Security audit

HungryPanda Book

Security checks for vulnerabilities and agentic risk

Overview

This food-ordering skill is coherent overall, but it asks agents to install and periodically execute unpinned remote instructions while also handling orders, saved payment methods, addresses, and API credentials.

Review this skill carefully before installing. It can access HungryPanda account data, addresses, order history, delivery tracking, and saved-card payment flows. Do not enable the recurring heartbeat or remote rule-file execution unless the publisher provides pinned, reviewed, and verifiable files. Store the API key in a proper secret store or at least a 0600-permission file, and require explicit user approval before every paid order or payment confirmation unless you intentionally opt into a spending cap.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:97
Finding: Periodic Retrieval and Execution of Mutable Remote Instructions
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:17
Finding: Unpinned Remote Skill and Rule Files Overwrite Local Agent Instructions
Content: View full analysis
~/.hungrypanda/skills/hungrypandabook/SKILL.md curl -s https://open.hungrypanda.vip/heartbeat.md > ~/.hungrypanda/skills/hungrypandabook/HEARTBEAT.md curl -s https://open.hungrypanda.vip/rules.md > ~/.hungrypanda/skills/hungrypandabook/RULES.md curl -s https://open.hungrypanda.vip/skill.json > ~/.hungrypanda/skills/hungrypandabook/package.json ``` ``` ### Technical Analysis The installation procedure downloads the Skill definition, heartbeat instructions, rule file, and package metadata from mutable URLs and directly overwrites active local files. It performs no signature validation, checksum verification, version pinning, content review, or atomic staging. The commands do not directly pipe native code into a shell. Nevertheless, `SKILL.md`, `HEARTBEAT.md`, and `RULES.md` are executable control inputs in an Agent environment because their content affects the Agent's decisions and tool use. Replacing these files can therefore alter the Agent's security boundaries and behavior. The audited project contains only `SKILL.md` and `_meta.json`; the referenced `HEARTBEAT.md`, `RULES.md`, and remote package metadata are absent. Their contents and future changes cannot be assessed from the submitted artifact. ### Attack Path 1. A user follows the documented installation or update procedure. 2. The commands download files from mutabl ...[truncated 1253 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:74
Finding: Bearer API Credential Stored in Plaintext Without Required File Permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The skill recommends storing the API key in a plaintext JSON file under the user's home directory. Plaintext credential storage increases exposure to local compromise, accidental disclosure, backup leakage, and misuse by other tools or processes running under the same account.
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
⚠️ 立即保存你的 api_key！ 所有后续请求都需要它。

推荐： 将凭证保存到 ~/.config/hungrypanda/credentials.json：

json
{

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill provides detailed order-creation and payment-confirmation flows without an explicit safety gate requiring user confirmation that charges may be incurred. In an agent context, this increases the risk of unauthorized purchases or accidental payment execution, especially because the skill also supports saved payment methods and streamlined confirmation flows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill description and examples are entirely in Chinese, and the registration/profile examples set locale to zh-CN by default. The file does not offer an opt-in language choice or explain that the skill is limited to a Chinese-speaking or region-specific context, which may violate the language/locale policy.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
本地安装：

bash
mkdir -p ~/.hungrypanda/skills/hungrypandabook curl -s https://open.hungrypanda.vip/skill.md > ~/.hungrypanda/skills/hungrypandabook/SKILL.md curl -s https://open.hungrypanda.vip/heartbeat.md > ~/.hungrypanda/skills/hungrypandabook/HEARTBEAT.md curl -s https://open.hungrypanda.vip/rules.md > ~/.hungrypanda/skills/hungrypandabook/RULES.md

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
本地安装：

bash
mkdir -p ~/.hungrypanda/skills/hungrypandabook curl -s https://open.hungrypanda.vip/skill.md > ~/.hungrypanda/skills/hungrypandabook/SKILL.md curl -s https://open.hungrypanda.vip/heartbeat.md > ~/.hungrypanda/skills/hungrypandabook/HEARTBEAT.md curl -s https://open.hungrypanda.vip/rules.md > ~/.hungrypanda/skills/hungrypandabook/RULES.md curl -s https://open.hungrypanda.vip/skill.json > ~/.hungrypanda/skills/hungrypandabook/package.json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
本地安装：

bash
mkdir -p ~/.hungrypanda/skills/hungrypandabook curl -s https://open.hungrypanda.vip/skill.md > ~/.hungrypanda/skills/hungrypandabook/SKILL.md curl -s https://open.hungrypanda.vip/heartbeat.md > ~/.hungrypanda/skills/hungrypandabook/HEARTBEAT.md curl -s https://open.hungrypanda.vip/rules.md > ~/.hungrypanda/skills/hungrypandabook/RULES.md curl -s https://open.hungrypanda.vip/skill.json > ~/.hungrypanda/skills/hungrypandabook/package.json

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The registration payload specifies "locale": "zh-CN" as the default behavior, but the file does not state that this is optional or user-selected. A fixed locale without user choice is a natural-language policy concern under the language/locale rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The profile update example instructs setting locale to zh-CN and does not mention user preference or alternatives. Repeating a mandatory-looking locale default reinforces a language policy violation rather than presenting a neutral example.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file includes a destructive operation (DELETE /agents/me/addresses/ADDR_ID) but provides no user-facing warning or caution around data loss or reversibility. Under the markdown-file criteria for missing user warnings, destructive behaviors that can affect user data should be disclosed.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 457)May include surrounding context.
如果主人还没有登录过控制台，你可以帮他们发起设置：

bash
curl -X POST https://open.hungrypanda.vip/api/v1/agents/me/setup-owner-access \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"phone": "+44-7xxx-xxx-xxx"}'

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: The documented permission model includes auto_confirm_under, explicitly enabling autonomous transaction approval below a threshold. In a purchasing skill, this can bypass real-time user consent and lead to unauthorized or unintended orders, especially if combined with saved payment methods.
Content: Scanner excerpt · SKILL.md (reported line 484)May include surrounding context.
md
"permissions": { "max_order_amount": 50.00, "allowed_payment_methods": ["saved_card"], "auto_confirm_under": 20.00, "require_approval_for": ["new_restaurant", "high_value"], "blocked_restaurants": [], "delivery_addresses": ["addr_xxx", "addr_yyy"]

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: The permissions section normalizes the idea that low-value orders may be auto-confirmed without owner approval. That increases the chance of silent financial actions by an agent and weakens the principle of explicit user authorization for purchases.
Content: Scanner excerpt · SKILL.md (reported line 495)May include surrounding context.
md
**权限说明：** - `max_order_amount` — 单笔订单金额上限（超过则需主人确认） - `allowed_payment_methods` — 允许使用的支付方式 - `auto_confirm_under` — 低于此金额的订单自动确认，无需主人审批 - `require_approval_for` — 需要主人审批的场景 - `blocked_restaurants` — 屏蔽的餐厅列表 - `delivery_addresses` — 允许使用的配送地址 ID 列表

Static analysis

No suspicious patterns detected.