薇薇发

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:57 PM UTC
• Version: 1.0.0

Overview

This package looks like internal LLM debugging notes, but it exposes sensitive endpoints, identifiers, and a bearer token example in a way users should review before installing.

Install only after the publisher sanitizes the package: remove and rotate the exposed token, replace internal IPs and object paths with placeholders, require HTTPS for uploads, and document exactly how uploaded files/images are authorized, retained, and deleted.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: 2025.11.24-2025.11.28.txt:12
• Finding: Hard-Coded Bearer Token in API Example<![CDATA[ ## Vulnerability Details **File Location**: `2025.11.24-2025.11.28.txt`, line 12 **Vulnerability Type**: Hard-coded API credential **Risk Level**: High ### Vulnerable Code ```bash curl -X POST http://10.73.171.38:30110/largemodel/api/v2/completions -H "Content-Type: application/json" -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcGlfa2V5IjoiNjhmNTkwN2QxYTk0ODM3MTM1ZmY2OTI0IiwiZXhwIjoxNzYzNjYxNDM4LCJ0aW1lc3RhbXAiOjE3NjM2MDE0Mzh9.GEFQg_eux0esIH7HHfCIfFktokE4aY6MnWfrKSRB1b4" -d '{"prompt": "北京还有什么其它景点","history":[["北京的景点","圆明园和故宫"]],"appId":"691d8e2264c4ec7578636236","stream":false }' ``` ### Technical Analysis A complete JSON Web Token is embedded directly in a reusable API invocation. The decoded payload contains an `api_key` claim and an expiration timestamp, demonstrating that this was an authentication credential rather than a harmless example value. The embedded expiration indicates that this particular token is now expired. Therefore, current replay of this exact token should fail if expiration is correctly enforced. Nevertheless, committing an active credential exposes it to every person and system with access to the file or its version-control history. It also establishes an insecure documentation pattern that may lead to future valid credentials being committed. ### Attack Path 1. An attacker obtains the file or an earlier repository revision. 2. The attacker extracts the bearer token from the `Authorization` header. 3. While the token remains valid, the attacker submits requests to `/largemodel/api/v2/completions`. 4. The service accepts the attacker as the token's principal if signature, expiration, and authorization checks pass. 5. The attacker consumes model resources or accesses functionality permitted to the associated API key. The exact token shown is currently expired, so successful present-day exploitation would require deficient expiration enforcement or another unrotated credential copied through the sam ...[truncated 412 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the exposed API credential, even though the embedded token appears expired. 2. Remove the token from the current file and purge it from version-control history where operationally possible. 3. Replace credentials in examples with unmistakable placeholders such as `${LLM_API_TOKEN}`. 4. Load development credentials from an approved secret manager or protected environment variable. 5. Add automated secret scanning to local hooks and CI pipelines. 6. Configure short token lifetimes, minimum required scopes, audience restrictions, and server-side revocation. 7. Review API access logs for use of this token from unexpected clients or locations during its validity period. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:232
• Finding: Sensitive File Uploads Documented over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 232-234; additional occurrence at line 50 **Vulnerability Type**: Unencrypted transmission of uploaded data **Risk Level**: High ### Vulnerable Code ```text LLM 图片上传：http://188.103.147.179:30181/largemodel/llmstudio/fs/uploadImg 文件上传：http://188.103.147.179:30181/largemodel/llmstudio/fs/uploadFile csv上传：http://188.103.147.179:30181/largemodel/llmstudio/fs/uploadFile ``` An additional workflow upload endpoint is documented as: ```text 文件上传：http://188.103.147.179:30181/largemodel/llmstudio/llm-workflow-service/api/v1/workflow/sign_file_url ``` ### Technical Analysis The instructions direct clients to upload images, general files, and CSV files to raw-IP endpoints using unencrypted HTTP. HTTP does not provide transport confidentiality, message integrity, or authenticated server identity. The surrounding examples reference attendance records and other user-supplied documents, indicating that potentially sensitive data may be transmitted through these endpoints. If authorization headers, cookies, or user-identifying headers accompany the requests, those values may also be exposed. Use of a raw IP further complicates secure deployment because clients cannot reliably validate a service identity without correctly configured TLS certificates and an approved hostname. ### Attack Path 1. A user or integration follows the documented instructions and submits a file to an `http://188.103.147.179:30181` endpoint. 