T08 · Insecure Dependencies
Error
- Location
scripts/upload-to-ima.py:27- Finding
Unpinned External Uploader Receives File Access and Temporary Cloud Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
AI RecSys Weekly Report
Security checks for vulnerabilities and agentic risk
Overview
The skill's report-and-sync purpose is real, but it should be reviewed because it stores API keys locally, can run scheduled uploads, and invokes an unverified external uploader with cloud credentials.
Install only if you are comfortable with scheduled reports being uploaded to a specified IMA knowledge base. Use a least-privilege IMA key, restrict credential file permissions, avoid enabling the weekly automation until you have reviewed each generated report, and verify or vendor the COS uploader instead of relying on a mutable external script path.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/upload-to-ima.py:156- Finding
Temporary COS Credentials Are Exposed in Child-Process Arguments
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
README.md:68- Finding
README Command Exposes Long-Lived IMA Credentials Through Curl Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose emphasizes generating AI recommendation reports, but the operational instructions materially expand behavior into arbitrary file upload, local credential use, and external script execution. This mismatch is dangerous because users may authorize the skill expecting content generation while it actually gains a path to exfiltrate local files to an external knowledge base using stored credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly promotes weekly automatic execution and syncing generated content to an external IMA knowledge base, but it does not clearly warn that this creates unattended outbound data transmission. In an agent skill context, that omission matters because users may enable scheduled runs without fully understanding that reports and possibly embedded sensitive workspace content will be uploaded automatically.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 创建 skills 目录（如果不存在） mkdir -p ~/.workbuddy/skills # 解压到 skills 目录 unzip ai-recsys-weekly-report.zip -d ~/.workbuddy/skills/
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README instructs users to store API credentials in plaintext files under ~/.config/ima without warning about the sensitivity of those secrets or file-permission hardening. Plaintext credential storage increases the chance of theft by other local users, malware, backups, logs, or accidental inclusion in support bundles and dotfile sync tools.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The curl example demonstrates authenticated transmission of data and secrets to an external service using locally stored credentials. While contacting the IMA API is expected for this skill, the README normalizes external transmission without clearly isolating test usage, minimizing scopes, or warning that secrets are being injected into headers from local files.
- Content
md # 打开 IMA -> 知识库 -> 点击目标知识库 -> 复制 ID # 方法2: 如果已配置凭证，可以用 API 搜索 curl -s -X POST "https://ima.qq.com/openapi/wiki/v1/search_knowledge_base" \ -H "ima-openapi-clientid: $(cat ~/.config/ima/client_id)" \ -H "ima-openapi-apikey: $(cat ~/.config/ima/api_key)" \ -H "Content-Type: application/json" \
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill clearly instructs the agent to perform network access, invoke shell commands, read local credential files, and run external Python/Node upload tooling, yet it declares no explicit tool scope or allowed-tools boundary. This increases the chance of overbroad execution and makes it harder for the platform or reviewers to constrain behavior to the minimum required privileges.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation conditions are broad enough to trigger on generic requests for reports or industry analysis, which can cause the skill to run its network/search/upload workflow unexpectedly. In the context of a skill that reads local credentials and performs external synchronization, over-triggering raises the risk of unintended data handling or uploads without sufficiently specific user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs users to place persistent API credentials in predictable plaintext files under ~/.config/ima without warning about sensitivity, access controls, or rotation. This raises the likelihood of credential exposure through local compromise, accidental inclusion in backups, or unintended reuse by other tools and skills.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
This duplicate persistence finding is substantiated by the same behavior: writing long-lived IMA credentials into predictable plaintext files for later reuse. In a skill that also invokes shell, Python, Node, and network upload flows, persistent credential storage makes the context more dangerous because multiple execution paths could access those secrets and perform unauthorized uploads.
- Content
1. 打开 https://ima.qq.com/agent-interface 获取 Client ID 和 API Key
2. 存储凭证
mkdir -p ~/.config/ima echo "你的Client_ID" > ~/.config/ima/client_id echo "你的API_Key" > ~/.config/ima/api_key
text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
This duplicate persistence finding is substantiated by the same behavior: writing long-lived IMA credentials into predictable plaintext files for later reuse. In a skill that also invokes shell, Python, Node, and network upload flows, persistent credential storage makes the context more dangerous because multiple execution paths could access those secrets and perform unauthorized uploads.
- Content
1. 打开 https://ima.qq.com/agent-interface 获取 Client ID 和 API Key
2. 存储凭证
mkdir -p ~/.config/ima echo "你的Client_ID" > ~/.config/ima/client_id echo "你的API_Key" > ~/.config/ima/api_key
text
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python file contains its primary natural-language documentation and runtime output entirely in Chinese, including the module docstring and operational messages. Under the stated policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python api_key_path = os.path.expanduser("~/.config/ima/api_key") if not os.path.exists(client_id_path) or not os.path.exists(api_key_path): print("ERROR: 缺少 IMA 凭证。请先运行:") print(" mkdir -p ~/.config/ima") print(' echo "your_client_id" > ~/.config/ima/client_id') print(' echo "your_api_key" > ~/.config/ima/api_key') sys.exit(1)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 回退到系统 PATH for candidate in ["/usr/local/bin/node", "/opt/homebrew/bin/node", "node"]: try: r = subprocess.run([candidate, "--version"], capture_output=True, timeout=5) if r.returncode == 0: return candidate except Exception:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python ] try: r = subprocess.run(upload_args, capture_output=True, text=True, timeout=120) stdout = r.stdout.strip() if r.stdout else "" stderr = r.stderr.strip()[:300] if r.stderr else "" if stdout:
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file uses Chinese throughout, including the title, headings, and guidance, and does not indicate that the user may choose another language. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a locale-policy issue unless the constraint is explicitly documented and justified.
- Content
Static analysis
No suspicious patterns detected.