T09 · Insecure Skill Coding Practices
Error
- Location
scripts/login.js:13- Finding
Privileged RiskShield Credentials Embedded in Documentation and Executable Scripts
- Content
View full analysis
- Remediation
View remediation
Security audit
RiskShield案件审批自动化
Security checks for vulnerabilities and agentic risk
Overview
This skill automates RiskShield approvals, but it ships reusable credentials and tokens and can submit consequential decisions with unsafe defaults.
Treat this as a Review item, not a routine install. Do not use it against real RiskShield data unless the exposed password and token have been revoked, credentials are supplied through a managed secret channel, fixed-case/default-decision behavior is removed, debug scripts are excluded, and approvals require explicit user-directed case/action input in an isolated least-privilege account.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
token.json:1- Finding
Bearer Token and Secret Token Packaged and Persisted in Plaintext
- Content
View full analysis
", "secretToken": "" } ``` The login implementation writes returned authentication material directly into the project directory: ```js const tokenData = { token: result.body.token, secretToken: result.body.secretToken || '', expire: result.body.expire || (Date.now() + 24 * 60 * 60 * 1000), obtainedAt: new Date().toISOString() }; // Save token fs.writeFileSync(TOKEN_FILE, JSON.stringify(tokenData, null, 2)); console.log(`Token saved to ${TOKEN_FILE}`); console.log(`Token expires at: ${new Date(tokenData.expire).toISOString()}`); ``` ### Technical Analysis `token.json` is included at the project root and contains a bearer token and a separate secret token. Bearer tokens generally grant access to any party possessing them, without requiring knowledge of the original password. The login routine persists new tokens with `fs.writeFileSync` but does not set restrictive file permissions. The effective permissions therefore depend on the process umask and surrounding filesystem configuration. Storing tokens beside distributable Skill files also makes accidental packaging, backup, or source-control inclusion more likely. Token persistence can be useful for automation, but packaging live authentication material and retaining an apparently unnecessary `secretToken` violate least exposure and least retention principles. ### Attack Path 1. An attacker reads the Skill directory, package archive, backup, CI artifact, or source history. 2. The attacker extracts the bearer token or secret token from `token.json`. 3. If ...[truncated 861 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/risk_approve.js:14- Finding
Approval Script Fails Open to a Fixed Case and PASS Decision When Arguments Are Missing
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/risk_approve.js:34- Finding
Chromium Sandbox Disabled During Authenticated Approval Automation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/test_login_fetch.js:30- Finding
Login Debug Script Writes Authentication Response Headers and Body to Logs
- Content
View full analysis
{ console.log('Status code:', res.statusCode); console.log('Response headers:', JSON.stringify(res.headers)); let body = ''; res.on('data', (chunk) => body += chunk); res.on('end', () => { console.log('Response body:', body.substring(0, 500)); }); }); ``` The labels above are translated into English for report consistency; the audited source uses equivalent non-English labels. The executed sinks and logged values are unchanged. ### Technical Analysis The debug script submits plaintext account credentials to the RiskShield login endpoint and then logs all response headers plus the first 500 characters of the response body. Login responses commonly carry session cookies, bearer tokens, refresh tokens, secret tokens, user identifiers, or diagnostic details. Even when the network transmission itself is expected and protected by HTTPS, copying authentication material into terminal output, CI logs, Agent traces, or centralized logging systems creates a separate disclosure channel with a potentially much longer retention period. The script does not inspect or redact sensitive header names and does not parse the response body to remove token fields. ### Attack Path 1. A developer, test runner, Agent, or CI job executes `scripts/test_login_fetch.js`. 2. RiskShield returns authentication or session material in response headers or the response body. 3. The script writes those values to standard output. 4. The output is retained in terminal history, Agent conversation logs, CI artifacts, or centralized logging. 5. A party with log access extracts and replays the exposed token or cookie before it expires. ### Impact Assessment If the response includes usable authentication material, a lo ...[truncated 336 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (505)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a limited browser approval skill, but the referenced behavior includes undeclared authenticated access, token handling, direct API interaction, local token persistence, screenshots, and diagnostic logging. This mismatch is dangerous because reviewers and operators may authorize a much more powerful skill than they realize, enabling covert data access or high-impact system actions.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/extract_page_api.js:132