Ai Intelligence Site

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:54 AM UTC
• Version: 1.0.0

Overview

The skill is mostly aligned with its stated site-update purpose, but it embeds an API key and can automatically publish broad local changes to GitHub, so it needs careful review before use.

Use this only in a dedicated repository with limited Git credentials. Remove and rotate the embedded Serper key, require SERPER_API_KEY from a protected secret store, add a dry-run or confirmation step before publishing, and replace git add . with an explicit allowlist of generated data files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/daily_update.py:19

Finding

Hard-Coded Serper API Credential

Content

View full analysis

Vulnerability Details

File Location: scripts/daily_update.py:19
Vulnerability Type: Hard-coded secret
Risk Level: High

python

SERPER_API_KEY = os.environ.get('SERPER_API_KEY', '374959ea28cae888d8049ea2e34d8acc156c602b')

Technical Analysis

The script embeds a Serper API key as the default value used when SERPER_API_KEY is not present in the environment. Anyone who can download, clone, inspect, or otherwise access the Skill package can recover this credential without authentication.

The credential is subsequently placed in the X-API-KEY HTTP header and transmitted to the expected Serper endpoint. Although no transmission to an unrelated endpoint was identified, embedding a live credential in distributed source code removes effective control over who may use it.

Attack Path

1. An attacker obtains a copy of the Skill package or its source repository.
2. The attacker reads scripts/daily_update.py and extracts the fallback API key from line 19.
3. The attacker submits requests directly to the Serper API using the exposed key.
4. Requests consume the credential owner's quota and may continue until the key is revoked or restricted.

Impact Assessment

Exploitation grants unauthorized use of the Serper account privileges associated with the exposed key. Potential consequences include API quota exhaustion, unexpected charges where billing applies, disruption of legitimate updates, and loss of attribution between legitimate and unauthorized requests.

This finding does not grant local operating-system privileges or GitHub access by itself. Its scope is limited to the permissions and usage limits assigned to the exposed Serper credential.

Remediation

View remediation

Remediation Suggestions

1. Revoke and rotate the exposed API key immediately.
2. Remove the fallback credential and require the key to be supplied through a protected environment variable:

   python

   SERPER_API_KEY = os.environ.get("SERPER_API_KEY")
   if not SERPER_API_KEY:
       raise RuntimeError("SERPER_API_KEY is required")
   

3. Store the replacement key in a CI/CD secret store or operating-system secret manager rather than in source files.
4. Restrict the key by API scope, quota, origin, or account policy where supported.
5. Scan repository history and distributed artifacts for prior copies of the credential.
6. Add automated secret scanning and pre-commit checks to prevent future credential commits.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/daily_update.py:282

Finding

Overbroad Git Staging Followed by Automatic Remote Push

Content

View full analysis

Vulnerability Details

File Location: scripts/daily_update.py:282-284
Vulnerability Type: Unrestricted file staging and publication
Risk Level: Medium

python

subprocess.run(['git', 'add', '.'], check=True)
subprocess.run(['git', 'commit', '-m', f'data: 每日全量更新 {date_str}'], check=True)
subprocess.run(['git', 'push'], check=True)

Technical Analysis

The script changes its working directory to SITE_DIR, which resolves to the directory containing daily_update.py, and then runs git add .. This stages every changed or untracked file under that directory that is not excluded by Git ignore rules. It does not restrict staging to the JSON files generated by the update process.

The script then creates a commit and pushes it through the repository's configured Git remote without reviewing the staged file list. Consequently, unrelated sensitive or attacker-controlled files located under scripts/ can be included in the remote repository.

The subprocess calls use argument arrays rather than a shell, so no command-injection issue is present in this code. The vulnerability is the overly broad file-selection policy combined with unattended publication.

Attack Path

1. A sensitive file, local configuration file, credential file, debugging artifact, or attacker-controlled file is created or modified beneath the scripts/ directory.
2. The scheduled or manually invoked update script detects repository changes.
3. git add . stages the unrelated file along with legitimate changes.
4. The script creates a commit without validating the staged paths.
5. git push publishes the file to the configured remote repository.
6. Anyone with access to that remote may retrieve the exposed content; if the repository is public, exposure may be unrestricted.

