T09 · Insecure Skill Coding Practices
Error
- Location
test_connection.py:29- Finding
Hard-Coded API Credentials Used for Authenticated Account Operations
- Content
View full analysis
- Remediation
View remediation
Security audit
Ima Knowledge Base
Security checks for vulnerabilities and agentic risk
Overview
The skill is related to Tencent IMA knowledge-base access, but it handles live account credentials unsafely and includes tests that can write to an account without clear safeguards.
Install only if you are comfortable giving this skill access equivalent to your active IMA session. Use a test account or limited credentials, avoid passing cookies in shell commands, do not store session cookies in plaintext, rotate any exposed API keys, and do not run endpoint write tests against important knowledge bases without reviewing the exact requests first.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
test_cookie.py:156- Finding
IMA Session Cookies Persisted in Plaintext Without Enforced Owner-Only Permissions
- Content
View full analysis
bool: """保存Cookie到.env""" if not self.ENV_FILE.exists(): self.ENV_FILE.parent.mkdir(parents=True, exist_ok=True) self.ENV_FILE.write_text('') content = self.ENV_FILE.read_text() if 'IMA_COOKIE=' in content: content = re.sub(r'IMA_COOKIE=["\'].*?["\']', f'IMA_COOKIE="{self.cookie_str}"', content) else: content += f'\nIMA_COOKIE="{self.cookie_str}"\n' self.ENV_FILE.write_text(content) print(f"\n💾 Cookie已保存到: {self.ENV_FILE}") return True ``` The Playwright helper performs equivalent plaintext storage: ```python if self.ENV_FILE.exists(): with open(self.ENV_FILE, 'r') as f: env_content = f.read() # ... with open(self.ENV_FILE, 'w') as f: f.write(env_content) ``` ### Technical Analysis A reusable browser session cookie is written to `~/.hermes/.env` in plaintext. Neither implementation explicitly creates the file with mode `0600` nor verifies and repairs the permissions of an existing file. Actual default permissions depend on the user's umask and pre-existing file state. A permissive umask or an already over-permissive `.env` file can expose the cookie to other local users, processes, backup systems, or log and file-indexing services. The cookie is particularly sensitive because it contains `IMA-TOKEN` and is used as the authentication material for private `/cgi-bin/` operations. Persistent storage is convenient but is not strictly necessary for one-time validation and therefore exceeds the minimum privilege and retention needed for that operation. ### Attack Path 1. A user validates or automatically captures an IMA cookie. 2. The script writes the complete cookie to `~/.hermes/.env`. ...[truncated 834 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
test_cookie.py:211- Finding
Session Cookies Accepted Through Command-Line Arguments
- Content
View full analysis
1: cookie = sys.argv[1] ``` The documented invocation pattern is: ```bash python test_cookie.py "你的_Cookie" python test_endpoints.py "你的_Cookie" ``` ### Technical Analysis The scripts and primary Skill documentation encourage users to place the complete browser session cookie directly in a command-line argument. Command-line secrets can be retained in shell history and may be visible in process inspection interfaces while the process is running. They may also be captured by terminal telemetry, command auditing, wrapper scripts, orchestration systems, or support transcripts. This exposure is unnecessary because the scripts already support environment-based loading and could safely accept the secret through protected standard input or a credential manager. ### Attack Path 1. The user follows the documented example and invokes a script with the complete cookie as an argument. 2. The shell records the command or the operating system exposes the process argument list. 3. A local observer, monitoring agent, support collector, or later shell-history reader obtains the cookie. 4. The observer replays the cookie against IMA's authenticated `/cgi-bin/` endpoints. 5. The observer receives the access associated with the user's browser session. ### Impact Assessment A recovered session cookie may permit access to private knowledge-base names and identifiers, searches, note content, and account modification endpoints. The exposure requires access to process metadata, command logs, or shell history, but no further credential cracking is required once the full cookie is recover ...[truncated 7 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
test_endpoints.py:49- Finding
Endpoint Availability Test Performs Unconfirmed Persistent Account Writes
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
get_ima_cookie_playwright.py:113- Finding
Browser Helper Collects and Logs More Cookie Data Than Required
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
test_knowledge_base.py:97- Finding
Private Knowledge-Base API Responses Are Dumped to Standard Output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (42)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The example reads a session cookie from
~/.hermes/.env, normalizing storage of a highly privileged browser credential in a plain local file. Plaintext env files are often world-readable through weak permissions, backups, shell tooling, accidental commits, or other local compromise, making credential theft significantly easier.- Content
