T09 · Insecure Skill Coding Practices
Error
- Location
scripts/neuron_skill.py:127- Finding
Unauthenticated UDP discovery permits peer-list poisoning and unsafe task distribution
- Content
View full analysis
- Remediation
View remediation
Security audit
神经元
Security checks for vulnerabilities and agentic risk
Overview
The skill is purpose-aligned, but it automatically shares prompts and results with unauthenticated LAN peers, which creates a real privacy and answer-integrity risk.
Install only in a trusted, controlled LAN and avoid sending secrets, credentials, private business data, or regulated personal data through it. Treat peer answers as untrusted unless peers are authenticated and allowlisted; review memory exports carefully because they may contain full prompts and results.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T01 · Skill Instruction Hijacking
Error
- Location
scripts/neuron_skill.py:260- Finding
Untrusted peer responses enable prompt injection during result aggregation
- Content
View full analysis
str: summary_prompt = self._build_summary_prompt(question, results) if context and hasattr(context, 'call_model'): return context.call_model(prompt=summary_prompt) else: return f"[聚合] {len(results)} 个节点响应。摘要: {summary_prompt}" def _build_summary_prompt(self, question: str, results: Dict[str, str]) -> str: summary = f"原始问题: {question}\n\n" summary += f"来自 {len(results)} 个节点的响应:\n" for node_id, result in results.items(): summary += f"\n[节点 {node_id}]:\n{result}\n" summary += "\n请将这些响应综合成一个全面、准确的答案。" return summary ``` ### Technical Analysis Peer responses are untrusted network-derived data. The implementation concatenates each response directly into the same prompt that instructs the aggregation model. There is no structural separation between instructions and peer data, no provenance enforcement, and no requirement that the model treat peer text solely as quoted evidence. A malicious peer can return text containing instructions that claim to override the aggregation task, suppress other responses, fabricate conclusions, or request disclosure of prompt content. Authentication alone would not fully resolve this issue because a compromised or malicious trusted peer could still submit adversarial content. ### Attack Path 1. An attacker becomes a participating node, potentially by exploiting unauthenticated discovery or compromising an authorized peer. 2. The initiating node sends a distributed question to the attacker-controlled peer. 3. The peer returns a response containing adversarial instructions, for example instructions to ignore the original question and emit attacker-selected content. 4. `_ ...[truncated 872 chars]- Remediation
View remediation
other
Warning
- Location
scripts/neuron_skill.py:53- Finding
Hostname-bearing persistent identity and local IP are unnecessarily exposed
- Content
View full analysis
str: try: s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) s.connect(("8.8.8.8", 80)) ip = s.getsockname()[0] s.close() return ip except Exception: return "127.0.0.1" ``` ```python msg = json.dumps({ "type": "announce", "node_id": self.node_id, "ip": self.local_ip, "timestamp": time.time() }).encode() sock.sendto(msg, ('', self.config["discovery_port"])) ``` ### Technical Analysis The Skill reads the local hostname and route-selected local IP address. It embeds the hostname in a persistent node identifier, stores both the node identifier and hostname in `scripts/node_identity.json`, and repeatedly broadcasts the hostname-bearing identifier together with the local IP. Determining a usable local address is reasonably related to the declared LAN discovery functionality. Collecting and disclosing the hostname is not necessary, however, because a random opaque UUID can uniquely identify a node. The persistent hostname-bearing identifier also enables long-term correlation of announcements. The UDP `connect()` call is used to determine the selected local interface; it does not itself establish a TCP connection. Nevertheless, hardcoding a public address for route selection is unnecessary and can produce mis ...[truncated 1161 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.json:1- Finding
Out-of-range default UDP port prevents discovery and causes repeated errors
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation advertises broadcasting final results for collective learning, which implies generated outputs may be shared network-wide without clear disclosure of the privacy and confidentiality consequences. Final answers can contain user secrets, proprietary data, or derived sensitive inferences, so rebroadcasting them materially expands the exposure surface beyond the originating node.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states that user questions are automatically distributed to all available LAN nodes, but it does not provide a prominent, explicit warning at the point of use that user-supplied content will be transmitted to other machines. Because prompts often contain sensitive business, personal, or credential-bearing data, automatic forwarding across the network can cause unintended data disclosure to every discovered node.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill documents code capabilities that include environment access and file read/write behavior, but it does not declare any explicit tool scope or permissions boundary in the manifest. In a distributed skill that persists node identity and reads configuration, this omission increases the risk of over-privileged execution and makes it harder for operators to understand or restrict what the skill can access.
- Content
Tainted flow: 'msg' from socket.socket.recvfrom (line 128, network input) → socket.socket.sendto (network output)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python "ip": self.local_ip, "timestamp": time.time() }).encode() sock.sendto(msg, ('<broadcast>', self.config["discovery_port"])) except Exception as e: print(f"广播错误: {e}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill distributes user questions to peer nodes and later broadcasts final aggregated results without any explicit consent, disclosure, trust model, or node authentication. In the context of a distributed AI skill, this is particularly risky because prompts and outputs may contain sensitive user data and are shared across the LAN with potentially untrusted or spoofed nodes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill exposes generic import/export of its full task memory to arbitrary local file paths, which goes beyond the core LAN distribution purpose and can persist or ingest sensitive prompts, results, and metadata. In an agent environment, this increases the risk of unintended data exfiltration, unsafe file writes, and loading attacker-controlled JSON into runtime state.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Exporting the in-memory task store writes potentially sensitive questions, intermediate node outputs, and final results to an arbitrary file path with no warning, redaction, or access control. This creates a straightforward confidentiality risk if the file is written to a shared, predictable, or attacker-influenced location.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The file presents the skill description and operating instructions exclusively in Chinese. If organizational policy requires offering language or locale choice rather than forcing a single language, this is a natural-language policy concern because no opt-in or documented locale constraint is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
User-facing docstrings, CLI descriptions, help text, and status messages are consistently Chinese-only. Under the language/locale policy, forcing a single language without opt-in or documented justification can be a natural-language policy issue.
- Content