T09 · Insecure Skill Coding Practices
Error
- Location
scripts/download.py:39- Finding
Authentication Cookie Exposure Through Command-Line Arguments and Redirectable Requests
- Content
View full analysis
- Remediation
View remediation
Security audit
Bian16 Wallpaper Downloader
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real pic.netbian.com wallpaper downloader, but it handles a logged-in browser cookie in a risky way and includes opt-in permanent file deletion.
Review before installing. Only run this if you are comfortable using a logged-in pic.netbian.com session cookie; avoid placing real session cookies directly in shell commands or shared logs. Check the output directory carefully before using --delete, because it permanently removes non-matching JPG files.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/download.py:60- Finding
Unbounded Response Reads and Out-of-Bounds JPEG Metadata Parsing
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The code substantially aligns with the core declared purpose: it targets pic.netbian.com, scans the mobile wallpaper category by default, uses a token-based download endpoint, applies a default 180-second interval, and validates image resolution before saving. However, two materially described capabilities are not present in the code. First, the declared description explicitly includes a WeChat QR login flow, but the script has no login automation at all and only requires the user to pass an existing cookie. Second, the description says it performs cleanup of non-4K files, but the implementation merely skips saving images whose detected width is below the threshold; it does not remove previously downloaded files or perform directory cleanup. Because these are explicit advertised features absent from the implementation, this is a description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a site-specific wallpaper downloader with authentication, download, rate-limiting, and verification features. The supplied code does not perform any network access, login, token handling, or downloading. It only validates JPEG width in a local directory and optionally deletes files that do not meet a minimum width threshold. While the cleanup/non-4K verification aspect partially overlaps with the description, the primary purpose and major capabilities described are absent, so this is a clear mismatch.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill describes workflows that require network access and reading browser-derived cookie data, but it declares no explicit tool scope or permissions boundary. That creates an authorization ambiguity where an agent may invoke broader-than-intended capabilities without clear user or platform controls, increasing the chance of unintended data access or network actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script requires a user-supplied authenticated cookie and sends it in outbound requests, but it provides no warning about the sensitivity of that credential, its account scope, or the risks of exposing it via command-line arguments. Passing cookies on the CLI can leak them through shell history, process listings, logs, or orchestration tooling, which could enable account/session hijacking if the cookie is reused.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
When
--deleteis provided, the script permanently removes files viaos.remove(f). Although the docstring and argument help mention deletion, there is no confirmation prompt or explicit user warning about the irreversible nature of the action before files are deleted.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
All user-facing documentation and runtime messages in this script are written exclusively in Chinese, with no option or note allowing users to select another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The docstring and CLI help text are presented in Chinese only, which is a natural-language locale choice embedded in the skill. Under the policy, forcing a specific language without user opt-in can be a language or locale policy violation.
- Content