T09 · Insecure Skill Coding Practices
Error
- Location
config.json:1- Finding
Plaintext API credentials distributed in the project configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
Gangtise Kb
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent financial knowledge-base purpose, but it ships plaintext API credentials and weakens TLS protections for credential and query traffic.
Review carefully before installing. Do not use this artifact as-is with real credentials: remove the bundled config.json, rotate any exposed Gangtise keys, restore normal TLS certificate verification, avoid printing or passing bearer tokens on the command line, and use a safer local secret-storage method.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/get_token.py:60- Finding
TLS certificate and hostname verification disabled for authentication and knowledge-base requests
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/get_token.py:92- Finding
Bearer tokens exposed through standard output and command-line arguments
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
gangtise_kb_skill.py:42- Finding
Temporary JSON input is not deleted when subprocess execution fails or times out
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (21)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Interactive setup for API credentials. Run this first before using any other scripts.
Get Access Token
bash python3 scripts/get_token.py
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md #!/usr/bin/env python3 """ Get access token from Gangtise Open Platform API. """ import json import sys
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md #!/usr/bin/env python3 """ Get access token from Gangtise Open Platform API. """ import json import sys
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ Get access token from Gangtise Open Platform API. """ import json import sys
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ Get access token from Gangtise Open Platform API. """ import json import sys
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ Get access token from Gangtise Open Platform API. """ import json import sys
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This code transmits sensitive credentials to a remote login endpoint while TLS verification is disabled, so users receive no meaningful protection against endpoint impersonation. In the context of a knowledge-base skill, collecting and transmitting API secrets is expected, but doing so without secure transport verification materially increases the chance of credential theft and token compromise.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code explicitly disables TLS certificate validation by setting check_hostname to False and verify_mode to ssl.CERT_NONE before sending the access key and secret key to the authentication endpoint. This enables man-in-the-middle interception or spoofing of the Gangtise server, which is especially dangerous because the request contains long-lived credentials and returns an access token.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python parser.add_argument('--top', type=int, default=5, help='Number of results per query (default: 5, max: 20)') parser.add_argument('--days', type=int, default=365, help='Search days back (default: 365)') parser.add_argument('--json', action='store_true', help='Output raw JSON') parser.add_argument('--token', help='Access token (optional)') args = parser.parse_args()
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code sends API credentials to obtain an access token and then transmits search queries over network requests without any user-facing disclosure or consent, while also disabling TLS verification. In this skill context, the network access is expected, but the combination of silent credential/data transmission and insecure transport significantly increases the risk of secret exposure and tampered results.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documentation indicates capabilities for reading/writing files, making network requests, and invoking shell commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it easier for a caller or future script changes to use broader capabilities than are necessary, especially since the skill handles API credentials and token retrieval.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The natural-language comments and docstrings describe the skill exclusively in Chinese, with no indication that other languages are supported or that the locale is intentionally limited. Under the policy, forcing a specific language without user opt-in or a justified locale constraint is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code writes all user-supplied request data to a persistent temporary file on disk using delete=False before handing it to the downstream program. If the input contains sensitive financial queries, credentials, or proprietary data, that content may be exposed through local filesystem access, crash paths, or cleanup failures because the file is not automatically removed on all exception paths.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The wrapper launches an external program via subprocess using data derived from the user's input flow. While subprocess execution is central to the adapter's behavior, this file does not provide any user-facing notice, confirmation, or clear disclosure that an external binary will be executed.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes a skill for querying the Gangtise knowledge base API to retrieve financial and market information. Instead of directly implementing that query behavior, this wrapper launches another local program with subprocess.run, which introduces general code-execution capability beyond what is inherently required for a KB lookup skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script collects the secret key using visible terminal input via input(), which can expose the credential to shoulder-surfing, terminal recording, or shell/session capture. It then stores both credentials in plaintext in a local config.json file; although chmod(0o600) reduces exposure on Unix-like systems, it does not encrypt the secret and may not provide equivalent protection on all platforms.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code disables TLS certificate verification for both authentication and knowledge-base queries by setting check_hostname=False and verify_mode=ssl.CERT_NONE. This allows man-in-the-middle interception of API credentials, bearer tokens, and user queries, making external data disclosure far worse than merely lacking a warning.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script explicitly creates an unverified SSL context and uses it for both authentication and data queries, which disables server certificate validation. This enables man-in-the-middle interception of the access key exchange and bearer token, allowing credential theft or response tampering despite using HTTPS URLs.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file contains user-facing instructional text in Chinese within an otherwise English document, which can impose a language/locale choice on users without opt-in. The same pattern appears in several later sections, indicating the skill does not consistently offer a language option or justify the locale constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The inline comments at these lines are written only in Chinese and do not offer any language choice or bilingual explanation. That can violate a language/locale policy when the skill otherwise appears intended for broader use and does not document a Chinese-only scope.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The embedded natural-language queries are all fixed to Chinese topics such as "今日财经新闻" and "A股市场动态", which imposes a specific language/locale behavior. There is no indication that users can opt into another language or that the locale restriction is documented as intentional.
- Content
Static analysis
No suspicious patterns detected.