creates a natural-language locale policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file's help text and error/status messages are written in Chinese only, and the CLI does not offer any locale selection or user opt-in. This creates a language policy concern because it forces a specific language regardless of user preference.
- Content