T09 · Insecure Skill Coding Practices
Warning
- Location
references/key-auth/references/examples.md:82- Finding
API Secret Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
维表智联管理
Security checks for vulnerabilities and agentic risk
Overview
This looks like a legitimate Dimens business-admin skill, but it gives agents live credential, permission, publishing, rollback, and deletion workflows without enough safeguards.
Install only if you intend to let the agent administer Dimens/BintelAI resources. Before use, require explicit confirmation for deletes, restores, public sharing, permission changes, and API key lifecycle actions; use only the official trusted base URL for authentication; avoid pasting real secrets into command lines or chats; and protect or clear any local CLI profile that stores tokens.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/key-auth/references/login-flow.md:113- Finding
Persistent Bearer Tokens Stored Without Documented Protection
- Content
View full analysis
Written to the local profile for later commands. data.refreshToken -> Also written to the local profile when returned. ``` ### Technical Analysis The Skill instructs the CLI to persist bearer credentials locally but does not document: - The profile's exact storage location. - Owner-only file permissions. - Encryption at rest. - Integration with an operating-system keychain. - Protection against symbolic-link or shared-directory attacks. - Token redaction requirements. - Logout, revocation, or secure-deletion behavior. - Automatic expiration cleanup. Bearer tokens grant access to anyone who possesses them. Refresh tokens are particularly sensitive because they may provide access beyond the lifetime of the initial access token. The documented example indicates a refresh-token lifetime longer than the access-token lifetime, increasing the value of a stolen profile. ### Attack Path 1. A user authenticates using the documented workflow. 2. The CLI writes the access token and refresh token to a local profile. 3. Another local account, process, backup service, malware instance, or exposed workspace reads the profile. 4. The attacker extracts the bearer or refresh token. 5. The attacker replays the access token or uses the refresh token to obtain a new session. 6 ...[truncated 613 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/key-auth/references/login-flow.md:90- Finding
Custom Authentication Base URL Can Redirect API Credentials
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (53)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 项目初始化 | `references/project/overview.md` | 创建项目、项目菜单、文档资源、初始化主链 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 项目初始化 | `references/project/overview.md` | 创建项目、项目菜单、文档资源、初始化主链 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 项目初始化 | `references/project/overview.md` | 创建项目、项目菜单、文档资源、初始化主链 |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | --- | --- | --- | | `code` | `number` | 成功通常为 `1000` | | `message` | `string` | 成功通常为 `success` | | `data.expire` | `number` | access token 过期秒数 | | `data.token` | `string` | 维表智联用户 JWT | | `data.refreshExpire` | `number` | refresh token 过期秒数 | | `data.refreshToken` | `string` | 刷新 token |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | --- | --- | --- | | `code` | `number` | 成功通常为 `1000` | | `message` | `string` | 成功通常为 `success` | | `data.expire` | `number` | access token 过期秒数 | | `data.token` | `string` | 维表智联用户 JWT | | `data.refreshExpire` | `number` | refresh token 过期秒数 | | `data.refreshToken` | `string` | 刷新 token |
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description and the primary heading present the skill entirely in Chinese, with no indication that users may choose another language or that the skill is restricted to a Chinese-only compliance or regional context. The policy requires flagging language or locale constraints when they are imposed without user opt-in or clear justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document exposes a
canvas restorecommand that can roll back a canvas to an earlier version, but it does not warn that this operation may overwrite or effectively discard newer work. In a skill designed to create, save, and maintain shared business canvases, omission of a destructive-operation warning increases the chance of accidental data loss or rollback of current state by users or downstream agents following the instructions literally.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown guidance contains a natural-language locale policy that explicitly requires Chinese text fields when the user input is Chinese. The file does not offer the user a language/locale choice or explain a justified region-specific constraint, so it can violate language-choice policy.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file is natural-language content, and it consistently forces a single language/locale throughout the description and operational guidance. Under the policy, locale or language restrictions should not be imposed without user opt-in unless clearly justified as region-specific, which is not stated here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document states that login tokens and refresh tokens are written to a local profile for reuse, but provides no warning about secure local storage, file permissions, redaction, or avoiding shared machines. In a skill focused on authentication workflows, this omission can lead users to persist sensitive bearer credentials insecurely, increasing the chance of credential theft and unauthorized API access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill documents destructive API key lifecycle actions such as disable, delete, and reset-secret without any caution about operational impact, confirmation requirements, or rollback implications. In an admin/operations skill, this can cause accidental outages, broken integrations, or secret invalidation if users follow the instructions without safeguards.