md import json # 读取 Cookie with open(Path.home() / '.hermes' / '.env') as f: content = f.read() cookie = re.search(r'IMA_COOKIE=["\'](.+?)["\']', content).group(1)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description claims a comprehensive IMA knowledge-base integration with multiple authentication modes and a wide set of management and content features. The supplied code is much narrower: it is a cookie acquisition/testing helper script. It guides the user to manually retrieve browser cookies, checks whether the cookie string contains IMA-TOKEN, calls a single endpoint to retrieve home page/knowledge-base data, and parses/display lists of personal/followed/public knowledge bases. There is no OpenAPI auth flow, no CRUD for notes, no folder manipulation, no RAG Q&A, and no broader knowledge-base or subscription management interface. This is a material mismatch in both primary purpose and implemented capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code only covers a narrow subset of the declared functionality. It authenticates via OpenAPI headers using client_id and api_key; there is no Cookie auth path. Implemented endpoints are limited to note import/create, get content, and append content, with two convenience helpers that format note content before calling create_note. There are no APIs for deleting or updating notes (beyond append), no knowledge base administration features, no RAG/QA, no folder manipulation, and no subscription management. The primary domain is still Tencent IMA knowledge-base-related note handling, so this is not unrelated behavior, but the description materially overstates the implemented scope.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description presents a production-style IMA knowledge-base skill with broad operational support across multiple feature areas and authentication modes. In contrast, the code chunk is specifically a batch testing utility for known /cgi-bin/ endpoints. It uses hardcoded sample payloads, checks HTTP/JSON responses, prints availability status, and writes a report file. While some tested endpoints correspond to declared areas such as notes, knowledge bases, folders, and Q&A, the code does not implement the claimed complete interface wrapper, does not support OpenAPI auth, and does not include subscription knowledge-base management. The primary purpose is materially different: endpoint validation rather than providing the described end-user/API skill functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description significantly overstates the functionality. The supplied code chunk is a simple diagnostic/testing script for one Cookie-authenticated endpoint that retrieves home page knowledge base data. It does not expose or implement the broad set of features claimed in the description, such as full interface coverage, dual authentication modes, CRUD operations, RAG, or folder/subscription management actions. While it is related to Tencent IMA knowledge bases, its actual purpose is much narrower and read-only, so the description does not accurately represent the behavior of this code chunk.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The skill explicitly tells users to store a live session cookie in a plaintext local .env file. Session cookies are bearer tokens; if that file is read by other tools, exposed in backups, logs, shell history, or accidentally committed, an attacker may gain direct access to the linked IMA account.
- Content
bash # 或者手动添加 echo 'IMA_COOKIE="你的_Cookie"' >> ~/.hermes/.env使用方法
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The sample code programmatically reads the cookie from ~/.hermes/.env and injects it into request headers, establishing a direct credential-access path from local storage to outbound authenticated requests. In an agent context, reading secrets from a common env file is more dangerous because unrelated workflows or tools may gain access to that file and reuse the session token.
- Content
md from pathlib import Path # 读取 Cookie env_file = Path.home() / ".hermes" / ".env" content = env_file.read_text() cookie = re.search(r'IMA_COOKIE=["\'](.+?)["\']', content).group(1)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 87% confidence
- Finding
The documentation states that harvested cookies will be automatically saved to ~/.hermes/.env, normalizing the handling of active authentication material as a local file secret. In the context of a skill whose purpose is to access a user's IMA account, this increases practical danger because it encourages users to export browser session credentials outside the browser's protection boundary.
- Content
python 使用方法： python get_ima_cookie_playwright.py Cookie获取后会自动保存到 ~/.hermes/.env """ import asyncio
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Hardcoding the secret destination as Path.home() / '.hermes' / '.env' creates a predictable plaintext location for sensitive authentication data. Predictable storage locations make credential discovery easier for local attackers, malware, misconfigured tooling, or accidental commits and sync processes, especially when the script does not enforce secure filesystem permissions.
