T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mercadolibre_goods_search.py:63- Finding
Unrestricted API Base URL Permits Credential Relay and Arbitrary Network Requests
- Content
View full analysis
- Remediation
View remediation
Security audit
极鲸云美客多数据分析与市场调研
Security checks for vulnerabilities and agentic risk
Overview
The skill does Mercado Libre research as advertised, but it should be reviewed because its login token handling and configurable API host are broader than users are clearly told.
Install only if you are comfortable signing in to GeekBI and treating .geekbi/agent-auth.json as sensitive. Do not use custom --base-url values unless you fully trust the destination, and avoid running the skill from shared, synced, or repository workspaces until token storage is limited to one secure per-user location.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/geekbi_auth.py:64- Finding
Bearer Tokens Are Mirrored into Multiple Local Directories
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose is Mercado Libre data research, but the analyzed behavior includes login/authentication flows, token persistence, local filesystem state management, and token refresh/cleanup. Hidden auth handling is security-relevant because it introduces credential storage and local state mutation that users are not informed about, creating opportunities for secret leakage, token misuse, or persistence beyond the intended session.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose is Mercado Libre data research, but the analyzed behavior includes login/authentication flows, token persistence, local filesystem state management, and token refresh/cleanup. Hidden auth handling is security-relevant because it introduces credential storage and local state mutation that users are not informed about, creating opportunities for secret leakage, token misuse, or persistence beyond the intended session.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose is Mercado Libre data research, but the analyzed behavior includes login/authentication flows, token persistence, local filesystem state management, and token refresh/cleanup. Hidden auth handling is security-relevant because it introduces credential storage and local state mutation that users are not informed about, creating opportunities for secret leakage, token misuse, or persistence beyond the intended session.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README presents the skill name, purpose, installation, and limitations entirely in Chinese. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy violation because users are not offered a language or locale choice.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill advertises executable capabilities with file, network, and shell access but does not declare any explicit tool scope or permission boundaries. That creates an authorization ambiguity where the runtime may grant broader access than users or reviewers expect, increasing the risk of unintended command execution, data access, or network calls.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill metadata and instructions are entirely written in Chinese and present the skill as operating in Chinese by default, with no indication that users may choose another language or locale. This can violate a language/locale policy when a skill implicitly mandates a specific language without opt-in or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown skill uses Chinese throughout and does not indicate that the language is optional, user-selectable, or required for a justified region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file presents all instructions and output requirements exclusively in Chinese. Under the policy, forcing a specific language without offering the user a language or locale choice can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This Python file contains natural-language descriptions and user-facing error/action messages in Chinese, beginning with the module docstring and repeated throughout the file. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The auth state path is created under a different skill namespace (
temu-research-skill) than the declared Mercado Libre skill. This can cause credential/state confusion across skills, leading to unintended token sharing, state collision, or one skill reading or overwriting another skill's login state if both run in the same user environment.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring and all user-facing error messages are written in Chinese, which imposes a specific language on users. Under the policy, locale or language restrictions should either offer user choice or be clearly documented as a justified region-specific constraint, which is not present in this file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring is entirely in Chinese and the command description/help text throughout the file is also Chinese-only, indicating the skill is designed to operate in a fixed language. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The display name and descriptions are written in Chinese while hard-coding the Spanish marketplace name 'Mercado Libre', but the file provides no user-facing indication of language/locale selection or justification for this mixed locale presentation. This can create a mild language/locale policy concern because the skill appears to impose a specific locale context without explicit opt-in or explanation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The file’s natural-language instructions are entirely in Chinese and do not indicate that the user can choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy issue unless the locale constraint is justified or optional.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file contains user-facing instructions entirely in Chinese, and there is no indication that the skill supports language selection or that it is intentionally limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring and argument descriptions are written only in Chinese, and the script emits Chinese-language error messages, which imposes a specific language on users without offering a locale choice. The policy allows locale constraints when explicitly justified, but this file does not document any region- or language-specific requirement.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This code sends user-supplied search parameters to a remote Mercado Libre AI search API via
authenticated_json_request. Although the module docstring says it calls the API, there is no explicit user-facing warning, confirmation, or runtime disclosure that the provided query data will be transmitted over the network.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring and user-facing argparse descriptions are entirely in Chinese, which imposes a specific language on users rather than offering a choice. Under the policy, forcing a language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content