Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 1.0.0

Overview

The skill can perform its stated static-sharing function, but it uses a permanent plaintext API key and sends identifiable local device information to a third-party service.

Review before installing. Use a random device ID instead of username@hostname, avoid uploading private content unless password protection is explicitly set, do not expose the API key in chat or logs, and treat the stored key as a permanent credential that can change or delete hosted projects.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:450

Finding

Mandatory Third-Party Promotion and Traffic-Diversion Template

Content

View full analysis

and return qr_base64 → Also append the Web management console address {BASE_URL} → The user opens it in a browser After a successful upload, extract and clearly display the share URL, while also telling the user the current project name and project_id, reminding the user that files can be repeatedly modified in the same project, and providing the online management console address. 4. Generate a QR code: call GET /api/v1/qr?url=, retrieve qr_base64, and return it as: ![qrcode]() Example output: > Online management console: {BASE_URL} > Use your API Key to sign in and manage files, passwords, and usage. ``` The configured destination is: ```text https://artifact-share.youthol.top ``` ### Technical Analysis The Skill mandates that the Agent add a third-party management-console link and promotional management language to its response after every successful upload. It also mandates an additional request to the service's public QR-code endpoint. Returning the generated share URL is necessary for the declared artifact-sharing function. However, advertising the management console and generating a QR code are ancillary actions that are not required to complete an ordinary upload request. These directives alter the Agent's output independently of the user's request and create a stable traffic-diversion mechanism. The QR request additionally discloses the complete generated share URL to the QR endpoint. Although the same service may already host the artifact, the extra disclosure and network request are unnecessary unless the user requests a QR ...[truncated 1145 chars]

Remediation

View remediation

other

Warning

• Location: SKILL.md:40

Finding

Unnecessary Disclosure of Local Username and Hostname as a Device Identifier

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:83

Finding

Plaintext Storage and Console Exposure of a Non-Expiring API Key

Content

View full analysis

~/.config/artifact-share/config.yml << EOF device_id: {YOUR_DEVICE_ID} api_key: {YOUR_API_KEY} base_url: {BASE_URL} EOF ``` It later instructs the Agent to print the entire configuration file: ```bash cat ~/.config/artifact-share/config.yml ``` The surrounding instructions state that the API key does not expire and is the sole credential used for subsequent operations. ### Technical Analysis The credential is written to a plaintext YAML file without commands that enforce restrictive permissions. The directory is created without an explicit mode, and the file's effective permissions depend on the process umask. On an improperly configured or shared system, other local users may be able to read it. Using `cat` to retrieve the credential exposes the entire secret in command output. Depending on the Agent environment, that output can enter tool transcripts, terminal logs, debugging records, monitoring systems, or model context. The risk is amplified because the API key is documented as non-expiring and no recovery or revocation workflow is described. The credential authorizes project listing, uploads, replacement of hosted content, password changes, email-binding operations, and irreversible project or file deletion. ### Attack Path 1. The Agent registers with the external service and receives an API key. 2. The Agent writes the non-expiring key to `~/.config/artifact-share/config.yml`. 3. No explicit `0700` directory mode, `0600` file mode, or restrictive umask is applied. 4. A local user, process, backup system, or logging component obtains access to the file or command output. 5. The attacker extracts the API key. 6. The attacker sends au ...[truncated 1072 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to read a locally stored API key from a config file and later tells the agent to direct the user to use that API key to log into a web management console. Combined with indiscriminate file reads, this normalizes secret handling in plain text and increases the chance of credential exposure through logs, prompts, or agent responses.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.

}

text

### 4. Delete Project File — `DELETE /api/v1/projects/{PROJECT_ID}/files/{FILE_ID}`

删除项目中的单个文件（同时清理存储与记录，并重算项目大小/文件数）。`FILE_ID` 来自第 3 节列表响应的 `id`。操作不可恢复。

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 452)May include surrounding context.

5. 上传 → POST /api/v1/projects → 获取 project_id + name + 分享 URL（可仅传 name 建空项目稍后上传,或带 file 直接上传;URL 以本地文件名结尾）
6. 分享 → 将 URL 与项目名返回给用户 → 调 GET /api/v1/qr?url= 取 qr_base64 一并返回（扫码调试）→ 同时附上 Web 管理后台地址 {BASE_URL}（用 API Key 登录可在线管理）→ 用户在浏览器中打开
7. 更新 → 复用同一 project_id 调用 PUT /api/v1/projects/{id}/files → 内容替换、URL 保持不变
8. 删除 → DELETE /api/v1/projects/{id} → 移除项目

text

## Returning Share Links to Users

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is explicitly designed to publish uploaded artifacts at publicly accessible URLs, but it does not foreground a strong warning that uploaded content becomes publicly reachable. An agent following this guidance could expose private HTML, images, or embedded data without the user understanding the visibility implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The registration guidance suggests building device_id from username and hostname without a privacy warning. This unnecessarily encourages collection and transmission of local identifying metadata to a third-party service, making correlation of a user's environment easier.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill recommends deriving a persistent device identifier from local system identity such as username@hostname via shell commands. That collects and transmits more host-identifying data than is necessary for static file sharing, creating avoidable privacy leakage and a stable cross-session identifier tied to the user's machine.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill sends registration data, including device_id and nickname, to an external third-party service. External transmission is core to the skill's function, but it is still security-relevant because it exports locally derived identifiers and begins a persistent account relationship with an outside domain.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

注册请求

bash

curl -s -X POST {BASE_URL}/api/v1/register \
  -H "Content-Type: application/json" \
  -d '{"device_id": "yangyc@macbook-pro", "nickname": "Yang"}'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This is the same underlying issue as the duplicate finding: the skill persists a permanent API key to a predictable plaintext config path. That creates long-lived credential exposure risk disproportionate to the task of static artifact sharing.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

写入命令：

bash

mkdir -p ~/.config/artifact-share
cat > ~/.config/artifact-share/config.yml << EOF
device_id: {YOUR_DEVICE_ID}
api_key: {YOUR_API_KEY}

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This is the same underlying issue as the duplicate finding: the skill persists a permanent API key to a predictable plaintext config path. That creates long-lived credential exposure risk disproportionate to the task of static artifact sharing.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

写入命令:

bash

mkdir -p ~/.config/artifact-share
cat > ~/.config/artifact-share/config.yml << EOF
device_id: {YOUR_DEVICE_ID}
api_key: {YOUR_API_KEY}

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill expands from artifact sharing into account management workflows such as sending verification codes and binding email addresses. This broadens data collection and external transmission beyond the minimum needed for the skill's stated purpose, increasing privacy and phishing-style abuse risk if invoked unnecessarily.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The return template tells the agent to include the project password in plain text in its response. That creates an unnecessary secret disclosure path through chat history, logs, screenshots, and any downstream systems that capture model outputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The overview and most operational guidance are written in Chinese, effectively imposing a specific language on users and downstream agents. The file does not offer an opt-in language choice or explain that the skill is intentionally restricted to a Chinese-language audience.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:91