T09 · Insecure Skill Coding Practices
Error
- Location
scripts/source_searcher.py:401- Finding
Confluence Bearer Token Can Be Sent to an Insecure or Attacker-Controlled Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
知识网格 / Knowledge Mesh
Security checks for vulnerabilities and agentic risk
Overview
This skill is a legitimate knowledge search tool, but it needs review because it handles work tokens, local note contents, search history, and file exports with some weak scoping and safety controls.
Review this skill before installing in a work environment. Use narrowly scoped read-only service tokens, set KM_CONFLUENCE_URL only to a trusted HTTPS Confluence host, avoid searching for secrets or confidential incident text unless you accept local query logging, and export reports only to safe paths you explicitly choose. Clear or protect the local KM_DATA_DIR if it may contain sensitive search history or indexed note metadata.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/report_exporter.py:340- Finding
Report Export Allows Unrestricted Overwrite of Arbitrary Writable Files
- Content
View full analysis
None: """导出搜索结果为 Markdown 报告. Args: data: 包含 query、results 的字典，可选 title 和 file_path。 """ query = data.get("query", "") results = data.get("results", []) title = data.get("title") file_path = data.get("file_path") if not results: output_error("无搜索结果可导出", code="NO_DATA") return report = _generate_markdown_report(query, results, title) if file_path: try: dir_name = os.path.dirname(file_path) if dir_name: os.makedirs(dir_name, exist_ok=True) with open(file_path, "w", encoding="utf-8") as f: f.write(report) ``` ```python def action_export_csv(data: Dict[str, Any]) -> None: """导出搜索结果为 CSV 格式. Args: data: 包含 results 的字典，可选 file_path。 """ results = data.get("results", []) file_path = data.get("file_path") if not results: output_error("无搜索结果可导出", code="NO_DATA") return csv_content = _generate_csv(results) if file_path: try: dir_name = os.path.dirname(file_path) if dir_name: os.makedirs(dir_name, exist_ok=True) with open(file_path, "w", encoding="utf-8", newline="") as f: f.write(csv_content) ``` ### Technical Analysis Both export actions accept a caller-controlled `file_path`. The path is used directly to create directories and open the destination in write mode. There is no canonicalization, permitted export-root boundary, traversal prevention, symlink rejection, extension restriction, overwrite confirmation, or exclusive file creation. Opening the destination with `"w"` truncates an existing file before wri ...[truncated 1664 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/learning_engine.py:362- Finding
Raw Search Queries Are Automatically Retained in Weakly Protected Plaintext Storage
- Content
View full analysis
None: """记录搜索查询及各知识源的结果数量. 用于分析搜索行为和知识源覆盖率. Args: data: 包含 query、sources、result_counts 的字典. """ query = data.get("query", "").strip() sources = data.get("sources", []) result_counts = data.get("result_counts", {}) if not query: output_error("请提供搜索查询（query）", code="VALIDATION_ERROR") return learning_data = _load_learning_data() query_entry = { "id": generate_id("QR"), "query": query, "sources": sources, "result_counts": result_counts, "total_results": sum(result_counts.values()) if result_counts else 0, "timestamp": now_iso(), } learning_data["query_log"].append(query_entry) _save_learning_data(learning_data) ``` The shared persistence function writes JSON using default process permissions: ```python def write_json_file(filepath: str, data: Any) -> None: """将数据写入 JSON 文件. Args: filepath: 目标文件路径. data: 待写入的数据. """ os.makedirs(os.path.dirname(filepath), exist_ok=True) with open(filepath, "w", encoding="utf-8") as f: json.dump(data, f, ensure_ascii=False, indent=2, default=str) ``` ### Technical Analysis Every successful unified search is automatically recorded verbatim in `learning.json`. The stored entry includes the raw qu ...[truncated 1955 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (50)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Subscription enforcement, quota tracking, and local usage persistence are materially different from the advertised core search function and introduce extra state collection. While not inherently malicious, undisclosed tracking/storage can affect privacy expectations and create local metadata that reveals user interests or activity patterns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Subscription enforcement, quota tracking, and local usage persistence are materially different from the advertised core search function and introduce extra state collection. While not inherently malicious, undisclosed tracking/storage can affect privacy expectations and create local metadata that reveals user interests or activity patterns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Subscription enforcement, quota tracking, and local usage persistence are materially different from the advertised core search function and introduce extra state collection. While not inherently malicious, undisclosed tracking/storage can affect privacy expectations and create local metadata that reveals user interests or activity patterns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Subscription enforcement, quota tracking, and local usage persistence are materially different from the advertised core search function and introduce extra state collection. While not inherently malicious, undisclosed tracking/storage can affect privacy expectations and create local metadata that reveals user interests or activity patterns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Subscription enforcement, quota tracking, and local usage persistence are materially different from the advertised core search function and introduce extra state collection. While not inherently malicious, undisclosed tracking/storage can affect privacy expectations and create local metadata that reveals user interests or activity patterns.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | 变量 | 必需 | 说明 | |------|------|------| | `KM_GITHUB_TOKEN` | 否 | GitHub Personal Access Token，用于搜索 Issues/Discussions | | `KM_STACKOVERFLOW_KEY` | 否 | Stack Exchange API Key，提高速率限制 | | `KM_DISCORD_BOT_TOKEN` | 否 | Discord Bot Token，搜索频道消息 | | `KM_DISCORD_CHANNEL_ID` | 否 | Discord 目标频道 ID |
