T09 · Insecure Skill Coding Practices
Error
- Location
scripts/create_room.py:43- Finding
Predictable Hard-Coded Publisher and Assistant Passwords
- Content
View full analysis
- Remediation
View remediation
Security audit
通过接口快速创建直播间
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims at a high level, but it handles sensitive CC credentials and creates rooms with weak hard-coded privileged passwords while exposing secrets in command-line use and logs.
Install only if you are comfortable reviewing or modifying the helper script first. Before real use, replace the hard-coded 123456 publisher and assistant passwords with unique strong values, avoid passing the API key on the command line, and remove logging of full request URLs and sensitive responses. Rotate any CC API key or room passwords previously used with this script if logs or shell history may have captured them.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/create_room.py:76- Finding
API Key Exposed Through Command-Line Arguments
- Content
View full analysis
[templatetype] [mobileViewMode]') print(' templatetype: 1-6 (default: 1)') print(' mobileViewMode: 2=竖屏观看, not set=横屏(default)') print(' Note: mobileViewMode only applies to templatetype 1, 2, 3, 6') sys.exit(1) userid = sys.argv[1] api_key = sys.argv[2] name = sys.argv[3] templatetype = int(sys.argv[4]) if len(sys.argv) > 4 else 1 mobileViewMode = int(sys.argv[5]) if len(sys.argv) > 5 else None ``` ### Technical Analysis The script requires the CC API key to be supplied as `sys.argv[2]`. Command-line arguments are not an appropriate channel for sensitive credentials because they may be exposed through: - Process-listing and system-monitoring interfaces while the process runs. - Shell command history. - Automation logs and job metadata. - Process inspection or diagnostic tooling. - Wrapper scripts that record the invoked command. The API key is used as the secret salt for generating THQS signatures. Disclosure therefore allows an attacker to construct authenticated requests independently of this script. This design also conflicts with the security requirement in `SKILL.md` that credentials must not be stored or cached. ### Attack Path 1. A user invokes the script with the API key as the second command-line argument. 2. The full invocation is retained in shell history, captured by automation logs, or exposed through process inspection. 3. A local user or another party with access to those records obtains the API key and associated account identifier. 4. The attacker reproduces the documented THQS signing algorithm using the stolen key. 5. The attacker su ...[truncated 773 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared purpose is broad credential management and room configuration, but the described behavior centers on a narrow create-room flow while the analysis indicates risky side effects such as hardcoded passwords and logging of signed request URLs. That mismatch is dangerous because it can conceal insecure credential handling and cause operators to trust the skill with sensitive API keys under incomplete or misleading documentation.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script sends sensitive values in a GET query string and also prints the full request URL and response to stdout. Because the URL contains authentication material derived from the API key and the request also includes default room credentials, these secrets can be exposed through terminal history, logs, process monitoring, proxies, or observability systems, making credential compromise more likely.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill clearly describes making outbound HTTP API calls and invoking a script that performs network activity, but it declares no explicit tool scope or allowed-tools/permissions boundary. This can allow an agent runtime to execute network-capable actions without transparent least-privilege constraints, increasing the chance of unintended data transmission or abuse.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill prescribes user-facing prompts in Chinese only, such as the credential and room setup questions, with no opt-in, fallback, or explanation that the skill is limited to Chinese-speaking users. This is a natural-language policy issue because it imposes a specific language on users without documented choice or justification.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md import requests API_URL = 'https://api.csslcloud.net/api/room/create' def my_urlencode(q):
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md import requests API_URL = 'https://api.csslcloud.net/api/room/create' def my_urlencode(q):
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests API_URL = 'https://api.csslcloud.net/api/room/create' def my_urlencode(q):
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Several user-facing docstrings and CLI/help strings are presented partly in Chinese and partly in English, but the script does not state a required locale or let the user choose a language. Under the stated policy, forcing a specific language or locale without opt-in is a natural-language policy concern.
- Content