- Content
python """IMA Cookie 获取器""" IMA_URL = "https://ima.qq.com" ENV_FILE = Path.home() / ".hermes" / ".env" def __init__(self): self.cookie_str = None
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script extracts and stores the user's full authenticated cookie jar, including IMA-TOKEN, specifically so it can be replayed by later scripts. Full session-cookie reuse is equivalent to credential reuse in many web apps; anyone who obtains the saved value may be able to impersonate the user and access their knowledge base, notes, subscriptions, or other account data until the session expires or is revoked.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script falls back to hardcoded
client_idandapi_keyvalues when no config file is present, which exposes live-looking credentials in source code and encourages accidental use of shared secrets. If these credentials are valid, anyone with code access can authenticate to the remote IMA service and access or modify knowledge-base data without the operator realizing they are using embedded secrets.- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ## Cookie 格式示例 IMA-TOKEN=eyJhbGc...;其他参数=xxx;... ## 验证成功后，Cookie会自动保存到 ~/.hermes/.env """ import requests
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Defining a fixed path for storing and later loading credentials from ~/.hermes/.env encourages use of a predictable plaintext secret store for a browser session cookie. This makes credential theft easier for local malware, other users on a shared system, or accidental leakage through logs, backups, and repository operations.
- Content
python """IMA Cookie 验证器""" BASE_URL = "https://ima.qq.com" ENV_FILE = Path.home() / ".hermes" / ".env" def __init__(self, cookie_str: str = None): self.cookie_str = cookie_str or self.load_from_env()
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Reading credentials from ~/.hermes/.env is credential-access behavior because the script harvests a session cookie from a local secret store and then uses it for authenticated requests. In the context of a knowledge-base skill, this is more dangerous than ordinary configuration loading because the cookie may belong to a real user account and enables access to private remote data and write actions.
- Content
python """IMA 端点测试器""" BASE_URL = "https://ima.qq.com" ENV_FILE = Path.home() / ".hermes" / ".env" # 已知的 /cgi-bin/ 端点 ENDPOINTS = [
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The endpoint list includes state-changing operations such as save_note and create_folder, and run_all_tests executes them automatically as part of bulk testing. Running this script can therefore create or modify remote user data without explicit acknowledgement, which is especially risky because it uses real authenticated cookies.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide explicitly instructs users to extract live browser authentication cookies and persist them in a local env file, but does not warn that these cookies are bearer credentials that may grant full account access. In the context of a knowledge-base skill with write and subscription capabilities, theft or mishandling of the cookie could enable unauthorized reading, modification, or takeover-like access to the user's IMA data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation shows authenticated requests that send the user's raw cookie to remote
/cgi-bin/endpoints without any privacy or credential-handling warning. Because the cookie is inserted directly into custom headers and the documented endpoints support broad knowledge-base operations, users may unknowingly expose a highly privileged session token during testing, logging, screen sharing, or reuse in unsafe scripts.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill documents capabilities that read environment files, write secrets to disk, and make outbound network requests, but it does not declare any explicit tool scope or permissions boundary. That makes the trust model unclear and increases the risk that a host agent executes sensitive file, env, or network actions without informed approval.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation instructs users to capture browser session cookies and persist them locally, but it does not prominently warn that these cookies are bearer credentials that may grant account access if copied, logged, or reused. In this context, the skill targets a real user account and encourages manual credential extraction, which materially increases account-compromise risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md } # 1. 获取知识库列表 resp = requests.post( 'https://ima.qq.com/cgi-bin/knowledge_tab_reader/get_home_page_data', headers=headers, json={"knowledge_base_id": "", "need_folder_number": True}
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md } # 1. 获取知识库列表 resp = requests.post( 'https://ima.qq.com/cgi-bin/knowledge_tab_reader/get_home_page_data', headers=headers, json={"knowledge_base_id": "", "need_folder_number": True}
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md } # 1. 获取知识库列表 resp = requests.post( 'https://ima.qq.com/cgi-bin/knowledge_tab_reader/get_home_page_data', headers=headers, json={"knowledge_base_id": "", "need_folder_number": True}
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md } # 1. 获取知识库列表 resp = requests.post( 'https://ima.qq.com/cgi-bin/knowledge_tab_reader/get_home_page_data', headers=headers, json={"knowledge_base_id": "", "need_folder_number": True}
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md } # 1. 获取知识库列表 resp = requests.post( 'https://ima.qq.com/cgi-bin/knowledge_tab_reader/get_home_page_data', headers=headers, json={"knowledge_base_id": "", "need_folder_number": True}
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md } # 1. 获取知识库列表 resp = requests.post( 'https://ima.qq.com/cgi-bin/knowledge_tab_reader/get_home_page_data', headers=headers, json={"knowledge_base_id": "", "need_folder_number": True}