T09 · Insecure Skill Coding Practices
Warning
- Location
skill.py:39- Finding
Spoofable Domain Reputation Classification Mislabels Attacker-Controlled Sites as Trusted
- Content
View full analysis
- Remediation
View remediation
Security audit
锋哥 Bing 搜索
Security checks for vulnerabilities and agentic risk
Overview
This is a straightforward Bing search skill, with privacy and result-labeling caveats but no evidence of hidden persistence, credential access, destructive behavior, or deception.
Install only if you are comfortable with search queries being sent to Microsoft Bing, specifically through cn.bing.com. Do not search for passwords, tokens, confidential project names, or private personal data. Treat the official or high-quality labels as rough heuristics because the domain scoring can be spoofed by misleading hostnames.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises and requires network-capable components but does not declare any explicit tool scope such as permissions or allowed-tools. This weakens transparency and policy enforcement, making it easier for a user or platform to invoke a networked skill without clear consent boundaries or reviewable capability declarations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description promotes Bing-based search but does not clearly warn users that their queries will be transmitted to Microsoft over the network. Search terms can contain sensitive business data, personal information, or secrets, so missing disclosure creates a privacy and data-handling risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file title and all user-facing strings are Chinese, and the code forces searches through the cn.bing.com endpoint. This imposes a specific language/locale behavior without opt-in or explanation, which matches the policy concern for forced language or locale constraints.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The natural-language description repeatedly emphasizes support for Chinese and English, which can imply a language limitation without an explicit opt-in or justification. Under language/locale policy review, this should be documented as a user choice or a clearly justified scope rather than an implicit restriction.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill sends the user's raw search query to an external service (cn.bing.com) without any in-file disclosure, confirmation, or privacy warning. This can expose sensitive prompts, internal project names, credentials accidentally pasted into queries, or other private data to a third party, which is a genuine privacy/security concern even though network search is the intended function.
- Content