T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/query_projects.py:21- Finding
OAuth Client Secret Transmitted in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
Pingcode Enhanced
Security checks for vulnerabilities and agentic risk
Overview
This PingCode skill is mostly a disclosed API integration, but it handles credentials unsafely and documents a live work-item update flow without strong safeguards.
Install only with narrowly scoped PingCode credentials, preferably read-only unless you intentionally need updates. Avoid using the update command until it requires full IDs, uniqueness checks, and explicit confirmation, and rotate credentials if token-request URLs may have been logged.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/update_workitem.py:45- Finding
Ambiguous Partial Work-Item Identifier Can Modify the Wrong Record
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (31)
Tainted flow: 'cid' from os.environ.get (line 21, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python if not cid or not secret: print("❌ 请设置环境变量 PINGCODE_CLIENT_ID 和 PINGCODE_CLIENT_SECRET") sys.exit(1) r = requests.get(f'{BASE}/v1/auth/token', params={ 'grant_type': 'client_credentials', 'client_id': cid, 'client_secret': secret }) return r.json().get('access_token')
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The documented behavior does not cleanly match the declared description: it includes report generation and local file output, while the implementation coverage described by the analyzer appears narrower than the advertised feature set. This mismatch is security-relevant because users and agent orchestrators may grant trust or permissions based on an inaccurate description, leading to unexpected data processing or writes.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - `GET /v1/agile/projects/{project_id}` — 获取项目详情 - `GET /v1/agile/projects/{project_id}/members` — 获取项目成员 - `POST /v1/agile/projects/{project_id}/members` — 添加成员 - `DELETE /v1/agile/projects/{project_id}/members/{member_id}` — 移除成员 ### 工作项 (Work Items) - `GET /v1/agile/projects/{project_id}/work_items` — 获取工作项列表
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - `GET /v1/agile/projects/{project_id}/work_items` — 获取工作项列表 - `POST /v1/agile/projects/{project_id}/work_items` — 创建工作项 - `PATCH /v1/agile/work_items/{work_item_id}` — 更新工作项 - `DELETE /v1/agile/work_items/{work_item_id}` — 删除工作项 - `GET /v1/agile/work_items/types` — 工作项类型列表 - `GET /v1/agile/work_items/states` — 工作项状态列表 - `GET /v1/agile/work_items/priorities` — 工作项优先级列表
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - `POST /v1/testhub/libraries/{library_id}/members` — 添加成员 - `GET /v1/testhub/libraries/{library_id}/members` — 获取成员列表 - `PATCH /v1/testhub/libraries/{library_id}/members/{member_id}` — 更新成员 - `DELETE /v1/testhub/libraries/{library_id}/members/{member_id}` — 移除成员 - `POST /v1/testhub/libraries/{library_id}/suites` — 添加用例模块 - `PATCH /v1/testhub/libraries/{library_id}/suites/{suite_id}` — 更新用例模块 - `GET /v1/testhub/libraries/{library_id}/suites` — 获取用例模块列表
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - `POST /v1/testhub/libraries/{library_id}/suites` — 添加用例模块 - `PATCH /v1/testhub/libraries/{library_id}/suites/{suite_id}` — 更新用例模块 - `GET /v1/testhub/libraries/{library_id}/suites` — 获取用例模块列表 - `DELETE /v1/testhub/libraries/{library_id}/suites/{suite_id}` — 移除用例模块 ### 用例 (Case) - `GET /v1/testhub/cases?library_id={library_id}` — 获取用例列表
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - `GET /v1/testhub/cases?library_id={library_id}` — 获取用例列表 - `POST /v1/testhub/cases` — 创建用例 - `PATCH /v1/testhub/cases/{case_id}` — 更新用例 - `DELETE /v1/testhub/cases/{case_id}` — 删除用例 - `POST /v1/testhub/cases/batch` — 批量创建用例 - `PATCH /v1/testhub/cases/batch` — 批量更新用例
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - `GET /v1/comments?principal_type={type}&principal_id={id}` — 评论列表 - `POST /v1/comments` — 创建评论 - `DELETE /v1/comments/{comment_id}?principal_type={type}&principal_id={id}` — 删除评论 - `POST /v1/attachments` — 上传文件 - `GET /v1/followers?principal_type={type}&principal_id={id}` — 关注人列表 - `POST /v1/followers` — 添加关注人
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - `POST /v1/attachments` — 上传文件 - `GET /v1/followers?principal_type={type}&principal_id={id}` — 关注人列表 - `POST /v1/followers` — 添加关注人 - `DELETE /v1/followers/{follower_id}?principal_type={type}&principal_id={id}` — 移除关注人 - `GET /v1/relationships?principal_type={type}&principal_id={id}` — 关联列表 - `GET /v1/activities?principal_type={type}&principal_id={id}` — 活动记录 - `GET /v1/work_hours?principal_type={type}&principal_id={id}` — 工时列表
