T09 · Insecure Skill Coding Practices
Error
- Location
scripts/local-agent/agent_link.py:121- Finding
Inbound Relay Messages Are Accepted Without Authentication
- Content
View full analysis
- Remediation
View remediation
Security audit
agent-link-local-agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is a relay-based agent messaging client, but its security claims are stronger than the code and examples support.
Review before installing. Use only with a relay you control or trust, prefer wss:// with valid TLS, avoid sending sensitive content unless you add end-to-end encryption, store the shared secret outside shell history and world-readable files, and treat inbound Agent messages as untrusted unless the client is updated to verify signatures and prevent replay.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/local-agent/agent-link-config.example.json:1- Finding
Plaintext WebSocket Transport Is Used in the Default Configuration
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/local-agent/agent_link.py:230- Finding
Shared Secret Can Be Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
docs/install-agent.md:24- Finding
Third-Party WebSocket Dependency Is Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly promotes using a public relay server for agent-to-agent messaging and even shows a default
ws://configuration later, but it does not clearly warn that message contents transit a third-party endpoint and are exposed to interception if TLS is not used. Because readers may follow the quick-start as written, this documentation can lead to insecure deployment and confidentiality loss for agent messages or metadata.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The quick-start and config examples encourage passing a shared secret directly on the command line and storing it in plaintext config files. Command-line arguments are often exposed through shell history, process listings, logs, and orchestration tooling, which can leak the credential and allow unauthorized agents or servers to impersonate trusted peers.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest description is written entirely in Chinese and provides no indication that the skill supports other languages or that the locale restriction is intentional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is clearly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code establishes a WebSocket connection to a relay server and immediately sends a registration payload containing instance metadata. Although there are developer-oriented log messages, there is no user disclosure or confirmation that data will be transmitted off-host, which matters because network/HTTP-style transmission is safety-relevant for code files.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
该文档从标题开始即以中文呈现，后续示例命令和说明也默认面向中文读者，没有提供用户可选择的语言/locale 选项，也未说明这是特定中文用户群体专用文档。按照语言/locale 政策，这属于未显式提供用户选择的语言限定。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The module docstring and many user/developer-facing comments are written in Chinese, while the file does not indicate that the tool is intentionally region-specific or provide any language selection. This can violate language/locale policy when a skill implicitly fixes one language without opt-in or justification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The code loads a JSON config file and retrieves a secret value used for authentication, but provides no user-facing notice that sensitive credentials are being read from disk. Comments and docstrings are implementation-focused and do not warn users about secret handling or advise secure storage practices.
- Content