T09 · Insecure Skill Coding Practices
Error
- Location
scripts/image.env:3- Finding
Hardcoded ZhipuAI API Credential Committed in Plaintext
- Content
View full analysis
- Remediation
View remediation
Security audit
公众号文章创作
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent WeChat-writing purpose, but it ships a plaintext API key and performs automatic local file writes, so it should be reviewed before installation.
Install only if you are comfortable with the skill writing article files automatically to its configured directory and using a network image API after confirmation. The published package should remove and rotate the exposed API key, require each user to provide their own key, add overwrite/confirmation controls for file writes, and pin a single documented Python SDK before broad use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_images.py:84- Finding
Unvalidated API-Supplied Image URL Enables SSRF and Unbounded Downloads
- Content
View full analysis
bool: """Download and save an image.""" try: import urllib.request with urllib.request.urlopen(url, timeout=60) as response: data = response.read() output_path.write_bytes(data) return True except Exception as e: print(f" Download failed: {e}", file=sys.stderr) return False ``` The URL is taken directly from the remote API response: ```python if hasattr(response, 'data') and response.data and len(response.data) > 0: image_url = response.data[0].url print(f" URL: {image_url}") # Download image filename = f"{request_id}.png" output_path = out_dir / filename if download_image(image_url, output_path): ``` ### Technical Analysis The script treats an API-returned URL as trusted and passes it directly to `urllib.request.urlopen`. It does not: - Restrict the URL scheme to HTTPS. - Allowlist expected image-delivery hostnames. - Reject loopback, private, link-local, multicast, or reserved IP addresses. - Revalidate the destination after HTTP redirects. - Verify the response content type. - Validate that the downloaded bytes represent an image. - Enforce a maximum response size. - Stream the response to disk with bounded memory consumption. Consequently, a compromised API, manipulated SDK response, malicious proxy, or compromised upstream account could direct the host to request internal resources. The response is read without a byte limit, allowing a large payload to exhaust memory or disk space. Arbitrary content is also saved using a `.png` exte ...[truncated 1807 chars]- Remediation
View remediation
MAX_IMAGE_BYTES: raise ValueError("Image exceeds the permitted size") target.write(chunk) ``` ]]>
T08 · Insecure Dependencies
Warning
- Location
image_templates/api-config.md:29- Finding
Unpinned and Inconsistent Python Dependency Instructions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill exposes a live API key directly in documentation, which is sensitive credential material that can be copied and abused by anyone who can view the skill. Because the skill also supports API-backed image generation, the credential could be used for unauthorized requests, billing abuse, or service-account compromise.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
A hardcoded plaintext API credential is embedded in the skill content, making secret exposure immediate and actionable. Anyone with access to the file can reuse the key, causing unauthorized API usage, quota exhaustion, financial loss, and possible downstream account abuse.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill describes capabilities that read files, write files, and potentially call a networked image-generation script, but it does not declare any explicit tool scope or permission boundaries. That increases the chance of over-broad execution or unsafe agent behavior because users are not clearly informed what side effects the skill may perform.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The skill name, description, triggers, and operating instructions are all written specifically for Chinese-language公众号 writing, with no indication that the user may choose another language or that the locale restriction is mandatory for compliance reasons. This can constitute a language/locale policy issue because the skill appears to assume and enforce a single language context without explicit opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to automatically save generated content and image prompt files to disk without a clear upfront warning or per-write confirmation. Silent file creation can surprise users, overwrite data, or be abused to persist unwanted content in local directories.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The prompt explicitly requires 'Chinese text clear and readable,' which imposes a specific language in the template output. This is a natural-language policy concern because the file does not provide user opt-in, alternatives, or a documented reason for restricting output to Chinese.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This prompt requires a 'short Chinese description' and states that 'Chinese text' must be readable, which mandates a specific language. The file does not indicate that this is optional or limited to a clearly justified locale-specific use case.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template requires Chinese labels and Chinese bullet points, which enforces a language choice in the generated content. Because no opt-in or justification is provided in the file, this appears to violate the language/locale policy criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This template specifies 'a Chinese heading + 1-2 sentences' and requires Chinese text readability, thereby mandating a specific language. The file does not offer user choice or explain a justified locale restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring describes the skill entirely in Chinese and frames it specifically as a '公众号图片生成脚本' without any indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill content is written to operate entirely in Chinese and does not offer any user-language detection, preference check, or opt-in. This can cause unsafe or misleading behavior when a user expects another language, especially if nuanced writing guidance, constraints, or generated titles are misunderstood due to a language mismatch.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The document is explicitly framed in Chinese and prescribes Chinese-language stylistic requirements such as first-person phrasing and colloquial expressions, without offering a language choice. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to automatically save generated articles to a fixed local Windows path without explicit user confirmation at the time of file creation. This creates an unauthorized side effect on the host filesystem, can overwrite existing content, and may disclose local environment structure or write sensitive user-generated content into an unintended location.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The entire skill file is written as a Chinese-only title formula library for public-account content, with no indication that users may choose another language or locale. Under the policy, a skill that effectively mandates a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The title and all guidance require output in Chinese style conventions, and the file does not present this as optional or limited to a justified region-specific context. That creates a natural-language locale policy concern because it forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file contains user-facing instructional content exclusively in Chinese, and nowhere indicates that the skill is intended only for Chinese-speaking users or provides an opt-in choice of language. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Line L66 states that prompts are recommended in English for more stable results. This is a natural-language locale preference that nudges users toward a specific language without explicit opt-in or a clearly documented policy justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The prompt explicitly mandates that the generated title text be in Chinese, which is a locale/language constraint expressed in natural language. Because the file does not present this as an opt-in choice or document a region-specific justification, it constitutes a language-policy concern under the stated rules.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This prompt specifies a large bold Chinese title and states that Chinese text must be clear and readable, imposing a fixed language requirement. The file does not indicate that users can choose another language or that the template is restricted to a justified Chinese-only context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The template instructs that each section contain a short Chinese keyword and that Chinese text be readable, which enforces a specific language. Under the policy criteria, such language constraints should be optional or explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The markdown file presents all template titles and embedded prompt text exclusively in Chinese, including user-facing call-to-action text. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language or locale choice is offered.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The note '提示词建议使用英文，效果更稳定' directs users toward a specific language choice. Under the policy, language constraints should either offer a choice or be clearly justified as a documented locale requirement rather than a default instruction.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The natural-language comments in this file are entirely in Chinese, which imposes a specific language on users and maintainers without any stated opt-in or justification. Under the policy rule for language or locale constraints, this is a natural-language policy concern because the file does not offer an alternative language or explain that the skill is intended only for a Chinese-speaking context.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/image.env:4
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:200