T09 · Insecure Skill Coding Practices
Error
- Location
notify.py:22- Finding
Unrestricted Push-Service Destination Can Disclose API Credentials and Notification Data
- Content
View full analysis
- Remediation
View remediation
Security audit
push-server-py
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to send WeCom notifications as advertised, but it needs review because it can send the API key and message contents to any configured server and prints full notification payloads to logs.
Install only if you control and trust the configured Push Server URL, use HTTPS, and treat the API key as capable of sending messages. Avoid sending secrets or regulated data through this skill unless logging is fixed, because the script prints full notification payloads to stdout.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
notify.py:53- Finding
Complete Notification Payload Is Written to Standard Output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill requires environment variables and performs outbound network communication, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens security boundaries and informed review, because an agent or user may not clearly see that the skill can access secrets and exfiltrate data to an external service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill documentation explains that it sends notifications through an external Push Server, but it does not clearly warn users that message bodies, recipient identifiers, and potentially embedded URLs/articles are transmitted to a third-party service. This creates a data-handling and privacy risk because users may supply sensitive operational or personal information without realizing it leaves the local agent environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code performs an HTTP POST to an external push service using user-provided message content and recipient data. Although the module docstring says it sends notifications via an OpenAPI push service, the execution path itself does not provide a clear runtime disclosure or confirmation before transmitting the payload.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script prints the full parsed request body after JSON parsing, which can expose recipient identifiers and message contents to stdout, logs, or calling systems. In an agent/skill context, stdout is often captured centrally, so this creates unintended data disclosure beyond the stated purpose of sending the notification.
- Content