T09 · Insecure Skill Coding Practices
Error
- Location
scripts/skillpay.js:7- Finding
Hard-Coded SkillPay API Credential Exposes Billing Authority
- Content
View full analysis
- Remediation
View remediation
Security audit
Polymarket预测监控
Security checks for vulnerabilities and agentic risk
Overview
This paid Polymarket monitoring skill mostly matches its stated purpose, but it embeds billing authority and performs automatic billing in ways users should review carefully.
Review this before installing because it is a paid skill that contacts external services and contains an embedded SkillPay API key. Use only in an environment where you trust the publisher, understand that invocations may trigger billing, and can control SKILLPAY_API_KEY, GLM5_API_KEY, and GLM5_API_URL securely.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ai-analyzer.js:6- Finding
Unrestricted GLM Endpoint Override Can Exfiltrate API Credentials and User Prompts
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the code performs external billing calls, generates payment/recharge links, contains hardcoded API keys, and lacks the claimed Polymarket monitoring logic, the skill is effectively deceptive and may be designed to extract money or abuse credentials under false pretenses. The combination of hidden payment behavior, embedded secrets, and absent core functionality is a strong indicator of high-risk abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the code performs external billing calls, generates payment/recharge links, contains hardcoded API keys, and lacks the claimed Polymarket monitoring logic, the skill is effectively deceptive and may be designed to extract money or abuse credentials under false pretenses. The combination of hidden payment behavior, embedded secrets, and absent core functionality is a strong indicator of high-risk abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the code performs external billing calls, generates payment/recharge links, contains hardcoded API keys, and lacks the claimed Polymarket monitoring logic, the skill is effectively deceptive and may be designed to extract money or abuse credentials under false pretenses. The combination of hidden payment behavior, embedded secrets, and absent core functionality is a strong indicator of high-risk abuse.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/monitor.js hot
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/monitor.js hot
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/monitor.js hot
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/monitor.js hot
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/monitor.js hot
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/monitor.js hot
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code embeds a live-looking SkillPay API key as a fallback when the environment variable is missing, which creates a secret exposure risk in source control, builds, logs, and downstream copies of the skill. Anyone obtaining the code can use the credential to invoke billing APIs, potentially charging users, creating payment links, or abusing the vendor account depending on the key's privileges.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares access to environment variables and implicitly requires networked behavior, but it does not declare any tool scope or permissions boundary. This is dangerous because users and hosting platforms cannot accurately assess what capabilities the skill needs, which weakens consent, review, and least-privilege controls.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language content of the skill description and usage instructions is presented in Chinese, and the file does not indicate that language selection is optional or user-configurable. Per the policy rule, forcing a specific language without user opt-in is a language/locale policy violation unless clearly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script presents its help text, commands, examples, and status messages in Chinese, and the file header also includes Chinese labeling. There is no indication that the skill is region-specific or that users can opt into another language, which creates a language/locale policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The function posts user_id, skill_id, and amount to an external billing endpoint to deduct funds, which affects user data and account balance. Although the file comments mention per-call charging, there is no visible confirmation prompt or user-facing disclosure at the point of charge execution.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file tells users to configure
SKILLPAY_API_KEYandGLM5_API_KEY, which are sensitive credentials, but it does not include any warning about keeping them secret, avoiding sharing logs, or how they will be used. Under the markdown-specific warning criterion, credential-related behavior should include some disclosure when privacy or system integrity could be affected.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The package description is written entirely in Chinese ("Polymarket预测市场监控 - 收费版") with no indication that the skill is region-specific or that users can choose their preferred language. This can violate the language/locale policy for natural-language content when no opt-in or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The prompt text requires the model interaction to occur in Chinese, and the rest of the file formats user-facing analysis messages in Chinese as well. This is a natural-language locale constraint with no visible opt-in or documented justification, which can violate language-choice policy.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
All visible natural-language documentation in this file, including the header comment and function descriptions, is Chinese-only. Under the language/locale policy, forcing a single language without offering choice or documenting a justified locale constraint can be a policy issue.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The function sends the caller's query string to the Polymarket API via
fetch, which is a network operation involving user-provided data. While the file has developer comments describing the function, it lacks any user-facing warning, logging, or confirmation that search input will be sent to a third-party service.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
Comments and operational descriptions such as the billing note are written in Chinese without indicating that language choice is optional. This can violate language/locale policy if the skill is expected to be language-neutral or to offer user choice.
- Content