bossskill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:04 AM UTC
• Version: 1.0.3

Overview

This is a mostly coherent business-assistant skill, but it needs Review because it can send business text plus license and device identifiers to cloud services and stores a reusable license key locally.

Before installing, treat this as a cloud-connected business-record system, not just a local coaching prompt. Use it only if you are comfortable with license/device identifiers and current licensed-command inputs being sent to the vendor cloud, avoid entering unnecessary personal or confidential business data, keep the SQLite database and exports protected, and do not rely on BOOSKILL_CORE_MODE=local as a no-network guarantee without a code fix.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/startup_os_db.py:545
• Finding: Unsolicited Commercial Content Injected into Local Daily Brief Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/startup_os_db.py:545-571` and `scripts/startup_os_db.py:574-594` **Vulnerability Type**: Output and instruction hijacking through mandatory promotional content **Risk Level**: High ### Vulnerable Code ```python return { "title": "BossSkill 今日老板简报", "today": today_text, "summary": f"当前有 {len(due_tasks)} 个到期任务，{len(followups)} 个到期客户跟进。", "today_priority": ranked_customers[:3], "due_tasks": due_tasks, "birthday_reminders": birthday_reminders(data, today_value), "important_date_reminders": important_date_reminders(data, today_value), "silent_customer_reminders": silent_customer_reminders(data["customers"]), "relationship_maintenance": relationship_maintenance_reminders(data), "one_on_one_reminders": one_on_one_reminders(data["team_members"]), "greeting_templates": greeting_templates(), "counts": { "customers": len(data["customers"]), "team_members": len(data["team_members"]), "contacts": len(data["contacts"]), "tasks": len(data["tasks"]), }, "suggested_action": [ "先处理今日到期客户，再处理到期任务。", "如果有生日或纪念日提醒，提前准备祝福或维护动作。", "重要客户和重要人脉没有下次动作时，今天先补一个维护任务。", "每次跟进后记录客户反馈、顾虑、下次时间。", "如果客户、员工或人脉信息缺失，今天只补一个最关键字段。", ], "upgrade_preview": commercial_preview("daily-brief"), } ``` ```python def commercial_preview(command): examples = { "assistant-action": "授权版示例：我会自动判断这句话是在建客户、建任务还是做复盘，并生成下一步动作、跟进话术和是否需要提醒。", "industry-playbook": "授权版示例：如果你做餐饮加盟，我会输出7天获客动作、客户筛选问题、跟进话术和成交复盘表。", "team-brief": "授权版示例：我会根据员工任务结果判断谁需要授权、谁需要训练、谁需要一对一沟通。", } return { "message": examples.get(command, "授权版会生成更完整的诊断、话术、任务和复盘方案。"), "commercial_modules": [ "经营判断系统", "主动秘书", "优秀级主动秘书", "行业深度作战包", "长期记忆", "任务结果闭环", "客户经营", "团队用人建议", "老板操作系统", "商业交付体系" ...[truncated 2216 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `upgrade_preview` from the normal return value of `local_daily_brief()`. 2. Return licensing and pricing information only when the user explicitly requests an upgrade, license status, activation help, or commercial feature preview. 3. Keep operational results and marketing content in separate commands and schemas. 4. Do not include Telegram, WeChat, or other off-platform contact details in routine tool output. 5. Add tests confirming that `daily-brief` output contains only requested operational data. 6. If a feature is unavailable because of licensing, return a concise machine-readable authorization error without unrelated promotion. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/startup_os_db.py:684
• Finding: Configured Local-Only Mode Does Not Prevent Cloud Transmission<![CDATA[ ## Vulnerability Details **File Location**: `scripts/booskill_license.py:184-186` and `scripts/startup_os_db.py:684-687` **Vulnerability Type**: Ignored privacy configuration causing unexpected network disclosure **Risk Level**: High ### Vulnerable Code ```python def cloud_enabled(): return os.environ.get("BOOSKILL_CORE_MODE", "cloud").lower() != "local" ``` ```python if not check_license(args.db, args.command).get("allowed"): print_json(license_required(args.command)) return response = run_cloud_core(args.command, args.db, args) print(response.get("output") or json.dumps(response, ensure_ascii=False, indent=2)) ``` The transmitted payload is built as follows: ```python def core_payload(command, db_path, args, db_export=None): command_args = { "project_id": getattr(args, "project_id", None), "name": getattr(args, "name", None), "text": getattr(args, "text", None), "owner": getattr(args, "owner", None), "title": getattr(args, "title", None), "topic": getattr(args, "topic", None), "content_json": getattr(args, "content_json", None), "confidence": getattr(args, "confidence", None), "customer_id": getattr(args, "customer_id", None), "industry": getattr(args, "industry", None), } return { "command": command, "args": {key: value for key, value in command_args.items() if value not in [None, ""]}, "license_key": read_license_key(db_path), "machine_id": machine_id(), "privacy_mode": "no_local_database_upload", } def run_cloud_core(command, db_path, args, db_export=None): return request_core("/run", core_payload(command, db_path, args, db_export)) ``` ### Technical Analysis The project defines `cloud_enabled()` to interpret `BOOSKILL_CORE_MODE=local`, but the command dispatcher never calls this function. After a successful license check, every unmatched licensed command is sent to `run_cloud_core()` unco ...