T09 · Insecure Skill Coding Practices
Error
- Location
scripts/review.py:11- Finding
API Credential and Reviewed Documents Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
ai-compliance-review
Security checks for vulnerabilities and agentic risk
Overview
This skill provides a plausible compliance-review service, but its documentation and executable disagree about where sensitive documents and credentials are sent, including a plaintext HTTP default endpoint.
Review carefully before installing. Do not use this with confidential, personal, employee, legal, financial, or customer data unless the publisher documents the actual service operator, destination, transport security, retention policy, and credential model. A safer version should require HTTPS, align the docs with the shipped script, avoid sending provider API keys to unrelated hosts, and ask for explicit confirmation before upload.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:75- Finding
Security-Relevant Documentation Misrepresents the Bundled Executable and Network Destination
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill requires an API key and references an external API endpoint, implying environment-variable access and outbound network use, but it does not declare any explicit tool scope or allowed-tools boundaries. This creates an authorization ambiguity where the runtime may grant broader capabilities than users expect, weakening least-privilege controls for a skill that handles potentially sensitive legal, HR, and privacy documents.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The activation criteria are very broad and include common business-writing scenarios like marketing copy, agreements, HR text, and general document self-checks. This makes accidental invocation likely during routine work, increasing the chance that users unknowingly send sensitive content to an external service or rely on compliance output in contexts where the skill is not appropriate.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill invites users to submit contracts, privacy policies, labor documents, and other sensitive materials, yet it does not present a clear, prominent warning before those materials may be transmitted to an external AI provider. In this context, the missing warning is particularly risky because the covered document types often contain personal data, confidential business terms, employment information, or regulated content.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
The documentation explicitly configures an external API endpoint, indicating that user-provided compliance-review content will be transmitted off-host to a third-party service. Given this skill's purpose, that content may include legal drafts, privacy policies, employment materials, or commercial documents, so external transmission materially raises confidentiality, privacy, and regulatory exposure.
- Content
bash export COMPLIANCE_API_USER_KEY="你的DeepSeek API Key" # 可选：自定义API地址 export DEEPSEEK_BASE_URL="https://api.deepseek.com/v1"第二步：开始审查
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The code performs external network transmission of user data to a configurable backend, with a default endpoint set to a raw IP address over plain HTTP rather than HTTPS. This creates confidentiality and integrity risks: sensitive submitted text and API credentials can be intercepted or modified in transit, especially on untrusted networks.
- Content
python if method == "GET": resp = requests.get(url, headers=h, params=data or {}, timeout=30) else: resp = requests.post(url, headers=h, json=data or {}, timeout=60) if resp.status_code >= 400: try: err = resp.json()
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The review command takes arbitrary user-supplied text and submits it to a remote third-party API, but the CLI does not clearly warn users that their content leaves the local environment. Because this tool is specifically marketed for reviewing marketing copy, contracts, recruiting text, and privacy-sensitive content, users may unknowingly transmit confidential or regulated data to an external server over the network.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The docstring and CLI output/help text consistently force Chinese-language interaction, including descriptions, status messages, and usage guidance. Under the stated policy, imposing a specific language without offering user choice is a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.