Security audit

众安车险自助投保

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent car-insurance purchase assistant, but it handles sensitive customer data in ways that could leak phone numbers, identity details, and API credentials.

Review this skill carefully before installing. It appears intended for a legitimate car-insurance workflow, but the publisher should remove API keys from URLs, stop printing full request bodies, secure or eliminate local phone-number storage, and use safer temporary-file handling before it is trusted with real customer data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: proposal.md:78
Finding: Session API Credential Exposed in Payment QR Page Query String
Content: View full analysis
Vulnerability Details

File Location: proposal.md:78
Vulnerability Type: Credential exposure through a URL query parameter
Risk Level: High

Vulnerable Code

text
GET <gateway-domain>/api/quickInsure/payQrcode?url=<zaPayUrl(URLencode)>&orderNo=<outTradeNo>&expiryTime=<expiryTime(URLencode)>&car-api-key=<$CAR_API_KEY(URLencode)>

Technical Analysis

The payment workflow embeds CAR_API_KEY directly into the query string used to open the QR-code page. URL encoding changes only the representation of the credential; it does not protect its confidentiality.

Query-string credentials can be retained or exposed through:

Browser history and address-bar synchronization

Browser screenshots and copied URLs

Reverse-proxy and web-server access logs

Monitoring, diagnostic, and browser automation logs

Referrer information, depending on the page and referrer policy

Local browser profile access

This behavior also conflicts with the authentication guidance in auth.md, which requires authenticated API credentials to be transmitted through the car-api-key request header rather than the query string.

Attack Path

A customer completes quotation and underwriting.

The Skill receives a valid same-day CAR_API_KEY.

The Skill constructs and opens the payment QR-code URL with the key in the query string.

The complete URL is retained in browser history, automation telemetry, proxy logs, or server access logs.

An attacker or lower-privileged operator with access to one of those records extracts the car-api-key value.

The attacker submits authenticated requests to supported insurance APIs before the credential expires.

Impact Assessment

Exposure grants the attacker the authenticated API privileges associated with the affected customer session for the remaining credential lifetime. Depending on backend authorization cont ...[truncated 323 chars]
Remediation: View remediation
Remediation Suggestions

Remove car-api-key from every URL and query string.

Authenticate the QR-page request through a protected request header where the client and browser integration support it.

Prefer a backend-generated, cryptographically random, single-use payment-page token.

Scope that token only to one order and one QR-page operation.

Apply a short expiration period and invalidate the token immediately after use.

Ensure the token cannot invoke quotation, underwriting, or policy APIs.

Configure Referrer-Policy: no-referrer on sensitive payment pages.

Redact existing query-string credentials from proxy, application, browser automation, and access logs.

Revoke exposed keys and review historical logs for accidental credential retention.

T09 · Insecure Skill Coding Practices

Error

Location: scripts/api.sh:98
Finding: Complete Sensitive Request Bodies Written to Standard Error
Content: View full analysis
Vulnerability Details

File Location: scripts/api.sh:98
Vulnerability Type: Plaintext logging of personally identifiable information
Risk Level: High

Vulnerable Code

bash
printf '>> POST %s%s\n>> body: %s\n\n' "$BASE_URL" "$PATH_SUFFIX" "$RAW_BODY" >&2

Technical Analysis

The script writes the complete unredacted API request body to standard error. The documented request bodies may contain:

Customer and vehicle-owner names

National identity numbers

License plate numbers

VIN and engine numbers

Vehicle registration dates

Insurance flow codes

Insurer and external order identifiers

Standard error is commonly collected by Agent runtimes, shell-session capture, CI systems, support tooling, terminal history mechanisms, and centralized logging platforms. The script therefore expands sensitive-data exposure from the intended insurer API to every system that captures process output.

Cleanup of the temporary request file does not mitigate this disclosure because the same data has already been copied to the logging channel.

Attack Path

A customer submits identity or vehicle information during quotation or policy processing.

The Agent passes that information to scripts/api.sh as RAW_BODY.