[truncated 2129 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce the mode before any license or core network request: ```python if not cloud_enabled(): print_json({ "error": "cloud_disabled", "message": "This command requires cloud processing, but local-only mode is enabled." }) return ``` 2. If local implementations exist, dispatch to them explicitly instead of falling back to the cloud. 3. Define local-only mode as a fail-closed policy: no license check, telemetry, or core request should be allowed unless separately and clearly documented. 4. Display the destination host and fields to be transmitted before the first cloud operation, and obtain explicit user consent. 5. Minimize payload fields per command rather than using one broad argument collector. 6. Avoid sending a reusable license secret with every core request; use a scoped, short-lived authorization token. 7. Add automated tests that mock `urllib.request.urlopen` and verify zero network calls when `BOOSKILL_CORE_MODE=local`. 8. Validate and constrain configurable server URLs if untrusted environment modification is within the threat model. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/booskill_license.py:80
• Finding: Reusable License Key Stored in Plaintext Cache File<![CDATA[ ## Vulnerability Details **File Location**: `scripts/booskill_license.py:80-92`, `scripts/booskill_license.py:133-145`, and `scripts/booskill_license.py:148-157` **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: Medium ### Vulnerable Code ```python def write_cache(db_path, data): path = cache_path(db_path) existing = {} if path.exists(): try: existing = json.loads(path.read_text(encoding="utf-8")) except json.JSONDecodeError: existing = {} existing.update(data) existing["checked_at"] = datetime.now(timezone.utc).isoformat() path.write_text(json.dumps(existing, ensure_ascii=False, indent=2), encoding="utf-8") ``` ```python def activate_license(db_path, license_key): payload = { "license_key": license_key.strip(), "machine_id": machine_id(), "feature_name": "activate", } result = request_license("/api/license/activate", payload) result["license_key"] = license_key.strip() write_cache(db_path, result) return result ``` ```python def check_license(db_path, feature_name): key = read_license_key(db_path) if not key: return {"allowed": False, "plan": "free", "reason": "missing_license_key"} payload = { "license_key": key, "machine_id": machine_id(), "feature_name": feature_name, } try: result = request_license("/api/license/check", payload) result["license_key"] = key write_cache(db_path, result) return result ``` ### Technical Analysis Both activation and routine license checks add the complete reusable license key to the response data before calling `write_cache()`. The cache is stored as `.booskill_license.json` beside the selected database. The file is written with the process's default creation permissions. The code does not: - Use an operating-system credential manager. - Explicitly create the file with owner-only permission ...[truncated 1589 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not store the raw license key in `.booskill_license.json`. 2. Store the secret through the platform's operating-system credential manager, such as Keychain, Credential Manager, or Secret Service. 3. Prefer exchanging the license key for a revocable, device-scoped, short-lived token. 4. Keep only non-sensitive cache fields in the JSON file, such as authorization status, plan, expiration time, and last-check timestamp. 5. If file storage is unavoidable: - Create the file atomically with owner-only permissions. - Verify ownership and permissions before reading it. - Refuse unsafe symbolic links. - Avoid placing it in commonly synchronized or shared directories. 6. Redact the license key from command output and logs. 7. Provide credential rotation and revocation mechanisms. 8. Add tests confirming that the serialized cache never contains `license_key`. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (44)

