T09 · Insecure Skill Coding Practices
Error
- Location
scripts/eleme_api.py:14- Finding
TLS Certificate and Hostname Verification Disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
eleme-food-recommend
Security checks for vulnerabilities and agentic risk
Overview
This Ele.me food recommendation skill has a coherent purpose, but it needs Review because it handles a live account cookie and precise location data in unsafe ways.
Review carefully before installing. Only use it if you are comfortable giving the skill an active Ele.me browser cookie and precise location data. Prefer not to run it on shared machines, avoid pasting real cookies into shell commands, clear or rotate the cookie after testing, and do not use it on untrusted networks unless TLS verification and secret handling are fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/config_manager.py:35- Finding
Authentication Cookie and Location Stored in a Plaintext Configuration File Without Enforced Permissions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
main.py:48- Finding
Full Authentication Cookie Exposed Through Command Output and Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README explicitly instructs users to extract a live browser Cookie from developer tools and pass it to the skill, but it does not warn that this Cookie is an authentication credential that can grant account access if exposed. In this skill context, the risk is elevated because the Cookie is required for functionality and may be stored, logged, or mishandled by the tool, enabling account takeover or abuse of the user's food-delivery account.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises operational behavior that likely requires file access, configuration storage, and network access, but it declares no explicit tool scope or permissions. This creates unnecessary ambiguity about what the skill is allowed to do and can enable overbroad execution in hosts that rely on manifest metadata for trust and sandboxing decisions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation instructs users to pass an Eleme cookie directly on the command line without any warning about credential sensitivity, storage, shell history exposure, or account misuse risk. Cookies are authentication secrets, and exposing them this way can lead to account takeover, unauthorized orders, privacy leakage, or reuse by other local users and logs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module docstring and CLI help text present the skill exclusively in Chinese, which effectively forces a specific language for users. The file does not offer any language/locale choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific audience.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module persists sensitive user data, including a session cookie and precise location details, to a plain JSON file under the user's home directory without any warning, consent flow, or access-control hardening. In the context of a food-ordering skill, the cookie may enable account/session abuse and the location data exposes sensitive personal information if another local process or user can read the file.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The SSL helper explicitly disables both certificate validation and hostname verification, so every HTTPS request in this module is vulnerable to man-in-the-middle interception. In this skill, those requests carry an Ele.me authentication cookie and precise location data, which makes the weakness materially more dangerous than a generic transport issue because an attacker could steal the session or tamper with restaurant/menu responses.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code sends latitude, longitude, and the user's Ele.me cookie to remote Ele.me API endpoints, which is a privacy-sensitive network operation. Although comments and docstrings describe functionality, they do not warn the user that precise location and account-linked authentication data will be transmitted.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This function performs an authenticated HTTP request by attaching the configured cookie to the request headers. The code lacks a user-facing disclosure that account-linked credentials are being sent to a third-party service as part of menu retrieval.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module docstring and user-facing descriptions are written entirely in Chinese, which imposes a specific language on users without any visible opt-in or alternative. The stated policy flags language or locale restrictions unless the skill offers a choice or clearly documents a justified regional constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The code checks for and relies on a configured Eleme cookie, which is an authentication credential, but there is no user-facing warning here that the skill will use stored account credentials to access an external service. Silent use of a session cookie increases the risk of unauthorized account actions, accidental credential misuse, or exposure through poor storage/logging practices elsewhere in the skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The function sends precise latitude and longitude to a network API to retrieve nearby restaurants, but this file provides no user-facing notice or consent flow about sharing location data. Precise geolocation is sensitive personal data, and silent transmission can expose the user's home/work area or routine if the API, logs, or downstream services are compromised or misused.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The skill content, commands, and guidance are presented only in Chinese, which can amount to a language/locale constraint without an explicit opt-in or justification. There is no statement that the skill is intended only for Chinese-speaking users or for a China-specific use case.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The module docstring is written only in Chinese, with no indication that language is selectable or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when a skill imposes a language without user opt-in or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The module docstring and user-visible error messages are presented only in Chinese, which can impose a language constraint without offering opt-in or alternative locale handling. Under the stated policy, forcing a specific language without user choice can be a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The module docstring is entirely in Chinese and does not indicate that language is configurable or user-selected. This can constitute a language-policy issue when a skill implicitly forces a specific language without offering choice or documenting a justified locale constraint.
- Content
Static analysis
No suspicious patterns detected.