Coze-Power

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:13 AM UTC
• Version: 1.0.5

Overview

This skill openly provides a Coze bot with local machine control, but its shipped server and setup guidance create a serious remote-compromise risk.

Install only if you intend to give a Coze cloud bot remote control over local files, commands, clipboard, and system information. Do not expose this server to the internet as shipped; change the API key, bind locally where possible, remove command execution or replace it with structured safe actions, restrict file paths to a dedicated sandbox folder, disable clipboard access unless needed, and run it in an isolated account or container.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/server.py:168

Finding

Shell Command Whitelist Bypass Enables Arbitrary Command Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/server.py:168-182
Vulnerability Type: OS command injection caused by unsafe shell execution
Risk Level: Critical

Vulnerable Code

python

def tool_run_command(command: str):
    """Execute a shell command (whitelist enforced)."""
    cmd_parts = command.strip().split()
    if not cmd_parts:
        return {"success": False, "error": "Empty command"}
    base = cmd_parts[0]
    if base not in CONFIG["allowed_commands"]:
        return {
            "success": False,
            "error": f"Command '{base}' not allowed. Allowed: {', '.join(CONFIG['allowed_commands'])}",
        }
    try:
        result = subprocess.run(
            command, shell=True, capture_output=True, text=True, timeout=30
        )

Technical Analysis

The whitelist validates only the first whitespace-delimited token. The entire attacker-controlled command is subsequently passed to subprocess.run() with shell=True.

Shell metacharacters such as semicolons, pipes, command substitution, redirection, and logical operators remain active. An input beginning with an allowed command can therefore append an arbitrary second command. For example, a request conceptually equivalent to ls /tmp; <arbitrary command> passes the base == "ls" check, after which the shell executes both portions.

The configured command list also includes general-purpose interpreters such as python3 and node. Even if metacharacters were filtered, access to these interpreters inherently permits execution of arbitrary code, filesystem access, and network operations under the server account.

Attack Path

1. The attacker obtains, guesses, or reuses the shared API key.
2. The attacker sends an authenticated POST request to /tools/run-command.
3. The supplied command begins with an allowed executable such as ls.
4. The attacker appends a shell operator followed by an ot ...[truncated 813 chars]

Remediation

View remediation

Remediation Suggestions

• Remove shell=True and execute commands as argument arrays, for example with subprocess.run([executable, *validated_args], shell=False, ...).
• Do not accept a free-form command string. Define separate operations with typed parameters for each supported action.
• Validate the executable path and every argument against an operation-specific policy.
• Remove python3, node, and other general-purpose interpreters from the allowlist.
• Reject shell metacharacters rather than attempting to escape them, although this must not replace shell=False.
• Execute tools under a dedicated, unprivileged operating-system account.
• Add filesystem, process, network, CPU, memory, and execution-time restrictions through a container or another sandbox.
• Record security audit events without logging secrets or sensitive command output.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/server.py:26

Finding

Predictable Credentials Protect a Publicly Exposed Privileged Service

Content

View full analysis

Vulnerability Details

File Location: scripts/server.py:26-31, scripts/server.py:385-390, scripts/config.json:1-6
Vulnerability Type: Hardcoded and placeholder authentication secrets with unsafe network defaults
Risk Level: High

Vulnerable Code

scripts/server.py:26-31:

python

DEFAULT_CONFIG = {
    "api_key": "coze-power-dev-key",
    "host": "0.0.0.0",
    "port": 8899,
    "allowed_commands": ["ls", "pwd", "cat", "echo", "python3", "node", "date", "whoami"],
    "allowed_paths": [os.path.expanduser("~"), "/tmp"],

scripts/config.json:1-6:

json

{
  "api_key": "CHANGE-ME-TO-SOMETHING-SECURE",
  "host": "0.0.0.0",
  "port": 8899,
  "allowed_commands": ["ls", "pwd", "cat", "echo", "python3", "node", "date", "whoami", "find", "wc", "tar", "grep", "head", "tail"],
  "allowed_paths": ["~", "/tmp", "/home"],

scripts/server.py:385-390:

python

server = HTTPServer((CONFIG["host"], CONFIG["port"]), CozePowerHandler)
print(f"╔══════════════════════════════════════════════════╗")
print(f"║  🚀 Coze-Power Server v1.0                      ║")
print(f"╠══════════════════════════════════════════════════╣")
print(f"║  Listening on: http://{CONFIG['host']}:{CONFIG['port']}          ║")
print(f"║  API Key:      {CONFIG['api_key']}                     ║")

Technical Analysis

The fallback API key is a publicly known development value. The shipped configuration replaces it with another predictable placeholder but does not enforce changing that placeholder before startup. If configuration loading fails, the known fallback remains active.

