T09 · Insecure Skill Coding Practices
Error
- Location
scripts/geekbi_auth.py:698- Finding
Bearer Token Can Be Sent to an Unrelated Network Origin
- Content
View full analysis
- Remediation
View remediation
Security audit
极鲸云美客多类目搜索
Security checks for vulnerabilities and agentic risk
Overview
The skill’s Mercado Libre research purpose is coherent, but it under-discloses how it stores and reuses GeekBI login tokens locally.
Review before installing if you are comfortable with this skill storing GeekBI login state locally and sending Mercado Libre research queries to GeekBI. Prefer installing only if you trust the publisher, can monitor or remove .geekbi/agent-auth.json files, and understand that the current implementation keeps token state in multiple local locations.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/geekbi_auth.py:69- Finding
Plaintext Authentication State Is Unnecessarily Mirrored Across Multiple Locations
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A substantial description-behavior mismatch is a security issue because the skill is presented as category research, while the detected behavior includes credential handling, token caching, login-state file management, and generic authenticated HTTP request support. That hidden auth and local-state functionality expands the trust boundary and can expose secrets or persist sensitive tokens in places users did not consent to.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A substantial description-behavior mismatch is a security issue because the skill is presented as category research, while the detected behavior includes credential handling, token caching, login-state file management, and generic authenticated HTTP request support. That hidden auth and local-state functionality expands the trust boundary and can expose secrets or persist sensitive tokens in places users did not consent to.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A substantial description-behavior mismatch is a security issue because the skill is presented as category research, while the detected behavior includes credential handling, token caching, login-state file management, and generic authenticated HTTP request support. That hidden auth and local-state functionality expands the trust boundary and can expose secrets or persist sensitive tokens in places users did not consent to.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A substantial description-behavior mismatch is a security issue because the skill is presented as category research, while the detected behavior includes credential handling, token caching, login-state file management, and generic authenticated HTTP request support. That hidden auth and local-state functionality expands the trust boundary and can expose secrets or persist sensitive tokens in places users did not consent to.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A substantial description-behavior mismatch is a security issue because the skill is presented as category research, while the detected behavior includes credential handling, token caching, login-state file management, and generic authenticated HTTP request support. That hidden auth and local-state functionality expands the trust boundary and can expose secrets or persist sensitive tokens in places users did not consent to.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares no explicit tool scope or permission boundaries even though its described workflow invokes local scripts and external services, implying file read, shell, and network capabilities. Without an allowlist, the runtime may grant broader access than users expect, increasing the blast radius if the skill or supporting scripts are modified, misused, or prompt-injected.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description and the entire skill instructions are written only in Chinese and provide no indication that language should follow the user's preference. Under the policy, a skill should not impose a specific language or locale without explicit user opt-in or a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The display name, short description, and default prompt are all written in Chinese, which imposes a specific language on the skill's interface and behavior. There is no indication that the skill is region-specific or that users can opt into or choose the language, which fits the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstring and subsequent user-facing strings are written in Chinese, indicating the skill presents messages in a fixed language. There is no evidence in this file of user opt-in, language selection, or a documented justification that the skill is intentionally region-specific.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
该技能清单描述的是使用极鲸云查询 Mercado Libre 类目样本并做类目研究分析，但本文件实现了独立的登录状态持久化、令牌缓存和清除机制。虽然访问极鲸云接口本身可能需要鉴权，但这里的代码实际承担了通用账号会话管理能力，而清单描述并未体现本地凭据存储或登录状态管理这一行为边界。
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The user config path uses a mismatched directory name, 'temu-research-skill', for this Mercado Libre skill. This can cause credential/state confusion across unrelated skills, leading to accidental token reuse, overwriting another skill's auth state, or reading stale credentials from the wrong context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
clear_auth_state会删除多个位置中的认证状态文件，这属于本地凭据生命周期管理，而非类目列表、父链或品类研究本身的直接业务能力。对一个被描述为市场/类目研究的技能而言，这种状态删除能力没有在清单中体现，造成描述与实际行为不一致。- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The clear_auth_state function unlinks authentication state files across all resolved stores, which is a destructive file operation affecting persisted login data. In this code path there is no confirmation prompt, no user-facing disclosure at the deletion point, and the function itself has no docstring or comment warning that it removes stored auth state from multiple locations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module docstring specifies the skill behavior entirely in Chinese, and the CLI descriptions and error messages also enforce Chinese-language interaction. This is a natural-language locale constraint with no user opt-in or documented justification that the tool is region- or language-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module docstring is written as an instruction-facing description entirely in Chinese, and the user-visible argument validation/error strings are also Chinese-only. This indicates a fixed language choice without any documented opt-in or locale selection, which can violate language/locale policy for general-purpose skills.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language strings in the module docstring, validation errors, and argument help are written only in Chinese, which imposes a specific language on users without any visible opt-in or documented locale constraint. Under the policy rule, this is a language/locale restriction because the skill does not offer an alternative language or explain that it is intentionally China-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description is entirely in Chinese and does not indicate any option for users to choose another language. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable unless the locale constraint is clearly documented and justified, which is not present here.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation instructs users to run scripts that query external Mercado Libre-related services but does not warn that user-supplied search terms and identifiers will be transmitted over the network. This creates a transparency and privacy issue: users may unknowingly send sensitive business research terms, product IDs, store IDs, or timing data to third-party services.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
_probe_storage_path不仅检查文件可读写，还进行临时文件创建、原子替换和文件锁探测，这是一套通用本地状态存储基础设施能力。对于一个宣称用于 Mercado Libre 类目查询和品类研究的技能，这种深入的本地存储诊断能力并非其业务目的直接要求，也未在描述中声明。- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The _post_json helper sends JSON bodies to a remote endpoint, including deviceCode during login completion, and authenticated_json_request later sends stored bearer-style credentials in request headers. The file contains no docstring, comment, or user-visible logging around these transmissions to disclose that authentication-related data is being sent over the network.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code performs an authenticated HTTP request to an external API, which may transmit user-supplied category and site parameters as well as authentication context. Although the purpose of the script is to query Mercado Libre categories, there is no explicit user-facing warning, confirmation, or disclosure in the script output or comments about the network call or use of authentication.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This Python file contains user-facing natural-language text exclusively in Chinese in the module docstring and later error messages, without indicating that language choice is configurable or limited to a justified region-specific context. Under the policy rule, forcing a specific language/locale without opt-in is a natural-language policy concern.
- Content