T09 · Insecure Skill Coding Practices
Error
- Location
scripts/submit_text.sh:7- Finding
Arbitrary Python Code Execution Through Unsafely Interpolated Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
review-radar
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed client for a local review-analysis service, but one helper script can run unintended local code from crafted inputs, so it needs Review before installation.
Install only if you trust the separate Review Radar service and can fix or avoid scripts/submit_text.sh. Keep RR_BASE_URL pointed at a trusted local endpoint, avoid passing untrusted file names or titles, and review the local service's own data handling before submitting private transcripts or URLs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/submit.sh:5- Finding
JSON Request Injection Through Unescaped Video URL
- Content
View full analysis
}" JOB=$(curl -sf -X POST "$BASE/jobs" -H 'Content-Type: application/json' \ -d "{\"url\": \"$URL\", \"run_async\": false}") ``` ### Technical Analysis The video URL is inserted directly into a JSON document without JSON escaping. URL input containing quotation marks, backslashes, or JSON structural characters can terminate the intended `url` string and alter the remainder of the request body. Depending on how the Review Radar service handles duplicate keys and which job properties it accepts, an attacker may inject or override request fields. At minimum, malformed input can make the request invalid and prevent legitimate jobs from being submitted. This is not direct shell-command injection because the URL remains within a quoted shell variable expansion. The vulnerability occurs at the JSON serialization boundary. ### Attack Path 1. An attacker supplies a crafted value as the video URL. 2. `submit.sh` inserts the value into the JSON request body without escaping it. 3. The resulting document contains attacker-controlled JSON structure rather than only an inert URL string. 4. The local Review Radar service parses the modified request. 5. The service may process injected fields, honor attacker-selected options, or reject the malformed request. ### Impact Assessment The confirmed scope is manipulation or disruption of job-submission requests sent to the configured Review Radar service. Potential consequences include: - Overriding job options recognized by the server. - Submitting unintended data fields. - Causing submission failures or workflow denial of service. - Triggering additional server behavior if the endpoint accepts security-sensitive properties. No evidence in the audited repository establishes that th ...[truncated 160 chars]- Remediation
View remediation
}" PAYLOAD=$(python3 - "$URL" <<'PY' import json import sys print(json.dumps({ "url": sys.argv[1], "run_async": False, })) PY ) JOB=$(curl -sf -X POST "$BASE/jobs" \ -H 'Content-Type: application/json' \ --data-binary "$PAYLOAD") ``` Further hardening should include: 1. Validate that the value is a supported `http` or `https` URL before submission. 2. Enforce any expected host allowlist if only specific video providers are supported. 3. Validate the request against a strict server-side schema and reject unknown fields. 4. Define deterministic handling for duplicate JSON keys, preferably rejecting them. 5. Add regression tests for quotes, backslashes, control characters, and malformed URLs. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description promises substantive functionality for extracting intelligence from display review videos on Bilibili/YouTube, including transcription and structured analysis. The actual code chunk does none of that; it only checks whether a local service endpoint (/health) is reachable. While a health-check script could be a supporting component of such a system, this chunk by itself does not implement or reflect the declared primary purpose. Therefore, the description does not accurately represent what this supplied code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose centers on analysis of review videos: accepting video URLs, transcribing audio, extracting structured findings, and aggregating multiple reviews. The actual code does none of these things. It simply performs a GET request to a reports API and formats the JSON output. This is a materially different primary purpose and indicates undeclared reliance on an existing report service rather than implementing video-analysis behavior. Therefore the description does not accurately represent the supplied code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents an end-to-end video review analysis skill focused on monitor review videos: ingesting links, transcribing speech, extracting test data/pros-cons/conclusions/competitor mentions, and supporting batch processing. The actual code does none of that directly. It only performs a curl request to retrieve a report from an API endpoint using a supplied job_id, optionally in JSON. This is a materially different primary purpose based on the supplied chunk. While this script could be a supporting utility within a larger system, the code shown itself is not accurately represented by the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description promises a feature for processing monitor review videos from Bilibili/YouTube and extracting structured evaluation insights. The actual code chunk only implements a status-check helper: it calls a jobs endpoint on a local service using a provided job ID and formats the JSON output. While this could be a supporting utility in a larger system, this chunk by itself does not perform or directly evidence the core declared functionality. Its observable behavior is materially different from the stated primary purpose, so this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description centers on ingesting Bilibili/YouTube review video links, transcribing audio, and extracting structured monitor review intelligence. The provided code does none of that directly: it takes a local text file path, reads the file, posts the text as 'manual_text' to a jobs API, and fetches a markdown report. This is a materially different input modality and workflow from the advertised video-link transcription pipeline. While this could be a fallback utility in a larger system, the supplied code chunk itself is not accurately represented by the declared purpose.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh set -euo pipefail BASE="${RR_BASE_URL:-http://127.0.0.1:8787}" if [ $# -ge 1 ]; then curl -sf "$BASE/reports?model=$1" | python3 -m json.tool else curl -sf "$BASE/reports" | python3 -m json.tool fi
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh if [ $# -ge 1 ]; then curl -sf "$BASE/reports?model=$1" | python3 -m json.tool else curl -sf "$BASE/reports" | python3 -m json.tool fi