The service binds to 0.0.0.0 by default, making it reachable through every available network interface. Project documentation additionally instructs users to make the service internet-accessible through ngrok or Cloudflare Tunnel. This service exposes shell execution, file access, clipboard access, and system information ...[truncated 1651 chars]

Remediation

View remediation

Remediation Suggestions

• Refuse to start when the key equals any bundled default or placeholder value.
• Generate a cryptographically random secret during initial setup rather than shipping an active default.
• Store the secret in a protected environment variable or operating-system secret store.
• Never print the API key or include it in routine logs.
• Bind to 127.0.0.1 by default and require an explicit option for non-loopback exposure.
• Place authentication at the tunnel or reverse-proxy layer in addition to application authentication.
• Use short-lived credentials scoped by bot, operation, and resource.
• Add key rotation, revocation, rate limiting, failed-authentication monitoring, and lockout controls.
• Use TLS for every network hop and reject direct plaintext network access.
• Require explicit local confirmation before enabling command execution, clipboard reading, or broad filesystem access.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/server.py:276

Finding

String-Prefix Path Validation Allows Access Outside Intended Directories

Content

View full analysis

Vulnerability Details

File Location: scripts/server.py:276-282
Vulnerability Type: Improper filesystem authorization boundary check
Risk Level: High

Vulnerable Code

python

def _is_path_allowed(path: str) -> bool:
    """Check if a path is within allowed directories."""
    abs_path = os.path.realpath(os.path.abspath(path))
    for allowed in CONFIG["allowed_paths"]:
        allowed_abs = os.path.realpath(os.path.abspath(os.path.expanduser(allowed)))
        if abs_path.startswith(allowed_abs):
            return True
    return False

Technical Analysis

The authorization decision uses a raw string-prefix comparison rather than checking filesystem path ancestry. A sibling path whose name begins with the same characters as an allowed directory is incorrectly accepted.

For example, when /tmp is allowed, a path under /tmp_private also satisfies:

python

"/tmp_private/file".startswith("/tmp")

Resolving paths with realpath() helps address some traversal and symlink cases, but it does not correct the directory-boundary error introduced by startswith().

The issue affects file reading, file writing, and directory listing because these operations call _is_path_allowed(). The shipped configuration also allows broad roots such as the current user’s home directory and /home, increasing the amount of data exposed even when the boundary check works as intended.

Attack Path

1. The attacker authenticates to the service.
2. The attacker identifies an allowed root, such as /tmp or /home.
3. The attacker supplies a path to a sibling directory whose textual name begins with the allowed root, such as /tmp_private/target.
4. realpath() normalizes the supplied path.
5. startswith() incorrectly treats the sibling path as being inside the authorized root.
6. The requested read, write, or directory-listing operation proceeds if operating-system permissions all ...[truncated 778 chars]

Remediation

View remediation

Remediation Suggestions

• Replace string-prefix checks with an ancestry-safe comparison:

python

try:
    if os.path.commonpath([abs_path, allowed_abs]) == allowed_abs:
        return True
except ValueError:
    pass

• Keep separate minimal allowlists for reading, writing, and directory enumeration.
• Do not allow all of ~ or /home by default; require users to select dedicated exchange directories.
• Open files relative to pre-opened directory descriptors where the platform supports it.
• Protect against time-of-check/time-of-use races and symlink replacement during file operations.
• Deny access to credential files, SSH material, browser profiles, environment files, sockets, and device nodes.
• Add automated tests for sibling-prefix paths, traversal attempts, symlink escapes, alternate path separators, and nonexistent targets.
• Run the service in a container or restricted account whose operating-system permissions enforce the same boundary.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/server.py:216

Finding

Unscoped Remote API Discloses Clipboard and Other Sensitive Local Data

Content

View full analysis

Vulnerability Details

File Location: scripts/server.py:196-229, scripts/server.py:300-350
Vulnerability Type: Excessive privilege and sensitive-data exposure through a shared remote interface
Risk Level: High