Impact Assessment

Exploitation can disclose any readable changed or untracked file beneath the staging scope, subject to Git ignore rules and the perm ...[truncated 521 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace git add . with an explicit allowlist of files that the update process is authorized to publish.
2. Resolve and validate every output path before staging it, ensuring it belongs to the intended repository and expected data-file set.
3. Inspect the staged file list with git diff --cached --name-only and abort if it contains an unexpected path.
4. Maintain a restrictive .gitignore for credentials, local environment files, logs, temporary files, and generated debugging artifacts.
5. Run the update under a dedicated account with Git credentials limited to the single required repository.
6. Consider separating data generation from publication and requiring CI validation or approval before pushing.
7. Add secret scanning to the remote repository so accidental credential staging blocks the push.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tainted flow: 'req' from os.environ.get (line 91, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/daily_update.py (reported line 99)May include surrounding context.

python

"Content-Type": "application/json"
            }
        )
        with urllib.request.urlopen(req, timeout=15) as resp:
            return json.loads(resp.read())
    except Exception as e:
        print(f"  搜索失败: {e}")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill describes capabilities that can read environment variables, write files, access the network, and execute shell commands, but it does not declare any explicit tool restrictions or permission boundaries. In a skill that also performs repository updates and deployment actions, this creates an overbroad execution surface where an agent may use powerful tools implicitly, increasing the chance of unauthorized data access, destructive file changes, or unintended remote actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly documents a workflow that deletes old data, regenerates site content, and pushes changes to GitHub, but it does not warn users about destructive side effects or require acknowledgment before executing them. In this context, the combination of deletion and remote publishing can cause irreversible data loss, repository corruption, or unintended public deployment if triggered accidentally or with stale configuration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad and map to common terms like 'AI情报中心' and '更新情报站', which can cause the skill to activate in contexts where the user did not intend deployment or data-refresh behavior. Because the skill includes destructive update and publish flows, ambiguous activation increases the risk of accidental execution of network, file, or repository-modifying actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstring says the update uses real data sources and explicitly '不使用模拟数据'. However, the code later generates trafficTrend values by multiplying the current traffic by fixed percentages, which is synthetic historical data rather than retrieved real measurements. This is an active contradiction between the file documentation and implemented behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and all user-facing messages are written in Chinese, which imposes a specific language on users without any opt-in or stated regional limitation. This matches the policy concern for language or locale restrictions that are not optional or justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script embeds a default Serper API key directly in source code and automatically uses it for outbound requests. Hardcoded secrets are easily exposed through source distribution, logs, backups, or forks, enabling unauthorized API usage, quota exhaustion, billing abuse, and potential account compromise if the key remains valid.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/daily_update.py (reported line 280)May include surrounding context.

python

"""提交并推送"""
    os.chdir(SITE_DIR)
    
    result = subprocess.run(['git', 'status', '--porcelain'], capture_output=True, text=True)
    if not result.stdout.strip():
        print("\n📝 无变更")
        return False

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/daily_update.py (reported line 286)May include surrounding context.

python

return False
    
    date_str = datetime.now().strftime("%Y-%m-%d")
    subprocess.run(['git', 'add', '.'], check=True)
    subprocess.run(['git', 'commit', '-m', f'data: 每日全量更新 {date_str}'], check=True)
    subprocess.run(['git', 'push'], check=True)
    print("\n🚀 已推送到 GitHub")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/daily_update.py (reported line 287)May include surrounding context.

python

date_str = datetime.now().strftime("%Y-%m-%d")
    subprocess.run(['git', 'add', '.'], check=True)
    subprocess.run(['git', 'commit', '-m', f'data: 每日全量更新 {date_str}'], check=True)
    subprocess.run(['git', 'push'], check=True)
    print("\n🚀 已推送到 GitHub")
    return True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/daily_update.py (reported line 288)May include surrounding context.

python

date_str = datetime.now().strftime("%Y-%m-%d")
    subprocess.run(['git', 'add', '.'], check=True)
    subprocess.run(['git', 'commit', '-m', f'data: 每日全量更新 {date_str}'], check=True)
    subprocess.run(['git', 'push'], check=True)
    print("\n🚀 已推送到 GitHub")
    return True

Static analysis

No suspicious patterns detected.