T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/geekbi_auth.py:45- Finding
Bearer Tokens Are Unnecessarily Mirrored Across Multiple Local Directories
- Content
View full analysis
- Remediation
View remediation
Security audit
极鲸云Shopee类目搜索
Security checks for vulnerabilities and agentic risk
Overview
The skill performs the advertised Shopee research, but it under-discloses sensitive GeekBI login-token storage and permits unvalidated alternate API origins.
Review before installing. Use this only if you are comfortable sending Shopee research queries to GeekBI and storing GeekBI login state locally. Avoid using --base-url unless it is a trusted HTTPS GeekBI endpoint, and do not run the skill from shared or archived workspaces unless token files under .geekbi are managed or removed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/geekbi_auth.py:698- Finding
Caller-Controlled Base URLs Can Redirect Authentication Traffic to Untrusted or Plaintext Origins
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation really performs authentication-state storage, token handling, and login challenge flows beyond the declared category-research purpose, users and reviewers are misled about sensitive behaviors. Undisclosed auth and local state management expand the attack surface and can expose credentials or tokens to misuse, especially when not clearly disclosed or permission-scoped.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the implementation really performs authentication-state storage, token handling, and login challenge flows beyond the declared category-research purpose, users and reviewers are misled about sensitive behaviors. Undisclosed auth and local state management expand the attack surface and can expose credentials or tokens to misuse, especially when not clearly disclosed or permission-scoped.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the implementation really performs authentication-state storage, token handling, and login challenge flows beyond the declared category-research purpose, users and reviewers are misled about sensitive behaviors. Undisclosed auth and local state management expand the attack surface and can expose credentials or tokens to misuse, especially when not clearly disclosed or permission-scoped.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the implementation really performs authentication-state storage, token handling, and login challenge flows beyond the declared category-research purpose, users and reviewers are misled about sensitive behaviors. Undisclosed auth and local state management expand the attack surface and can expose credentials or tokens to misuse, especially when not clearly disclosed or permission-scoped.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation really performs authentication-state storage, token handling, and login challenge flows beyond the declared category-research purpose, users and reviewers are misled about sensitive behaviors. Undisclosed auth and local state management expand the attack surface and can expose credentials or tokens to misuse, especially when not clearly disclosed or permission-scoped.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill invokes local scripts and external references implying shell, file-read, and likely network capabilities, but it does not declare any tool/permission scope. This creates an overbroad execution surface where a caller or runtime may grant more access than users expect, reducing containment if a script is modified or abused.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file is a markdown skill description, so natural-language policy checks apply. Line L31 specifies a default output format in Chinese-context wording without indicating the user may choose another language, which can violate language/locale choice expectations when no opt-in is provided.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This Python file embeds user-facing natural-language descriptions and messages entirely in Chinese, starting with the module docstring. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation, and there is no indication anywhere in this file that users can choose another language or locale.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
该文件实现了完整的本地登录状态持久化机制，在用户配置目录、技能目录和当前工作目录之间解析并镜像认证状态，而技能清单描述只强调基于极鲸云数据进行 Shopee 类目查询与研究，没有说明会在本地文件系统中维护和复制认证状态。网络认证本身可视为实现细节，但将令牌状态跨多个位置持久化属于额外行为，会影响用户对技能实际操作范围的理解。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file's docstring, CLI description, argument validation errors, and runtime messages are all hard-coded in Chinese, indicating the skill enforces a specific language for user-facing interaction. There is no user opt-in, language selection mechanism, or documentation in this file justifying a Chinese-only locale constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The module docstring, CLI description, argument help text, and error messages are all written in Chinese, which imposes a specific language on users. There is no indication that the tool is intended only for a Chinese-speaking environment or that users can opt into another language, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The display name, short description, and default prompt are all written exclusively in Chinese, which can constitute a language/locale policy issue when no user choice or opt-in is provided. The file does not indicate that the skill is region-specific or that users can select another language.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
clear_auth_state 会直接删除各存储位置中的认证状态文件，这属于对本地状态的修改性管理能力。技能描述强调查询 Shopee 类目、父链、可信类目 ID 和样本分析，没有体现存在本地状态管理或删除功能，因此行为范围与描述不完全一致。
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script sends user-supplied search parameters to an authenticated external API endpoint without any explicit user-facing notice at execution time. While this is expected for the skill’s functionality, it still creates a real privacy and data-handling risk because users may provide commercially sensitive keywords, category IDs, or research inputs without understanding they are transmitted off-host to a third-party service.
- Content