Tainted flow: 'request' from os.environ.get (line 123, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={"Content-Type": "application/json"},
        method="POST",
    )
    with urllib.request.urlopen(request, timeout=12) as response:
        return json.loads(response.read().decode("utf-8"))

• Confidence: 95% confidence
• Finding: The request URL is derived from environment-controlled server settings, so anyone who can influence BOOSKILL_LICENSE_SERVER or BOOSKILL_CORE_SERVER can redirect license or core traffic to an attacker-controlled endpoint. That causes outbound transmission of the license key, machine fingerprint, and command metadata, creating SSRF-style abuse and credential/data exfiltration risk.

Tainted flow: 'request' from os.environ.get (line 123, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={"Content-Type": "application/json"},
        method="POST",
    )
    with urllib.request.urlopen(request, timeout=60) as response:
        return json.loads(response.read().decode("utf-8"))

• Confidence: 97% confidence
• Finding: Cloud-core requests are also sent to an environment-configurable endpoint, allowing redirection of command payloads, license keys, and machine identifiers to an attacker-controlled server. In the context of a coaching workflow, this is more concerning because user-entered business/customer text may be included in args and silently leave the local environment.

Hidden Instructions

High

• Category: Prompt Injection

Content

## 授权码协议确认

用户购买、领取、发送、输入、提交、激活或使用 BossSkill 授权码，即表示已阅读、理解并同意 `USER_AGREEMENT.md`、`PRIVACY.md` 和 `LICENSE_NOTICE.md`。