The script prints the entire body to standard error before sending the request.

The execution environment captures standard error in an Agent transcript, diagnostic record, or centralized log.

A user or service account with log-reading access retrieves the sensitive fields.

The exposed information may be correlated with order and policy identifiers for impersonation, targeted fraud, or privacy abuse.

Impact Assessment

Exploitation grants access to the complete sensitive fields contained in affected requests. The scope includes every customer whose request is executed while logging remains enabled and every retained copy of the relevant ...[truncated 219 chars]
Remediation: View remediation
Remediation Suggestions

Remove request-body logging from the production script.

Log only the endpoint name, response status, duration, and a non-sensitive correlation identifier.

If diagnostic body logging is unavoidable, require an explicit development-only flag that is disabled by default.

Implement structured redaction for names, identity numbers, phone numbers, license plates, VINs, engine numbers, API credentials, and order identifiers.

Prevent production logs from receiving raw request bodies even when debugging is enabled.

Apply least-privilege access controls and short retention periods to existing logs.

Search historical logs for exposed data and securely delete or quarantine affected records according to incident-response requirements.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/api.sh:87
Finding: Sensitive API Request Data Stored in an Insufficiently Protected Temporary File
Content: View full analysis
Vulnerability Details

File Location: scripts/api.sh:87-96
Vulnerability Type: Unsafe temporary-file handling for sensitive data
Risk Level: Medium

Vulnerable Code

bash
TMP_DIR="${TMPDIR:-${TEMP:-${TMP:-/tmp}}}" TMP_FILE="${TMP_DIR}/car_api_body_$$_${RANDOM}.json" printf '%s' "$RAW_BODY" > "$TMP_FILE" trap 'rm -f "$TMP_FILE"' EXIT

Technical Analysis

The script constructs a temporary filename from the process ID and shell RANDOM value, then creates it through ordinary shell redirection. It does not:

Use mktemp for atomic secure creation

Enforce file mode 0600

Set a restrictive umask

Verify that the selected temporary directory is trusted

Defend against a pre-existing path or symbolic-link race

The final permissions depend on the caller’s umask. In a permissive environment, the temporary file may be readable by other local users. The predictable filename structure also weakens resistance to local observation and pre-creation attacks.

The EXIT trap is useful but incomplete. It does not prevent disclosure while the request is in progress, and cleanup cannot be guaranteed after abrupt termination that bypasses shell traps.

Attack Path

An attacker obtains local access to the same shared host or runtime namespace.

The attacker monitors the configured temporary directory for files matching car_api_body_*_*.json.

A victim initiates a request containing identity, vehicle, or order data.

The script creates the temporary JSON file using permissions inherited from the current umask.

If permissions permit, the attacker reads the file before the request finishes.

Alternatively, where directory permissions and timing permit, the attacker attempts to pre-create or redirect the predictable path before shell redirection occurs.

The eventual cleanup does not reverse data already read or redirected.

Impact Assessment

A successful ...[truncated 420 chars]
Remediation: View remediation
Remediation Suggestions

Use secure, atomic temporary-file creation and restrictive permissions:

bash
umask 077 TMP_DIR="${TMPDIR:-/tmp}" TMP_FILE="$(mktemp "${TMP_DIR%/}/car_api_body.XXXXXX")" chmod 600 "$TMP_FILE" trap 'rm -f -- "$TMP_FILE"' EXIT HUP INT TERM printf '%s' "$RAW_BODY" > "$TMP_FILE"

Additional hardening should include:

Reject temporary directories that are not directories or are not owned or trusted as expected.

Avoid user-controlled temporary-directory variables in privileged environments.

Prefer passing the body through standard input when supported, eliminating the temporary file entirely.

Retain cleanup handlers for normal exit and common termination signals.

Never print the file contents or raw request body to logs.

