Security audit

coze-workflow-runner

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real Coze workflow runner, but it uses local service credentials and can send user data to remote workflows without enough scoping or disclosure.

Install only if you trust the Coze workspace and understand that inputs may be sent to Coze under a local service token. Before use, replace the hardcoded token path with an explicit least-privilege secret, verify each workflow ID and its side effects, avoid personal or proprietary data unless external processing is acceptable, and save returned files only to intended locations.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill documents reading a local token file but does not declare corresponding permissions, creating a mismatch between advertised and actual capabilities. In an agent setting, undeclared file-read behavior is security-relevant because it can expose sensitive local data and bypass user expectations about what the skill may access.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The documentation instructs invoking subprocess/curl on workflow-returned URLs, which expands the skill from API invocation into local command execution and filesystem writes. Because the URLs originate from an external service, this also creates an SSRF-style/trust-boundary issue where unvalidated remote output drives local network access and file creation.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script reads a bearer token from a hard-coded local path and automatically uses it for remote API access. This gives the skill credential-access capability beyond simple workflow execution, creates an implicit dependency on sensitive local files, and can be abused to use the operator's account without explicit consent or visibility.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill shows writing downloaded images to local files without any warning or consent flow, so users may not realize the skill persists data on disk. Silent filesystem writes are dangerous in agent environments because they can consume storage, overwrite expected outputs, or create artifacts from untrusted remote content.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation instructs use of a service token with an external API but does not warn users about credential sensitivity or that input data will be transmitted to a third-party service. This weakens informed consent and increases the risk of accidental secret exposure or inappropriate transmission of sensitive data.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation explicitly describes collecting a user's email address and sending it to a remote Coze workflow, but it provides no privacy notice, consent guidance, retention limits, or restrictions on what personal data may be included. Because email addresses are personal data and the example encourages bundling additional identifying information, this creates a real privacy and data-handling risk rather than a purely informational issue.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script silently harvests a bearer token from a local file and does not warn the user that existing credentials on disk will be consumed. That lack of disclosure undermines informed consent and can lead to unauthorized use of a user's account or secrets if the skill is run in a broader agent environment.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The workflow call sends the provided input text to a remote service, but the script gives no explicit notice that user-supplied data may leave the local environment. Because the sample input includes personal data fields, this creates a real privacy and data-handling risk if operators assume processing is local.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The documentation reveals the precise local path of the service token file, which materially lowers the effort needed for an agent or user to locate sensitive credentials. In this context, the skill is explicitly operational guidance for using those credentials, so exposing the path makes credential discovery and exfiltration significantly easier.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Repeating the exact credential file location in the resource section reinforces and normalizes access to sensitive token material, increasing the chance of credential disclosure. Duplication also broadens the attack surface by making automated extraction from documentation easier and more reliable.

Static analysis

No suspicious patterns detected.