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger conditions for search are overly broad, including ordinary words like 'search' or generic technical questions. In a skill that can access networked sources and local knowledge stores, broad triggers raise the chance of unintended data access, API use, or query persistence from normal conversation rather than explicit user intent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares no explicit tool scope or permission boundaries, yet its documented behaviors require environment access, local file read/write, and network access. Without a declared allowlist, the agent may operate with broader capabilities than users expect, increasing the risk of unintended data access, token use, or filesystem modification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
该处明确要求代理“始终使用中文与用户沟通”，这是对语言/locale 的强制约束，但文档没有提供用户选择语言的机制，也未说明这是区域性合规或业务必需限制。根据规则，未经用户选择的强制语言策略属于自然语言政策问题。
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation exposes a delete action for local indexes without a prominent warning that it changes persistent local state. Destructive operations against indexed knowledge can cause data-loss-like outcomes for users who do not realize deletion is being performed rather than just removing results from view.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The report export workflow omits an explicit user-facing warning that files will be written locally. In context, the skill already combines local data handling with arbitrary export paths, so missing disclosure makes unintended persistence and accidental overwrites more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Export is triggered by vague phrases like '导出' or '保存结果' without a clearly defined confirmation step, yet the action writes files to disk. This can lead to accidental file creation or overwrite from ambiguous user requests, making the issue more serious because the skill has write-capable workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Obsidian connect/index workflow lacks a strong privacy notice about the scope of local note access. Because vault indexing may traverse large collections of personal or proprietary notes, metadata, wikilinks, and backlinks, insufficient disclosure can result in significant unintended exposure of sensitive local knowledge.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
该行再次规定“始终使用中文与用户沟通”，强化了单一语言输出策略，而没有任何 opt-in、切换条件或例外说明。重复性的强制语言要求进一步表明该技能未尊重用户语言偏好。
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README claims requests go directly to platform APIs, but it does not explicitly warn users that their search queries are transmitted to third-party services such as GitHub, Stack Overflow, Slack, Notion, and Baidu. This omission can cause users to unknowingly send sensitive internal terms, credentials, incident details, or proprietary project names to external providers, creating privacy, compliance, and data leakage risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README promotes local indexing and export features without warning that local file contents may be read, processed, summarized, and written into generated Markdown/CSV outputs. Users may unintentionally index sensitive notes, source files, or secrets and then expose them through synthesized reports, exports, or downstream sharing workflows.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | **认证方式** | `Authorization: Bearer {KM_SLACK_TOKEN}` | | **所需权限** | `search:read` | | **速率限制** | Tier 2: 20 次/分钟 | | **文档** | https://api.slack.com/methods/search.messages | > 注意：Slack Token 需要 `search:read` scope，且 Bot 需要被邀请到相应频道。
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
清单将 skill 描述为统一搜索 GitHub、Stack Overflow、Discord、Confluence、Notion、Slack、百度、Obsidian 的跨平台聚合器，并支持自学习排序。但本文件的公开操作仅包括扫描本地路径、读取本地文件、构建/重建/删除本地倒排索引以及本地搜索，没有任何对应的平台集成、远程搜索或聚合逻辑。
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The rebuild flow wipes persisted index and metadata before confirming that the new index can be rebuilt successfully and without requiring explicit confirmation. In a local knowledge-indexing skill, this can cause avoidable data loss or denial of service of the search capability if rebuilding later fails due to missing files, read errors, or interruption.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Natural-language descriptions, usage text, and user-facing messages in this file are written only in Chinese, which imposes a language choice without any opt-in or alternative. Under the policy, language constraints should either be optional or clearly justified as region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module persistently logs click behavior with result IDs, sources, optional queries, and timestamps, creating a behavioral activity trail without an explicit warning or opt-in. In this skill's enterprise/collaboration-search context, click history can reveal what repositories, discussions, or internal documents a user is investigating, which may expose sensitive work patterns or confidential topics if the local data store is accessed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code persistently stores raw search queries, source selections, result counts, and timestamps without any consent, retention control, or minimization. In a cross-platform knowledge aggregator, queries can easily contain sensitive internal project names, credentials pasted by mistake, or proprietary troubleshooting details, so retained telemetry increases privacy exposure if the data file is accessed, copied, or reused beyond user expectations.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
At L583-L588, the generated suggestion text says the heavily clicked source's '排序权重已自动提升'. However, this function only appends a suggestion and never updates
source_weights; actual weight changes occur only inaction_boost_weightsusing explicit feedback data at L399-L441. This is an active contradiction between user-facing intent/documentation text and implemented behavior.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This Python file contains its top-level description, usage text, docstrings, and user-facing output strings entirely in Chinese, indicating the skill is designed to operate in a single language. The file does not offer any user opt-in, locale selection, or documented region-specific justification, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module-level description and all user-facing messages are written in Chinese, which effectively fixes the interaction language for this skill. There is no indication that users can choose another language or that the locale restriction is intentionally limited to a Chinese-specific deployment context.
- Content
Static analysis
No suspicious patterns detected.