2. An attacker with a network position between the client and server observes the plaintext request. 3. The attacker captures the uploaded file and any unprotected authentication or identity headers. 4. Alternatively, the attacker modifies the request or response, substitutes uploaded content, or redirects the client to an attacker-controlled service. 5. The modified content may subsequently be processed by the LLM or workflow under the legitimate user's identity. ### Impac ...[truncated 392 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace all upload URLs with HTTPS endpoints using an approved DNS hostname. 2. Deploy certificates issued by a trusted internal or public certificate authority and require certificate verification. 3. Redirecting HTTP to HTTPS is insufficient for sensitive initial requests; clients should reject HTTP upload URLs entirely. 4. Protect uploads with short-lived, narrowly scoped signed URLs or authenticated API requests. 5. Avoid sending reusable credentials in plaintext headers and apply least-privilege authorization to each uploaded object. 6. Validate file type, size, extension, and content on the server before downstream processing. 7. Encrypt stored uploads and define explicit retention, deletion, and access-control policies. 8. Review whether previously transmitted attendance records or other personal files require incident-response handling. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:116
• Finding: Internal Infrastructure and User-Specific Identifiers Embedded in Skill Documentation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 116-125; related storage identifiers and internal endpoints at lines 19-31 and 68-105 **Vulnerability Type**: Sensitive internal information disclosure **Risk Level**: Medium ### Vulnerable Code ```json "agentApp": { "appId": "690d98e00b367959f1fcc8dd", "appName": "cgm_test", "debug": true, "id": "690d98e00b367959f1fcc8dd", "name": "cgm_test", "avatar": "public/avatar/1762498777498_1762498777496_1762498777487_text2Image.jpg", "desc": "cgm_test", "prolog": null, "userId": "6e35a560-0530-4b72-8b1c-672f9bb5d531", "username": "cxy_test", ``` Related object paths include: ```json "imagePaths": [ "6e35a560-0530-4b72-8b1c-672f9bb5d531/upload/1763030284427_10.30加班打卡记录.jpg", "6e35a560-0530-4b72-8b1c-672f9bb5d531/upload/1763030292138_11.04加班打卡记录.jpg" ], "filePaths": [ "6e35a560-0530-4b72-8b1c-672f9bb5d531/upload/2025.11.13-2025.11.21.txt", "6e35a560-0530-4b72-8b1c-672f9bb5d531/upload/2025.11.13-2025.11.21.txt", "6e35a560-0530-4b72-8b1c-672f9bb5d531/upload/上下班打卡_日报_20250720-20250920-30天.csv" ] ``` ### Technical Analysis The skill documentation contains real-looking internal IP addresses, service routes, application and workflow identifiers, a user UUID, a username, storage object paths, and filenames revealing the existence of employee attendance records. Identifiers are not credentials by themselves, and the reviewed files do not prove that the referenced objects are publicly retrievable. However, exposing them increases the effectiveness of reconnaissance and authorization testing. If any referenced endpoint lacks object-level authorization, the disclosed UUIDs and paths could be used to request another user's files. The filename metadata may itself disclose personal or operational information even where object contents remain protected. ### Attack Path 1. An attacker obtains the skill package or repository. 2. The attacker extra ...[truncated 1154 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace all real user, application, workflow, record, and object identifiers with synthetic examples. 2. Replace internal IP addresses and ports with reserved documentation domains or neutral placeholders. 3. Remove usernames, personal filenames, attendance references, and other production-derived metadata. 4. Enforce object-level authorization for every file lookup, download, upload, and workflow operation. 5. Do not treat UUIDs or opaque paths as authorization controls. 6. Restrict repository and artifact access according to business need. 7. Review access logs for requests targeting the disclosed object paths. 8. Add documentation sanitization and privacy review to the release process. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

