T09 · Insecure Skill Coding Practices
Error
- Location
siyuan.js:26- Finding
Generic API Call Bypasses the SELECT-Only SQL Restriction
- Content
View full analysis
- Remediation
View remediation
Security audit
Siyuan Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly aligned with controlling SiYuan notes, but its broad direct API command weakens the documented safety controls around SQL and writes.
Install only if you are comfortable giving the skill broad SiYuan API authority through SIYUAN_TOKEN. Prefer a local loopback SIYUAN_BASE, avoid pointing it at untrusted or plaintext remote hosts, and treat the generic call command as powerful enough to bypass some documented safety limits.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
lib/api.js:1- Finding
API Credential Can Be Transmitted to an Unrestricted Plaintext HTTP Destination
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:20- Finding
Installation Instructions Use Unpinned Remote Components
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill explicitly relies on an environment credential (SIYUAN_TOKEN) and direct HTTP access to a local API, but it does not declare any tool scope or allowed-tools constraints. That means an agent platform may grant broader-than-necessary access without clear policy boundaries, increasing the risk of unintended credential use, unauthorized local network calls, or misuse of write-capable operations exposed by the underlying CLI.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code performs a network POST request and transmits both an authorization token and arbitrary JSON body data, but it does not include any visible user-facing log, confirmation, comment, or docstring explaining that data will be sent to an external service. Under the code-file criteria for missing user warnings, network transmission of user or system data should have some disclosure unless clearly covered elsewhere in the skill description.
- Content