T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/geekbi_auth.py:698- Finding
Unrestricted API Origin Permits Attacker-Controlled or Cleartext Authentication Flows
- Content
View full analysis
- Remediation
View remediation
Security audit
极鲸云速卖通类目搜索
Security checks for vulnerabilities and agentic risk
Overview
The skill’s AliExpress research purpose is coherent, but it handles persistent login tokens and exposes an unsafe API-origin override that users should review before installing.
Install only if you trust GeekBI and are comfortable with local persistent login state. Use the default GeekBI endpoint, avoid passing custom --base-url values, and consider clearing auth state after use; the publisher should isolate the auth namespace and restrict API origins to HTTPS allowlisted hosts.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Undeclared authentication management, local state persistence, and token injection materially expand the skill’s security-sensitive behavior beyond its stated analytics purpose. Hidden or insufficiently disclosed auth flows and local credential storage increase the risk of token leakage, unauthorized reuse, and operator misunderstanding about what sensitive data the skill handles.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Undeclared authentication management, local state persistence, and token injection materially expand the skill’s security-sensitive behavior beyond its stated analytics purpose. Hidden or insufficiently disclosed auth flows and local credential storage increase the risk of token leakage, unauthorized reuse, and operator misunderstanding about what sensitive data the skill handles.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Undeclared authentication management, local state persistence, and token injection materially expand the skill’s security-sensitive behavior beyond its stated analytics purpose. Hidden or insufficiently disclosed auth flows and local credential storage increase the risk of token leakage, unauthorized reuse, and operator misunderstanding about what sensitive data the skill handles.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Undeclared authentication management, local state persistence, and token injection materially expand the skill’s security-sensitive behavior beyond its stated analytics purpose. Hidden or insufficiently disclosed auth flows and local credential storage increase the risk of token leakage, unauthorized reuse, and operator misunderstanding about what sensitive data the skill handles.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill declares no explicit tool scope even though its instructions reference shell scripts, file access, and networked API usage. Without a least-privilege allowlist, an agent runtime may grant broader capabilities than necessary, increasing the blast radius if the skill is misused, mis-triggered, or later modified to perform unintended actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Broad trigger phrases can cause the skill to activate on unrelated user requests, which is risky here because the skill appears capable of shell, file, and network operations. Mis-triggering can lead to unnecessary external queries, unintended use of authenticated sessions, and execution of workflows the user did not explicitly request.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instruction '原样使用服务端中文 msg' requires the skill to present Chinese-language content exactly as returned by the server. This imposes a specific language on users without offering opt-in, fallback, or justification for a locale-specific workflow, which matches the language policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Natural-language strings such as the module docstring, argument descriptions, and error messages are written only in Chinese. This can amount to a language policy violation when the skill forces a specific language without user opt-in or documentation that the tool is intentionally limited to a Chinese-speaking context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This Python file contains natural-language strings entirely in Chinese, including the module description and multiple exception messages shown to users. Because the skill does not offer a language/locale choice or state that it is intentionally limited to Chinese users, it appears to impose a specific language without user opt-in.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The auth state path uses the namespace "temu-research-skill" while this skill is an AliExpress category search skill. This can cause credential/state confusion between different skills that share the same GeekBI config area, leading to unintended reuse, overwrite, or disclosure of login state across skills. In this skill context, the risk is more credible because the file manages persistent authentication tokens and mirrored state storage, so namespace collisions directly affect auth isolation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This Python file contains user-facing natural-language strings entirely in Chinese, including the module docstring, CLI description, validation errors, and error output messages. The file does not offer a language/locale option or document that the skill is intentionally restricted to Chinese users, which can violate language/locale policy requirements.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This Python file makes an authenticated HTTP request to an AliExpress API endpoint, which transmits request parameters and likely authentication context over the network. While the script's purpose is to query category data, the file itself does not include an explicit user-facing warning, confirmation, or comment/docstring disclosing that an authenticated remote request will be made.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This Python file contains natural-language strings entirely in Chinese, including the module docstring, CLI description, argument help text, and error messages. Under the policy rule for language/locale, this is a violation because it imposes a specific language without any visible user opt-in or alternative locale support.
- Content