External Transmission

Medium

• Category: Data Exfiltration

Content

1. 生产环境智能体api调用，给history字段输入历史记录，无法承接历史内容进行对话
        curl -X POST http://10.73.171.38:30110/largemodel/api/v2/completions -H "Content-Type: application/json" -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcGlfa2V5IjoiNjhmNTkwN2QxYTk0ODM3MTM1ZmY2OTI0IiwiZXhwIjoxNzYzNjYxNDM4LCJ0aW1lc3RhbXAiOjE3NjM2MDE0Mzh9.GEFQg_eux0esIH7HHfCIfFktokE4aY6MnWfrKSRB1b4" -d '{"prompt": "北京还有什么其它景点","history":[["北京的景点","圆明园和故宫"]],"appId":"691d8e2264c4ec7578636236","stream":false }'

    2. -- 图像生成的插件，插件返回base64格式图像时，调试的时候无法渲染

• Confidence: 97% confidence
• Finding: This is a concrete external transmission example to an internal service over HTTP using an embedded bearer token, and it includes potentially sensitive conversational history in the request body. The danger is not merely that a network call exists, but that the file operationalizes authenticated access and data submission in a way that could enable unauthorized use, token theft, and leakage of internal service topology.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The file contains a ready-to-use authenticated curl command with a live bearer token and internal endpoint details. Anyone who gains access to this text can replay the request, access the referenced service, and potentially abuse the token until it expires or is revoked; the skill context increases risk because this is framed as a production API debugging example, not a clearly sanitized sample.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The prompt explicitly instructs the system to use user-provided image or file content, but the skill definition contains no visible notice, consent flow, or handling constraints for potentially sensitive uploaded data. This increases the risk of users submitting personal, confidential, or regulated content without understanding how it will be processed, retained, or exposed through connected components.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The example question "帮忙吹牛逼" is a short, generic natural-language phrase without clear scope or activation constraints. In a plain text/config-style skill definition, this can overlap with casual user speech and does not specify when the skill should or should not be invoked.

Session Persistence

Medium

• Category: Rogue Agent

Content

}
    ],
    "plugList": [],
    "mcpList": [
        "68f1ec87897276532ef56008",
        "68b6b37cff6d755e0ff31fd1"
    ],

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

}
    ],
    "plugList": [],
    "mcpList": [
        "68f1ec87897276532ef56008",
        "68b6b37cff6d755e0ff31fd1"
    ],

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

}
    ],
    "plugList": [],
    "mcpList": [
        "68f1ec87897276532ef56008",
        "68b6b37cff6d755e0ff31fd1"
    ],

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

}
    ],
    "plugList": [],
    "mcpList": [
        "68f1ec87897276532ef56008",
        "68b6b37cff6d755e0ff31fd1"
    ],

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The invocation examples are open-ended natural-language requests that can trigger multiple skills without clear boundaries, constraints, or exclusions. In a chained weather-to-flight workflow, this increases the chance of over-broad activation, unintended cross-skill execution, and ambiguous handling of user intent, which can cause the wrong tool to run or more data to be processed than necessary.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The file is an extremely sparse design note with broad phrases such as 'LLM login not using Keycloak' and 'external call to mcp' but no activation boundaries, authorization model, or safety constraints. In a security-sensitive skill or agent context, this ambiguity is dangerous because implementers may default to insecure behavior, especially around authentication bypass and uncontrolled external connectivity.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: This plain text file lists behavior requirements and fixes, but it does not define any specific trigger phrases, activation conditions, or exclusion cases for when the skill should or should not apply. In plain text skill documentation, the absence of explicit trigger scope can lead to unintended invocation because the operational boundaries are unclear.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document contains concrete internal upload endpoints, file/image handling parameters, and examples of user content being transmitted, but does not include any warning about retention, access control, or privacy implications. Because the skill explicitly discusses uncertainty about how long files/images are stored and shows remotely accessible paths, users could be led to upload sensitive content without understanding exposure or persistence risks.

Vague Triggers

Low

• Confidence: 79% confidence
• Finding: This .txt file is in scope for vague-trigger review, and L01 contains only a raw link with no context, purpose, or activation constraints. In a skill-related artifact, an unlabeled link can act as an overly broad invocation cue because readers cannot tell what action or context it applies to, nor what should not trigger its use.

Static analysis

No suspicious patterns detected.