T09 · Insecure Skill Coding Practices
Error
- Location
references/02_开发指南.md:84653- Finding
SMS API credential sent over unencrypted HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
狐表(Foxtable) 开发文档
Security checks for vulnerabilities and agentic risk
Overview
This is a documentation-only Foxtable skill, but it includes unsafe examples for silent remote updating and plaintext credentials that warrant review before use.
Install only if you specifically need the Foxtable documentation. Treat network, credential, and updater examples as legacy or unsafe patterns: use HTTPS/SFTP, placeholders or secret storage instead of hardcoded credentials, signed update manifests/packages, user/admin control, logging, and rollback before implementing anything based on these docs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/02_开发指南.md:82887- Finding
Plaintext FTP credentials embedded in URLs and source examples
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/08_发布项目.md:102- Finding
Silent remote updater overwrites application files without documented authenticity verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - [开发指南](references/02_开发指南.md)
Ae5
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Instruction-capable artifact exceeds whole-file semantic analysis limits
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The activation terms include broad single-word/product-word matches, which can cause the skill to load in conversations where the user did not explicitly request this documentation. Unintended invocation can crowd out more relevant skills, leak internal documentation context into unrelated chats, or increase exposure to prompt-surface abuse if the skill is auto-included frequently.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Many read_when phrases are broad topic matches such as generic Foxtable concepts and adjacent themes like AI, LLM, mobile, and WeChat, which substantially increases accidental activation. Because this skill is a large documentation bundle, overbroad triggering expands the model's active context unnecessarily and may influence answers outside the user's actual intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document describes an update mechanism that downloads remote ZIP packages, automatically extracts them, and overwrites local application files. Without strong guarantees such as authenticated update metadata, signed packages, transport integrity, rollback protection, and explicit trust checks, this creates a software supply-chain risk that could enable remote code execution or full application compromise if the update source is tampered with.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The guide explicitly recommends fully silent updating that can start automatically and replace installed files without prompting the user. Silent self-updating increases the danger of a compromised update path because users and administrators receive no warning, reducing detection opportunities and making unauthorized code deployment more stealthy.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file describes export/import operations such as exporting tables to text/XML/Access/Excel and merging external files, but it does not include any warning about potential overwrites, data leakage, or integrity risks. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data, privacy, or system integrity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The appendix lists project exit commands including forced exit without saving data, which could directly cause data loss, but provides no warning or cautionary text. In markdown documentation, omission of warnings for behaviors that can affect user data or system integrity meets the SQP-2 criteria.
- Content