T09 · Insecure Skill Coding Practices
Error
- Location
scripts/skillpay.js:6- Finding
Hardcoded Billing API Credential Exposed in Source Code
- Content
View full analysis
- Remediation
View remediation
Security audit
BTC短线预测
Security checks for vulnerabilities and agentic risk
Overview
This BTC prediction skill mostly does what it advertises, but its paid billing flow is under-scoped and unsafe enough that users should review it carefully before installing.
Install only if you are comfortable with a paid remote billing service being contacted on invocation. Treat the bundled SkillPay key as exposed, do not rely on the advertised win-rate or automated-trading claims, and avoid using the history or auto commands until billing is validated before charging.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/predict.js:80- Finding
Billing Identity Is Generated from an Unauthenticated Timestamp
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
scripts/predict.js:62- Finding
Unsupported Documented Commands Enter the Paid Prediction Workflow
- Content
View full analysis
0 && args[0] === 'help') { console.log(` ╔════════════════════════════════════════════════════════╗ ║ BTC 短线预测器 - 15分钟级别涨跌预测 ║ ║ 每次调用 0.005 USDT ║ ╚════════════════════════════════════════════════════════╝ 用法: node predict.js [命令] 命令: (无参数) 获取当前预测 history 查看历史战绩（开发中） auto 自动模式（开发中） 示例: node predict.js 💰 支付: BNB Chain USDT，最低充值 8 USDT `); process.exit(0); } const userId = 'user_' + Date.now(); // 扣费 console.log('\n⏳ 检查余额并扣费...'); const chargeResult = await chargeUser(userId, SKILL_PRICE); ``` ### Technical Analysis There is no command-dispatch branch for `history` or `auto`. Only `help` receives special handling. Consequently, both documented commands—and any other unrecognized argument—fall through to the ordinary one-shot charge and prediction path. The `history` command therefore does not display historical results, and `auto` does not schedule a prediction every 15 minutes. Both can still initiate a charge attempt. This violates the expectation that billing occurs only after the requested operation has been validated and can be delivered. ### Attack Path 1. A user follows the documented instructions and runs `node scripts/predict.js history` or `node scripts/predict.js auto`. ...[truncated 909 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill appears to access an external billing API and use credentials while presenting itself primarily as a BTC predictor. Undisclosed external billing integration and credential-dependent behavior increase the risk of unauthorized charging, opaque data flows, and misuse of secrets, especially in a financial context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill appears to access an external billing API and use credentials while presenting itself primarily as a BTC predictor. Undisclosed external billing integration and credential-dependent behavior increase the risk of unauthorized charging, opaque data flows, and misuse of secrets, especially in a financial context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill appears to access an external billing API and use credentials while presenting itself primarily as a BTC predictor. Undisclosed external billing integration and credential-dependent behavior increase the risk of unauthorized charging, opaque data flows, and misuse of secrets, especially in a financial context.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 80% confidence
- Finding
The skill declares access to an environment variable and appears to require networked behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a transparency and least-privilege problem: users and platforms cannot reliably assess what capabilities the skill may exercise, especially when it also involves billing-related behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill promotes high-frequency, fully automated trading-style usage and advertises strong performance claims without any warning about financial loss, model error, or unattended execution risks. In a financial context, this omission can encourage unsafe reliance on speculative outputs and lead users to make repeated or automated trading decisions without understanding the downside.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This JavaScript file contains natural-language comments and output strings entirely in Chinese, including values returned in the
signalsobjects such as '超卖 → 看涨' and '放量上涨 → 看涨'. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code hard-codes the zh-CN locale in time formatting, and the skill's help/output strings are entirely in Chinese. This imposes a specific language/locale on all users without any opt-in or indication that the skill is intended only for a Chinese-speaking or region-specific context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The advertised function is directional BTC prediction, but the output goes further by providing concrete trading instructions such as BUY YES/BUY NO along with stop-loss and take-profit levels. This increases user reliance and potential harm, because the skill shifts from informational analysis into actionable financial advice without corresponding disclosure, safeguards, or suitability checks.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is presented as a BTC short-term prediction tool, but it also automatically initiates billing and a recharge flow before delivering the core functionality. This creates a deceptive capability mismatch: users or calling agents may invoke what appears to be an analysis skill without realizing it performs payment operations, increasing the risk of unauthorized charges or unintended financial interaction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code performs a network POST to a billing endpoint containing the user's identifier, skill identifier, and charge amount, but there is no confirmation prompt, user-facing log, or explanatory comment warning that a billable remote request will be made. Because this operation affects user billing and transmits user-related data, the lack of disclosure meets the missing-warning criterion for code files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The function sends a user's identifier and requested payment amount to a remote billing API, yet the code includes no confirmation prompt, print/log disclosure, or descriptive comment warning the user about this external transmission. Since the operation has privacy and billing implications, it should be disclosed.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest description and all user-facing documentation are presented only in Chinese, with no indication that users can choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The description is written only in Chinese ("BTC 15分钟短线预测 - 技术指标分析"), which can impose a language-specific experience without any indication that users may choose another language. The file does not document that this skill is region-specific or offer any opt-in for locale/language selection.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file's natural-language comments are written entirely in Chinese, including the capability descriptions and parameter documentation. Under the stated policy, forcing a specific language without user opt-in or a documented region-specific justification is a locale/language policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Natural-language strings and comments such as '收费接口', '扣费', and '开发模式：跳过扣费' indicate a Chinese-language experience without any opt-in or explanation that the skill is intentionally locale-specific. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
- Content