T03 · Remote Payload Retrieval and Execution
Error
- Location
references/02_开发指南.md:85512- Finding
Unauthenticated Remote Update Can Overwrite Application and Runtime Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Foxtable 开发文档（上）
Security checks for vulnerabilities and agentic risk
Overview
This is a documentation-only Foxtable skill, but it includes copy-ready examples for silent remote updates, plaintext HTTP/FTP credentials, and exposed web services without enough security safeguards.
Install only if you specifically need Foxtable documentation, and treat network, update, SMS, FTP, and Excel automation examples as legacy patterns to review before use. Do not copy the flagged snippets into real projects without HTTPS/TLS, protected secret storage, package signing or hash verification, explicit update approval, authentication, least-privilege access, logging, backups, and rollback controls.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
references/02_开发指南.md:84650- Finding
SMS API Credentials and Sensitive Request Data Are Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/08_发布项目.md:260- Finding
Remote Update Credentials Are Embedded in a Plaintext FTP URL
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/00_关于Foxtable.md:1057- Finding
Example HTTP Server Binds to All Network Interfaces without Authentication or TLS
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - [开发指南](references/02_开发指南.md)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation provides sample code to start an HTTP server bound to http://*/, which exposes the service on all interfaces without any mention of access controls, TLS, or network restrictions. In a developer skill, this materially increases the chance that users deploy an internet-reachable server insecurely, enabling unauthorized access, data exposure, or abuse of hosted functionality.
- Content
Ae5
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Instruction-capable artifact exceeds whole-file semantic analysis limits
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The FTP example embeds a username and password directly in the update URL and uses FTP, which does not provide secure transport. This exposes credentials in configuration, logs, screenshots, and network traffic, and also allows an attacker to intercept or modify update packages, compromising both secrets and software integrity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This is a markdown file, so missing user-facing warnings about behaviors affecting privacy or user data should be flagged. The text states the product can send/receive SMS, collect/query remote data, and return results to phones, but provides no caution about exposing sensitive data over messaging channels or possible SMS-related implications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file describes integrating WeChat into management systems for data entry, querying, statistics, and approvals, which can affect sensitive business data and workflows. There is no accompanying warning about verifying user identity, limiting shared data, or protecting approvals and messages in third-party channels.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation describes an auto-update mechanism that downloads remote ZIP packages and automatically extracts and overwrites local program files, but it does not mention any integrity protection such as signed updates, authenticated transport, or hash verification. If an attacker can tamper with the update source, network path, or hosted files, they could deliver arbitrary code that will be installed during update, turning the updater into a remote code execution path.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The example explicitly recommends a fully silent update flow that suppresses prompts and automatically starts upgrade operations in the background. In the context of an updater that replaces local files, silent execution increases the chance of unnoticed malicious or accidental changes, reduces user awareness, and makes abuse harder to detect or interrupt.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file documents destructive commands such as deleting tables, rows, columns, and especially forceful project exit without saving, but does not include any user-facing caution in the surrounding documentation. In markdown, omission of warnings for destructive behaviors can leave users unaware of data-loss risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file lists import/export operations such as exporting to text/XML/Access/Excel and merging/importing data, but provides no warning about potential overwrites, data leakage, or irreversible data movement. For markdown files, descriptions of behaviors that affect user data or system integrity should disclose those risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The example explicitly disables Excel safety prompts with
App.DisplayAlerts = Falseimmediately before merging cells, normalizing suppression of interactive warnings without emphasizing the consequences. In an agent-assistance context, this can encourage automation patterns that hide destructive or state-changing operations from users and can be adapted to more harmful workbook actions.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The entire skill content is presented only in Chinese, with no indication that users may choose another language or that the locale restriction is intentional and justified. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy issue.
- Content