Vulnerable Code

scripts/server.py:216-229:

python

def tool_clipboard_read():
    """Read clipboard content."""
    try:
        import pyperclip
        text = pyperclip.paste()
        return {"success": True, "content": text[:10000]}
    except ImportError:
        # Fallback: try xclip on Linux
        try:
            result = subprocess.run(
                ["xclip", "-o", "-selection", "clipboard"],
                capture_output=True, text=True, timeout=5
            )
            if result.returncode == 0:
                return {"success": True, "content": result.stdout[:10000]}

scripts/server.py:300-350:

python

class CozePowerHandler(BaseHTTPRequestHandler):
    """HTTP request handler for the Coze-Power API."""

    def _auth(self):
        api_key = self.headers.get("X-API-Key", "")
        if api_key != CONFIG["api_key"]:
            self._json(401, {"success": False, "error": "Invalid API key"})
            return False
        return True

    def _json(self, status, data):
        self.send_response(status)
        self.send_header("Content-Type", "application/json")
        self.send_header("Access-Control-Allow-Origin", "*")
        self.end_headers()
        self.wfile.write(json.dumps(data, ensure_ascii=False).encode("utf-8"))

    def do_POST(self):
        if not self._auth():
            return

        parsed = urlparse(self.path)
        content_length = int(self.headers.get("Content-Length", 0))
        body = self.rfile.read(content_length) if content_length > 0 else b"{}"

        try:
            params = json.loads(body.decode("utf-8"))
        except json.JSONDecodeError as e:
            se
...[truncated 2800 chars]

Remediation

View remediation

Remediation Suggestions

• Disable clipboard reading, command execution, and broad file access by default.
• Require explicit, visible local approval for each sensitive operation.
• Introduce per-tool and per-resource authorization scopes.
• Issue separate short-lived tokens for individual bots and tasks.
• Restrict file operations to dedicated exchange directories selected by the user.
• Add secret detection and redaction before returning clipboard, file, or command output.
• Show the exact requested operation and destination identity in the local approval prompt.
• Apply request expiration, replay protection, rate limiting, and detailed security auditing.
• Allow users to revoke individual bot credentials without rotating every integration.
• Run the bridge in an isolated container or VM with no access to the primary desktop clipboard or home directory unless temporarily granted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (33)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

The YARA hit is plausibly driven by the combination of rich tool-manifest metadata and a massive opaque base64 payload in the same skill file, which are common indicators of metadata poisoning or review-evasion patterns. Even if not intentionally malicious, this structure makes the manifest harder to audit and increases the risk that tooling or agents will misinterpret or over-trust embedded content.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: coze-power
description: |
  Bridge your Coze bots to local machine capabilities. Coze bots run in the cloud and can't access local files, run commands, or control your machine — Coze-Power fixes that with a lightweight HTTP server + Coze-compatible OpenAPI plugin. 10-minute setup: web search, file operations, command execution, clipboard, desktop notifications, and more.
  
  Use this skill when:
  - You want your Coze bot to read/write local files
  - You need a Coze bot to execute shell commands on your machine
  - Your Coze bot should search the web and return structured results
  - You want to give

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The quick-start prominently instructs users to expose a localhost control server to the public internet via ngrok or Cloudflare before presenting a strong upfront risk warning. For a service that supports file access, command execution, clipboard access, and system inspection, encouraging public exposure substantially raises the chance of remote compromise or data exfiltration if authentication or filtering is weak or misconfigured.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The endpoint claims only whitelisted commands are allowed, but the schema exposes a free-form shell command string with no structured allowlist, argument restrictions, or documented validation. Because this skill explicitly gives a cloud bot command execution on the local machine and suggests exposing the server remotely, any mismatch between documentation and implementation could enable arbitrary command execution with full local-system impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The run-command endpoint exposes shell execution on the local machine, which is an inherently high-risk capability even if commands are whitelisted. The documentation mentions whitelisting but does not clearly warn that misuse, weak allowlists, or prompt-influenced agent behavior can lead to destructive system actions, data loss, or local compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guide explicitly instructs users to expose a local HTTP server to the public internet via ngrok, Cloudflare Tunnel, or Serveo while the server provides sensitive capabilities such as local file access and shell command execution. Although API-key auth and some restrictions are mentioned later, the setup section lacks a prominent warning that this creates remote access to the user's machine and can lead to unauthorized command execution or data exposure if the key is weak, leaked, or restrictions are misconfigured.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This is a true tool-parameter-abuse vulnerability: the command parameter is attacker-controlled and is executed with shell=True. The simplistic base-command allowlist is insufficient because an attacker can supply an allowed command followed by shell operators to run arbitrary commands, turning the bot bridge into unauthenticated-capability amplification if the API key is exposed or guessed.