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document explicitly instructs users to pass an API secret on the CLI and states that access and refresh tokens are written to a local profile, but it provides no warning about shell history, process-list exposure, file permission hardening, or secure storage. In an authentication-focused skill, omitting these handling precautions can directly lead to credential leakage and session compromise on shared or monitored systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document gives operators a direct write command to change effective access control on resources, but it does not include an explicit warning that this action can immediately alter who can view or edit sensitive assets. In a permission-management skill, omission of change-risk guidance increases the chance of accidental over-permissioning, unintended exposure, or disruption, especially when users copy commands verbatim.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown documents permission deletion and revocation-related operations, including
/permission/deleteand later ACL revoke endpoints, but does not include any explicit caution that these actions can immediately remove user access or alter collaboration behavior. For markdown files, the rule requires warnings when behaviors could affect user data, privacy, or system integrity, and access-control changes are safety-relevant because they can lock users out or change effective permissions unexpectedly.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documents a destructive
doc deleteworkflow but does not require explicit user confirmation immediately before deletion. In an agent setting, this increases the risk of accidental or overly-trusted destructive actions, especially because the surrounding guide encourages direct command execution and lifecycle maintenance flows.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill includes a
doc deletecommand in the standard maintenance flow without highlighting that it is destructive and may permanently remove documentation or break project workflows. In an operational admin skill, presenting deletion alongside routine info/update commands without caution increases the chance of accidental data loss by users following the guide verbatim.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill recommends creating a default view with
--is-public truebut does not warn that this can expose table data to anyone with the public link or broader unintended audiences. In a resource-management skill that handles business projects, tables, permissions, roles, and reports, normalizing public-by-default configuration can easily cause accidental data disclosure of internal or customer information.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Recommending version restore without warning that it overwrites current document content can cause unintended integrity loss, especially in collaborative environments. In this skill's context, the command operates on live business documentation, so an incautious restore could erase newer work or operationally important updates.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The document exposes destructive and visibility-changing operations such as report deletion and publication with operational guidance, but the nearby guidance does not consistently require explicit user confirmation or clearly warn about irreversible data loss, dependency breakage, or unintended public exposure. In an agent skill context, this increases the chance that an automated agent will execute high-impact actions from a casual prompt without an adequate safety checkpoint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file includes example commands for deleting and archiving reports, which can affect user data and report availability, but it does not provide any caution, confirmation note, or warning about irreversible or disruptive effects. Under the markdown-specific warning criterion, user-facing documentation should disclose potentially harmful behaviors when presenting such operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document states that the
batchwidget API performs whole-array reconstruction and explicitly notes that missing components or changed ordering may be due to this overwrite behavior. In an agent skill that may generate or recommend commands, insufficient guardrails around bulk replacement can cause accidental loss of report component state or unintended destructive changes at scale.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The title and entire guidance prescribe the report component generation规范 in Chinese, and there is no indication that language choice is optional or limited to a justified region-specific workflow. Under the policy rule, forcing a specific language/locale without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown file presents all user-facing instructions in Chinese, which effectively forces a specific language for readers. The policy allows locale constraints only when the skill offers language choice or clearly documents and justifies the restriction, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The natural-language description is written entirely in Chinese and does not indicate that language selection is optional or limited to a China-specific/regional compliance context. Under the policy rules, forcing a specific language or locale without user opt-in is a natural-language policy violation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document defines a very generic trigger condition around requests like “帮我搭一个系统”, then prescribes broad operational steps across projects, tables, views, fields, relations, and reports. In an agent setting, an overly broad trigger can cause this skill to activate for common user requests outside its intended scope, leading the agent to perform or suggest high-impact resource creation and configuration in the wrong project or context.
- Content