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises broad operational capabilities and references environment credentials plus commands that can write files and interact with remote APIs, but it does not declare an explicit tool scope or permission boundary. In an agent setting, this increases the chance of overbroad execution or unintended access because consumers cannot tell which tools are required or safe to grant.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs users to export a client ID and client secret but provides no guidance on secure secret handling, storage, rotation, or avoiding leakage through logs and shell history. This is dangerous because API credentials for a project-management platform can expose organizational data and permit modifications if mishandled.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill documents commands that modify live work items such as assignee, dates, priority, and status without warning that these actions affect production project data. In an autonomous or semi-autonomous agent workflow, this can cause unauthorized or accidental business-impacting changes, especially if a user assumes the skill is read-only.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation instructs clients to send the OAuth2 client_secret in the URL query string when requesting a token. Query parameters are commonly logged by proxies, servers, browser history, monitoring tools, and intermediary infrastructure, so this can expose long-lived credentials and enable full API impersonation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code's natural-language description states the skill generates a weekly report in Chinese, and the script's user-facing strings are exclusively Chinese throughout. There is no opt-in, language selection parameter, or documented justification that the skill is intentionally limited to a Chinese-only context, which creates a locale policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and all user-facing messages are written in Chinese, which effectively fixes the interaction language for users of the skill. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking context, which matches the locale-policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Natural-language strings throughout the file, including the module description, CLI help, and error/output messages, are all fixed in Chinese. There is no user opt-in, language selection flag, or documentation that this skill is intentionally limited to a Chinese-speaking context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This Python file contains user-facing docstrings, CLI help, and error/output text exclusively in Chinese, such as the module description and runtime messages. The file does not indicate that the skill is intentionally China/Chinese-specific or provide any user opt-in or language selection, which is a natural-language locale policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. The docstring, argument descriptions, and user-facing output are written only in Chinese, with no opt-in, alternative language support, or stated regional justification.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The usage text at L010 and argument help at L070 state that the tool queries recent days, and L091 reports results as if constrained to that period. However, in get_test_runs(), the computed
sincevalue at L048 is never used, and the request parameters at L050-L055 contain no time filter, so the script fetches all test runs (optionally filtered only by library). This is an active contradiction between documented intent and implemented behavior.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script prints organizational directory data including user IDs, names, email addresses, phone numbers, and job titles directly to stdout, which can expose personally identifiable information to terminal logs, shell history capture, CI logs, or unauthorized observers. In the context of an org-directory integration, broad enumeration plus detailed output increases privacy and internal reconnaissance risk even if the API itself requires valid credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python code reads sensitive environment variables and sends them in an HTTP request to obtain an access token. Although this is functionally expected for API authentication, the file provides no explicit warning in comments, docstrings, or user-facing output that credentials will be used and transmitted to a remote service.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code file contains natural-language strings that force a specific language/locale for usage instructions and interaction. Under the policy, a skill should not impose a language choice without user opt-in unless the locale restriction is clearly justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script performs a state-changing remote API call that updates a PingCode work item immediately after parsing arguments, without any interactive confirmation, dry-run safeguard, or explicit force flag. In an agent or automation context, this increases the risk of accidental or unintended modification of project-management data, especially because the script can change assignee, schedule, status, and priority using privileged API credentials from the environment.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code reads API credentials from environment variables and then uses them to call PingCode endpoints to look up projects and fetch work items. While the script's purpose implies API access, there is no explicit disclosure in code comments, help text, or runtime output that project metadata and work item contents will be sent/received over the network.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This is a code file, so SQP-2 applies to safety-relevant operations such as access to sensitive environment variables and network calls. The script reads PINGCODE_CLIENT_ID and PINGCODE_CLIENT_SECRET and transmits them in an HTTP request, but there is no explicit disclosure beyond operational usage text explaining that credentials will be used and a remote API will be contacted.
- Content