Content

Scanner excerpt · scripts/server.py (reported line 180)May include surrounding context.

python

"error": f"Command '{base}' not allowed. Allowed: {', '.join(CONFIG['allowed_commands'])}",
        }
    try:
        result = subprocess.run(
            command, shell=True, capture_output=True, text=True, timeout=30
        )
        return {

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The path allowlist uses startswith on canonicalized paths, which allows sibling-path bypasses such as permitting /tmp-evil when /tmp is allowlisted. Because this skill exposes file read/write and directory listing over HTTP, the flaw can let remote callers access files outside the intended trusted directories.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The manifest advertises powerful capabilities including local file read/write, shell command execution, and networked access, but it does not declare any explicit tool scope or permission boundaries in the skill metadata. That increases the chance of over-broad invocation and unsafe use because consumers cannot see clear least-privilege constraints at the manifest level.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation guidance is broad enough to match many routine requests involving local files, commands, system info, or web search, which can cause the skill to be selected in situations where safer alternatives would suffice. Because this skill bridges a cloud bot to local machine control, overbroad triggering materially increases the risk of unintended sensitive actions.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 95% confidence

Finding

Embedding a very large base64 data URI image inside the skill file is a form of context stuffing that can hide malicious or policy-relevant content, waste analysis budget, and reduce visibility into meaningful instructions. In security-sensitive manifests, oversized opaque blobs are especially risky because they can obscure review and trigger parser or tooling edge cases.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

### Architecture

![Coze-Power Architecture](data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/4gHYSUNDX1BST0ZJTEUAAQEAAAHIAAAAAAQwAABtbnRyUkdCIFhZWiAH4AABAAEAAAAAAABhY3NwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAA9tYAAQAAAADTLQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlkZXNjAAAA8AAAACRyWFlaAAABFAAAABRnWFlaAAABKAAAABRiWFlaAAABPAAAABR3dHB0AAABUAAAABRyVFJDAAABZAAAAChnVFJDAAABZAAAAChiVFJDAAABZAAAAChjcHJ0AAABjAAAADxtbHVjAAAAAAAAAAEAAAAMZW5VUwAAAAgAAAAcAHMAUgBHAEJYWVogAAAAAAAAb6IAADj1AAADkFhZWiAAAAAAAABimQAAt4UAABjaWFlaIAAAAAAAACSgAAAPhAAAts9YWVogAAAAAAAA9tYAAQAAAADTLXBhcmEAAAAAAAQAAAACZmYAAPKnAAANWQAAE9AAAApbAAAAAAAAAABtbHVjAAAAAAAAAAEAAAAMZW5VUwAAACAAAAAcAEcAbwBvAGcAbABlACAASQBuAGMALgAgADIAMAAxADb/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/2wBDAQMDAwQDBAgEBAgQCwkLEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBD/wAARCAJ0AgoDASIAAhEBAxEB/8QAHgABAAIDAQEBAQEAAAAAAAAAAAcIBQYJBAMCCgH/xABkEAABBAEDAgIEBQkPDg0FAAMBAAIDBAUGBxESIQgTFCIxQRUYUVZhCRYylJfR0tPVIzU4QlVXWHF1gZGTlqGyFzM2N1JidHZ3lbO0tcEZJCVTVGNzgpKipbHUNENmcraD4fD/xAAbAQEAAQUBAAAAAAAAAAAAAAAABAECAwUGB//EAEcRAQABAwIDAwYJCAkEAwAAAAABAgMRBAUSITEGQVETFmFxgZEHIjJTkrGywdEUMzQ1UlSh4RUXNkJik9Li8CNVcsJDc6L/2gAMAwEAAhEDEQA/AOqaIiAiIgIiII+363Im2p2tzOsKUbZL8TG16LXgFosSuDGOIPtDeS4j3hvHvVbtPbGeIfXmia+7rt7MtDnsjV+EqGOE87euNw62ND2vDY+sBpDGsLe454Vnd49tq27O3mV0RNb9FkuMbJWnIJEU7HBzCQPa3kcH6CVUSruH4odvm1PDNFisacxZrejYubzGOsNqubJx5c3mCMANaekuAc0M4+TjX6rlcibmeHHLHi9O7Hcdzba6NsqtU6mK81+Uin8zFMdOKJ+LE5mrHP09FiPClu7lt29tnWtSyibNYa0aNucNa30gdIdHKWt4AJa7pPbuWE+/hTQon8Nmzc2y+3ww2Tssny+Sn9OyBjPMcchaGiNp94aABz7zz7uFLCl2Iri3Tx9XF9o6tFXu2oq278zNU8OOnpx6M5x6MCIiytKIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICLE6q1VgdE6fu6o1NkY6WNx8Rlmmf8nua0e1zieAGjuSQAq7WPH9tfHO9lfSWp5Y2nhrzHA3qHy8eb2WK5ft2pxXOG52zs9um801V6CzVXEcpmOmfDM45rPoquf8IBtr8zNTfwV/xixmp/Hvo+7pvK0tOaX1BVytinNFSsS+SGQzuYQx7ul5PDXEHt8ixTrLER8pt7fYLtFXXFM6aqM9
...[truncated 27 chars]

