T09 · Insecure Skill Coding Practices
Error
- Location
scripts/dev_log.py:958- Finding
Automatic Disclosure of Unredacted Supplier HTTP Requests and Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
zzr-testUpload-skill
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent DEV log-search tool, but it automatically retrieves, stores, and exposes raw supplier HTTP payloads without redaction or confirmation.
Install only for authorized DEV operators who are allowed to view raw internal and supplier log payloads. Treat outputs and cached files as sensitive, avoid pasting real tokens into chats or repositories, restrict local file permissions, and delete ~/.DEV_SKILL/dev-find-log run directories after use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/dev_log.py:976- Finding
Raw Diagnostic Logs Retained Without Explicit Restrictive File Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly requires outputting underlying HTTP request and response payloads, but gives no requirement to redact secrets, personal data, or proprietary payload contents. Log and protocol payloads commonly contain tokens, session identifiers, booking data, passenger data, or internal endpoints, so automatic exposure materially increases data leakage risk.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill mandates automatic disclosure of full underlying HTTP request/response payloads to the user. This is dangerous because raw payloads often contain sensitive application data, credentials, internal schemas, and partner-specific information that should not be exposed verbatim in a user-facing answer.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill requires automatic retrieval and disclosure of supplier-side request/response data without asking the user for confirmation. Supplier-side logs are especially sensitive because they may include third-party API contracts, booking details, credentials, or partner error payloads, so forcing automatic collection and presentation increases both privacy and contractual exposure.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The output requirements force the user-facing response to include raw supplier HTTP URLs and request/response JSON. This creates a direct exfiltration path from internal/supplier logs to end users, potentially exposing credentials, PII, internal endpoints, business logic, and partner-confidential data in a way that is easy to copy, persist, and misuse.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill performs network access and local file read/write operations, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where a host agent may grant broader capabilities than intended, increasing the blast radius if the skill is misused or prompt-injected.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to match ordinary requests like '查 dev 日志' or 'grep 一下测试服', causing the skill to auto-activate in ambiguous situations. In this skill, auto-activation is risky because it can initiate log retrieval, network calls, and disclosure-heavy workflows without sufficient contextual narrowing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs users to store personal tokens and sshToken values in a local config file, but does not provide strong warnings or safer handling guidance. Credentials placed in plaintext under a predictable path are vulnerable to local disclosure, accidental inclusion in logs, backups, screenshots, or other tools reading the same directory.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document instructs operators to place account- and token-bearing credentials directly into HTTP headers and a local config file, but provides no guidance on secret handling, rotation, masking, or storage protections. In a log-search skill, these credentials may be copied into scripts, terminals, chat transcripts, or repo-managed dotfiles, increasing the risk of credential leakage and unauthorized access to DEV systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The API reference states that downloaded logs are automatically written to a predictable local path without warning that logs may contain sensitive application data, request/response bodies, identifiers, or credentials. Because this skill is specifically designed to retrieve DEV environment logs and even underlying HTTP messages, silent persistence to disk materially increases the chance of local data exposure, accidental sharing, and retention beyond operational need.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly directs extraction and disclosure of raw HTTP request/response data from DEV logs, but provides no guardrails for masking tokens, credentials, personal data, or other secrets commonly present in headers, bodies, and query strings. In this skill's context, the risk is elevated because it requires the agent to automatically continue into supplier-side logs and output底层报文, increasing the chance of broad sensitive-data exposure to the user or downstream systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script downloads log files to a persistent cache directory and saves them locally, while other functions in the file explicitly extract HTTP request/response payloads from those logs. Although the code prints the destination path, it does not warn the user that downloaded logs may contain sensitive request, response, or trace data and will remain on disk until later cleanup.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
A natural-language policy concern exists when a skill or reference material effectively forces a specific language without user opt-in. This file presents all operational instructions in Chinese and does not indicate that Chinese is optional or required for a justified region-specific reason.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The module docstring and all user-facing help and status text are written only in Chinese, which imposes a specific language on users without any opt-in or alternative locale. Under the stated policy, a skill should not force a language/locale unless it offers choice or clearly documents a justified regional constraint.
- Content