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh # 查询任务状态 set -euo pipefail BASE="${RR_BASE_URL:-http://127.0.0.1:8787}" curl -sf "$BASE/jobs/${1:?用法: status.sh <job_id>}" | python3 -m json.tool
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh set -euo pipefail BASE="${RR_BASE_URL:-http://127.0.0.1:8787}" URL="${1:?用法: submit.sh <视频URL>}" JOB=$(curl -sf -X POST "$BASE/jobs" -H 'Content-Type: application/json' \ -d "{\"url\": \"$URL\", \"run_async\": false}") JOB_ID=$(echo "$JOB" | python3 -c "import sys,json;print(json.load(sys.stdin)['job_id'])") curl -sf "$BASE/reports/$JOB_ID?format=md"
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh text = open('$FILE', encoding='utf-8').read() print(json.dumps({'manual_text': text, 'title': '$TITLE', 'run_async': False})) ") JOB=$(curl -sf -X POST "$BASE/jobs" -H 'Content-Type: application/json' -d "$PAYLOAD") JOB_ID=$(echo "$JOB" | python3 -c "import sys,json;print(json.load(sys.stdin)['job_id'])") curl -sf "$BASE/reports/$JOB_ID?format=md"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill instructs the agent to invoke shell scripts and a local Python service, but the manifest does not declare any explicit tool scope such as allowed shell access. That creates an authorization and review gap: a caller may not realize the skill requires command execution against localhost and local files, increasing the chance of unintended command use or broader-than-expected system interaction.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh BASE="${RR_BASE_URL:-http://127.0.0.1:8787}" [ $# -ge 1 ] || { echo "用法: batch.sh <URL1> [URL2 ...]" >&2; exit 1; } URLS=$(printf '%s\n' "$@" | python3 -c "import sys,json;print(json.dumps([l.strip() for l in sys.stdin if l.strip()]))") curl -sf -X POST "$BASE/jobs/batch" -H 'Content-Type: application/json' -d "{\"urls\": $URLS}"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The curl command transmits the batch of input URLs to the service endpoint, which is a network operation involving user-supplied data. While the file has a usage message, it does not disclose that the provided URLs will be sent to a remote/local HTTP service, and there is no user-facing log, comment, or confirmation associated with that transmission.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 77% confidence
- Finding
The script transmits a user-controlled URL to an external HTTP service, and the default endpoint uses plain HTTP rather than HTTPS. In this skill context, sending the URL to a processing backend is expected, but using unauthenticated, unencrypted transport can expose the submitted URL and returned job metadata to interception or tampering by a local network adversary if the service is not strictly confined to localhost.
- Content
sh set -euo pipefail BASE="${RR_BASE_URL:-http://127.0.0.1:8787}" URL="${1:?用法: submit.sh <视频URL>}" JOB=$(curl -sf -X POST "$BASE/jobs" -H 'Content-Type: application/json' \ -d "{\"url\": \"$URL\", \"run_async\": false}") JOB_ID=$(echo "$JOB" | python3 -c "import sys,json;print(json.load(sys.stdin)['job_id'])") curl -sf "$BASE/reports/$JOB_ID?format=md"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script sends the user-supplied URL to a backend service via a POST request, which is a network operation that transmits user data. There is no confirmation prompt, warning message, comment describing the disclosure implications, or other user-facing notice in the script.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The script transmits local file contents in a POST request to a configurable external endpoint via RR_BASE_URL, with an insecure HTTP default of 127.0.0.1:8787. Even if intended for a local service, this is still an external transmission boundary and becomes more dangerous if the environment variable is changed to a remote host, if localhost is proxied, or if sensitive input files are uploaded unintentionally.
- Content
sh text = open('$FILE', encoding='utf-8').read() print(json.dumps({'manual_text': text, 'title': '$TITLE', 'run_async': False})) ") JOB=$(curl -sf -X POST "$BASE/jobs" -H 'Content-Type: application/json' -d "$PAYLOAD") JOB_ID=$(echo "$JOB" | python3 -c "import sys,json;print(json.load(sys.stdin)['job_id'])") curl -sf "$BASE/reports/$JOB_ID?format=md"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script reads an arbitrary local text file and posts its full contents to a network service without any explicit disclosure, confirmation, or data-sensitivity warning to the user. In the context of a skill that processes review material, this creates a real risk of accidental exfiltration if a user supplies notes, transcripts, or other sensitive files assuming the processing is purely local.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The description says to use the skill when the user mentions phrases like "总结评测视频" or "评测情报", but it does not provide negative examples or clear constraints on what kinds of review videos qualify. Some of these phrases are generic enough that they could match broader conversations about summarizing reviews rather than specifically invoking this localhost-backed video intelligence workflow.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Natural-language guidance and usage instructions appear exclusively in Chinese, which can impose a language requirement without stating that users may interact in other languages. The policy requires flagging language or locale constraints when they are forced without opt-in or clear justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script’s descriptive comment and usage output are written only in Chinese, which imposes a specific language on users without opt-in or explanation. Under the policy, language constraints should either offer choice or be clearly justified as region- or locale-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file contains user-facing natural language only in Chinese, including the comment and the shell parameter error message. This imposes a specific language without any opt-in or indication that the skill is intentionally limited to Chinese-speaking users or a China-specific environment.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The comment and usage message are presented only in Chinese, which imposes a specific language on users without offering an alternative or opt-in. This can violate language/locale policy where skills should not force a locale absent explicit justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script's visible usage/help text and default title are presented only in Chinese, which imposes a language choice on users without opt-in or an alternative locale. This is a natural-language policy issue because the skill does not offer language selection or document a justified region-specific constraint.
- Content