T09 · Insecure Skill Coding Practices

Warning

Location: auth.md:29
Finding: Customer Phone Numbers Persisted in a Plaintext Authorization File
Content: View full analysis
Vulnerability Details

File Location: auth.md:29-33
Vulnerability Type: Plaintext persistence of sensitive customer identifiers
Risk Level: Medium

Vulnerable Documentation Segment

The following is an English translation of the complete relevant authorization-storage procedure:

text
Authorization records are persisted in a local file without calling a backend API. Process: check the authorization file, display the agreements when authorization is absent, and write the file after the user confirms. Authorization check logic: 1. After the user provides a phone number, check whether ~/.car_insurance_auth contains that phone number. 2. If a record exists, skip this step and send the verification code. 3. If no record exists, display the agreements and, after confirmation, append the phone number to the authorization file in plaintext, one phone number per line.

The persistence requirement is repeated at auth.md:67 and SKILL.md:39.

Technical Analysis

The workflow persistently stores complete phone numbers in ~/.car_insurance_auth. No command or requirement establishes restrictive file permissions, encryption, hashing, retention limits, atomic updates, or protection against symbolic links.

This behavior also conflicts with auth.md:169, which states that phone numbers and identity numbers must not be written to any file. As a result, implementations following the mandatory authorization workflow necessarily violate the document’s own sensitive-data handling rule.

Storing a keyed hash or an opaque backend consent identifier would be sufficient to determine whether consent was previously recorded without retaining the complete phone number in plaintext.

Attack Path

A customer provides a phone number and accepts the agreements.

The Skill appends the complete number to ~/.car_insurance_auth.

The file remains on disk across subsequent sessions.

Anothe ...[truncated 805 chars]
Remediation: View remediation
Remediation Suggestions

Do not store complete phone numbers in the local authorization file.

Prefer a backend consent record referenced by an opaque customer identifier.

If local lookup is required, store a keyed HMAC of the normalized phone number rather than the original value.

Keep the HMAC key outside the Skill package and outside the authorization file.

Create the state directory and file with owner-only permissions, such as directory mode 0700 and file mode 0600.

Use atomic writes and reject symbolic links before updating the file.

Define and enforce a retention period and reliable consent-revocation deletion.

Remove the contradictory instruction that sensitive phone numbers must never be written to files, or redesign the authorization flow so that the rule is actually satisfied.

Migrate or securely delete existing plaintext authorization records.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file instructs the agent to persist phone numbers in ~/.car_insurance_auth, but elsewhere says phone numbers and other sensitive data must not be written to files. This contradiction creates a real privacy and security risk because implementers may store personal data locally in plaintext despite later rules forbidding such persistence, leading to unintended retention and possible disclosure on the host.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The spec explicitly requires placing car-api-key into the payment QR page URL query string. Secrets in URLs are routinely exposed via browser history, logs, reverse proxies, analytics, screenshots, referer headers, and copied links, so this can leak an authentication credential beyond its intended scope. In this insurance-payment context, leakage of an API key could enable unauthorized access to underwriting or policy APIs, making the workflow materially more dangerous.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes shell-based network operations and handles sensitive workflows like phone numbers, OTP delivery, quoting, payment, and policy issuance, yet it declares no explicit tool scope or permissions boundary. This creates an overly broad execution model where an agent could use shell capabilities without a least-privilege declaration, increasing the risk of unintended command execution or uncontrolled data handling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger phrases include broad, natural-language requests related to buying car insurance, which can cause accidental invocation in ordinary conversation. Because this skill initiates sensitive flows involving authorization, OTP, and payment, mis-triggering can expose users to unwanted collection of personal data or premature transactional prompts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill processes highly sensitive information and actions—phone numbers, authorization state, verification codes, payment steps, and policy issuance—but does not present clear user-facing privacy, consent, and sensitive-action warnings at the top-level workflow description. This increases the risk that users provide credentials or complete financial steps without sufficient notice, especially if the skill is auto-triggered.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The skill is designed to transmit user data externally via shell/curl to a remote insurance gateway, including phone numbers, vehicle details, identity data, and payment-related information. While external transmission is expected for this business function, it remains a real security concern because the skill mandates command-line HTTP calls and centralized handling of sensitive data, expanding exposure if logging, endpoint validation, or secret handling are weak.
Content: Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.
md
### 为什么必须使用脚本 shell 环境存在编码差异，直接在 `curl -d '...'` 中写中文字符（车牌省份汉字如「沪」、车主姓名如「张三」）会导致： - **乱码（`\ufffd`）**：接口收到非 UTF-8 编码的字节序列 - **业务误报错**：「身份证号码不正确」「请求参数错误」「实名信息不匹配」