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is business coaching, but the skill also describes license activation, device identification, cloud command routing, cache storage, and remote communication. This mismatch undermines informed consent: users may invoke what թվում like a local advisory skill while triggering remote data flows and authorization mechanisms not clearly reflected in the primary description.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The client package includes license verification that transmits an authorization code, device identifier, and feature name, which is unrelated to the core coaching workflow and creates user/device tracking capability. This can expose sensitive metadata, enable fingerprinting, and violate least-privilege and data-minimization expectations if not prominently disclosed and controlled.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The release notes explicitly describe sending commercial commands to a remote cloud-core endpoint, which extends behavior beyond a local coaching/secretary workflow and introduces external data-flow risk. Even though the document says only command parameters are sent by default, the feature creates a remote execution and data exfiltration pathway that may be under-disclosed relative to the skill’s stated purpose.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file is entirely written in Chinese and the recommended prompt instructs the assistant how to answer老板问题, but it does not offer any language or locale choice for users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The README shows the skill being activated by plain conversational phrases such as customer notes, team observations, and task prompts without defining strict command boundaries or requiring explicit confirmation before state-changing actions. In an agent platform, this can cause accidental triggering from normal chat content, quoted text, forwarded messages, or prompt-injected context, leading to unintended data creation, follow-up actions, or cloud requests.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The phrase '今晚追结果' / 'Review unfinished tasks tonight' is a broad natural-language trigger that appears to initiate workflow behavior without specifying scope, target set, or confirmation. In a multi-turn agent environment, such underspecified triggers can be invoked unintentionally or through injected/quoted text, causing unwanted task review, status prompts, or autonomous follow-up behavior against the user's stored business data.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no explicit tool scope or allowed-tools boundary while the content instructs use of local scripts, database access, file operations, and network-backed licensing flows. That creates a permission ambiguity where a host may grant broader capabilities than users expect, increasing the chance of unauthorized file, environment, or network access.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The natural-language instructions, examples, and required outputs are all framed in Chinese, and the skill does not state that users may choose another language. Under the stated policy, forcing a specific language without opt-in is a locale-policy violation unless the constraint is clearly documented and justified.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Using broad trigger phrases such as '保存' and '查一下' as direct tool-invocation signals can cause unintended execution of local commands from ordinary conversation. In a secretary-style skill handling business records, ambiguous triggers raise the risk of unauthorized reads/writes to customer, employee, task, or contact data.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The phrase '今天有哪些' is vague and can naturally occur in normal planning conversation, yet the skill treats it as a tool trigger in some contexts. That ambiguity can lead to unnecessary database reads or workflow execution when the user only wanted generic planning advice, exposing recorded operational data more often than intended.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: This markdown file contains natural-language policy-relevant content, and the entire user agreement is written in Chinese with no indication that users may select another language or that the skill is limited to a Chinese-speaking or region-specific audience. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The default prompt is a very broad activation phrase that can trigger open-ended business coaching behavior without clearly constraining allowed topics, boundaries, or refusal conditions. In an agent setting, this increases the risk of prompt abuse, overscoped assistance, or the model being steered into sensitive operational, legal, HR, or financial guidance beyond the intended coaching use case.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The recommended bootstrap prompt is entirely in Chinese and directs the assistant’s default interaction style without any indication that the user has opted into Chinese. This can override user expectations, reduce transparency, and make safety notices or consent-sensitive actions less understandable for non-Chinese-speaking users, especially in a skill that may handle customer, team, and business records.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The startup instruction is written as a directive that constrains the assistant's behavior and includes fixed Chinese-language phrasing for how it should respond. In this manifest there is no indication that users may choose another language or that the Chinese-only behavior is limited to a justified region-specific context, which makes it a language/locale policy concern.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The document instructs users to export the SQLite database to JSON and sync it to other systems, but it does not warn that the database may contain customer, team, and business-operational data. In this skill’s context, that omission can lead users to move sensitive data into less protected locations or third-party memory systems without considering confidentiality, retention, or access controls.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation guidance is broad enough to trigger on generic requests like asking what to do next or wanting reminders, which can cause the skill to activate outside its intended business-coaching scope. Over-broad routing increases the chance of unintended data handling, irrelevant workflow insertion, or overshadowing more appropriate skills in ordinary conversations.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The mandated output template is entirely in Chinese without any stated locale requirement or user-language negotiation. This can cause responses in the wrong language, degrade usability, and create confusion in task or reminder workflows, especially if deadlines, owners, or acceptance criteria are misunderstood.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document defines structured storage for extensive employee and customer personal data, including phone numbers, social accounts, family relationships, compensation structure, performance scores, and sensitive behavioral notes. Although it includes a brief note to ask permission for sensitive customer data, it lacks clear data minimization, retention, access control, lawful basis, and handling guidance for employee/customer PII, making it easy for downstream agents or operators to over-collect and persist sensitive information in memory or knowledge stores.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The manifest describes startup coaching, secretary workflows, follow-up, team management, task review, and business diagnosis, but this file derives a machine identifier from host characteristics and uses it for remote license activation/checking. Commercial licensing controls may be operationally useful, but they are not a direct or obvious requirement of the stated end-user coaching functionality.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill description focuses on founder coaching, customer follow-up, team management, task review, diagnosis, and checklists, while this code primarily implements network calls to external license and core servers. Those remote control-plane operations are not reflected in the manifest description and go beyond an obvious implementation detail for a coaching skill.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code transmits a license key and machine identifier to remote services without any user-facing notice in this file, and cloud-core execution may also send command metadata and user-provided content. In a business coaching context, undisclosed outbound transfer increases privacy and compliance risk, especially where business/customer data may be involved.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The printed license-required message is hard-coded in Chinese, which imposes a specific language on all users without any opt-in or locale selection. The policy forbids forced language or locale behavior unless the skill offers a choice or clearly documents a justified regional constraint.

Static analysis

No suspicious patterns detected.