my-test-skill-4-xn

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:17 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed remote calculator integration, but it sends a bearer token and session data over unencrypted HTTP to a private IP address.

Review before installing. Only use this skill if you trust the private MCP server and the network path to it, and prefer an HTTPS endpoint with certificate validation plus a short-lived, least-privilege token. Rotate the token if it may already have been used over plaintext HTTP.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:31

Finding

Bearer Token and MCP Session Data Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:31-79
Vulnerability Type: Plaintext transmission of credentials and session data
Risk Level: High

Vulnerable Code

bash

# 1. Initialize a session and obtain the session ID
SESSION_ID=$(curl -s -D - -X POST http://192.168.71.7:8000/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer $XINIUDATA_MCP_TOKEN" \
  -d '{
    "jsonrpc": "2.0",
    "method": "initialize",
    "params": {
      "protocolVersion": "2024-11-05",
      "capabilities": {},
      "clientInfo": {"name": "mcp-calculator", "version": "1.0.0"}
    },
    "id": 1
  }' | grep -i "mcp-session-id" | awk '{print $2}' | tr -d '\r')

# 2. Send the initialized notification
curl -s -X POST http://192.168.71.7:8000/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer $XINIUDATA_MCP_TOKEN" \
  -H "mcp-session-id: $SESSION_ID" \
  -d '{"jsonrpc":"2.0","method":"notifications/initialized"}'

# 3. Invoke the add tool
curl -s -X POST http://192.168.71.7:8000/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer $XINIUDATA_MCP_TOKEN" \
  -H "mcp-session-id: $SESSION_ID" \
  -d '{
    "jsonrpc": "2.0",
    "method": "tools/call",
    "params": {"name": "add", "arguments": {"a": 123, "b": 456}},
    "id": 2
  }'

# Alternatively, invoke the subtract tool
curl -s -X POST http://192.168.71.7:8000/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer $XINIUDATA_MCP_TOKEN" \
  -H "mcp-session-id: $SESSION_ID" \
  -d '{
    "jsonrpc": "2.0",
    "method": "tools/call",
    "params": {"name": "subtract", "arguments": {"a": 100, "b": 30}},
    "id": 3
  }'

...[truncated 2360 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the plaintext endpoint with an HTTPS endpoint using a valid certificate:

   bash

   https://calculator.example.internal/mcp
   

2. Use a trusted DNS hostname rather than a bare IP address so the client can verify the intended server identity through certificate hostname validation.
3. Do not disable TLS verification with options such as curl -k or --insecure. For a private certificate authority, explicitly configure its CA certificate with --cacert or the operating system trust store.
4. Reject non-HTTPS MCP endpoint configuration by default and fail closed if certificate validation fails.
5. Scope the bearer token to only the required calculator tools and apply short expiration periods. Rotate the currently used token after migrating to TLS because it may previously have traversed the network in plaintext.
6. Apply server-side authorization independently to every request and bind session identifiers to the authenticated principal. Use short-lived, unpredictable session IDs and invalidate them when a session ends.
7. Where feasible, avoid sending simple arithmetic to an external service at all; local calculation removes the credential and network attack surface.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to send an Authorization bearer token to a remote MCP endpoint but provides no warning about token disclosure, server trust, or data transmission risks. This is more dangerous because the endpoint uses plain HTTP to a private IP address, so the token and request contents could be exposed in transit or sent to an untrusted internal service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

The skill directs clients to POST to an external MCP server over unencrypted HTTP while including a bearer token in the Authorization header. That creates a real risk of credential interception, replay, and unintended transmission of user data to an unverified service.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

bash

# 1. 初始化 session，获取 session ID
SESSION_ID=$(curl -s -D - -X POST http://192.168.71.7:8000/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer $XINIUDATA_MCP_TOKEN" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

This second network call continues the same insecure pattern: authenticated requests are sent to the same remote endpoint over HTTP with session state in headers. The repeated authenticated transmission increases the opportunity for interception and misuse if the network or target service is not trusted.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

}' | grep -i "mcp-session-id" | awk '{print $2}' | tr -d '\r')

# 2. 发送 initialized 通知
curl -s -X POST http://192.168.71.7:8000/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer $XINIUDATA_MCP_TOKEN" \

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The user-facing description and instructions are entirely in Chinese, which imposes a locale expectation without stating that the skill is region-specific or offering an opt-in language choice. Under the policy, language constraints should be justified or optional rather than implicitly forced.

Content

No source excerpt is available for this finding.