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest describes a car-insurance quote and purchase flow centered on phone authorization, quoting, underwriting, payment, and policy issuance. In auth.md, the skill additionally mandates browser-driven opening of three external agreement URLs before authorization, which is a separate web-browsing capability not stated in the manifest and not obviously required to implement the quoted workflow itself.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The prescribed user messages and control flow are entirely fixed in Chinese, and the authorization rule requires the user to reply with the exact Chinese phrase 已阅读并同意 to proceed. This imposes a specific language/locale on all users without opt-in or an offered alternative, which is a natural-language policy violation under the stated rules.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The markdown explicitly tells the agent to append the user's phone number to a local file for authorization tracking, but does not provide a user-facing warning that the number will be stored locally on the machine. This is dangerous because it silently creates plaintext local persistence of personal data, increasing exposure to other local users, backups, logs, or host compromise.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document mandates all user-facing scripts and operational instructions in Chinese, including fixed phrases that 'must not be modified'. There is no indication that users may opt into another language, nor any justification that this skill is limited to a Chinese-only regulatory or regional context.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The document directs the agent to fall back to open "<上一步URL>" when MCP is unavailable, which invokes a local operating-system application. Launching local apps is a broader host-interaction capability than is justified by the manifest's described insurance quoting and policy issuance flow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file contains a natural-language policy issue because it requires that the speech templates 'must not be modified' and all prescribed user-facing phrases are written in Chinese. There is no indication that users may opt into another language or locale, so the skill effectively forces a specific language.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs collecting and transmitting highly sensitive personal data, including full name,身份证号,车架号 and发动机号, but does not require an explicit privacy notice, purpose limitation statement, consent record, or data-minimization guardrails at the collection point. In an insurance quoting workflow this materially increases the risk of unnecessary disclosure, over-collection, or misuse of regulated personal information if the agent follows the instructions verbatim.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file is entirely written as Chinese sales-response guidance and presents fixed Chinese response scripts, but it does not state that the skill is region- or language-specific nor offer any user opt-in for language selection. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script prints the full JSON request body to stderr before sending it, and the documented payloads include highly sensitive personal data such as phone numbers, names, certificate numbers, and vehicle identifiers. In real deployments, stderr is commonly captured by terminals, CI logs, orchestrators, or support tooling, which can unintentionally disclose regulated personal data and insurance transaction details.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/api.sh (reported line 100)May include surrounding context.
sh
printf '>> POST %s%s\n>> body: %s\n\n' "$BASE_URL" "$PATH_SUFFIX" "$RAW_BODY" >&2 # curl -d @file 直接读取文件字节流发送，不经过 shell 字符串处理 curl -s -X POST "${BASE_URL}${PATH_SUFFIX}" \ -H "car-api-key: ${API_KEY}" \ -H "Content-Type: application/json" \

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file is entirely written as mandatory Chinese-only operating guidance and examples, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file's natural-language documentation, examples, and runtime messages are entirely in Chinese, which effectively imposes a specific language on users. The policy allows locale constraints when documented and justified, but this file does not state that the skill is intentionally Chinese-only or offer an alternative language or opt-in choice.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: auth.md:113

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Documentation Segment

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tp2

Intent-Code Divergence

Context-Inappropriate Capability

Undeclared Tool Scope

Vague Triggers

Missing User Warnings

External Transmission

Context-Inappropriate Capability

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Context-Inappropriate Capability

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

External Transmission

Natural-Language Policy Violations

Natural-Language Policy Violations

Static analysis

File appears to expose a hardcoded API secret or token.