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The spec says file reads are limited to configured directories, but the request schema accepts any absolute or relative path and documents no enforceable boundary. In this skill's context, a cloud bot is being bridged to local-machine capabilities and the server may be exposed via ngrok/Cloudflare, so ambiguous path constraints can lead to sensitive local file disclosure if the backend enforcement is missing, weak, or bypassable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This endpoint allows writing or overwriting local files but does not provide user-facing warning or confirmation guidance despite destructive potential. In a local-bridge skill used by cloud agents, this increases the risk of accidental or prompted data loss, config tampering, or persistence actions initiated through the bot.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The command-execution endpoint lacks a clear user-facing warning about system impact even though running commands can modify files, exfiltrate data, or execute malware. Given the skill's purpose is to let a cloud bot control the local machine, inadequate warning materially increases the chance of unsafe consent and high-risk misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Clipboard contents often contain secrets, tokens, personal data, or copied credentials, but the endpoint description does not warn about this privacy risk. In this skill, a remote/cloud bot can access local state, so silent clipboard reading meaningfully increases the chance of unintended sensitive-data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The API reference documents a write-file capability that can modify local files and auto-create parent directories, but it does not prominently warn users about the destructive nature of this action. In the context of a cloud-to-local bridge, an agent or integration mistake could overwrite important data or plant files on the host, so missing safety guidance increases the risk of unintended system changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The system-info endpoint exposes host metadata including hostname, OS, architecture, storage details, and time, which can aid fingerprinting and targeted follow-on attacks. The documentation does not warn that these details may be sensitive, and this matters more here because the skill is designed to connect cloud-based bots to a local machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Clipboard-read can expose sensitive transient data such as passwords, tokens, personal messages, or copied documents, yet the documentation lacks a privacy warning. Because this skill explicitly bridges cloud bots to local capabilities, the risk is elevated: clipboard contents could be unintentionally disclosed to remote agent workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Clipboard-write overwrites the user's current clipboard contents, which can disrupt workflows and potentially replace sensitive copied data without notice. In an agent-driven local bridge, lack of warning makes unintended clipboard tampering more likely, especially if triggered automatically by remote instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example prompts normalize risky operations like executing shell commands and creating files on the user's desktop without an adjacent safety notice about destructive side effects, path scope, or command allowlisting. In this skill's context, those examples are especially dangerous because the whole purpose of the integration is to let a cloud bot drive local machine actions, increasing the chance that users enable powerful capabilities without understanding the consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This example normalizes having a cloud-connected bot enumerate and read local desktop documents, then write derived output back, without any privacy boundary, consent, or data-minimization warning. In the context of this skill, which explicitly bridges a remote Coze bot to local machine capabilities, this can expose sensitive local files to remote processing and encourage unsafe use on personal or corporate data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code-helper example instructs the bot to execute shell commands over a local project and presents command execution as routine, without warning about command-injection, scope control, or the risks of running model-selected shell commands. Because this skill's core purpose is to let a cloud bot run commands on the user's machine, examples like this materially increase the chance of dangerous command execution against valuable source trees or developer environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This scheduled backup scenario depicts recurring local file operations and archive creation initiated through the bot, but omits warnings about persistence, storage location, overwrite behavior, and the fact that ongoing automated access increases blast radius if the bot or integration is misused. In this skill context, scheduled tasks amplify risk because a cloud-driven agent can repeatedly access and package local data without fresh user review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Reading clipboard contents without a privacy warning is dangerous because clipboards frequently contain passwords, tokens, personal messages, or confidential business data copied from other applications. Given that this skill bridges cloud bots to local machine state, presenting clipboard access as a simple analysis flow increases the likelihood of inadvertent secret disclosure to remote services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill exposes a write-file tool that creates directories and overwrites files, but there is no confirmation prompt and no user-facing disclosure near the operation itself about modifying local files. The top-level description says the server bridges bots to local capabilities, but it does not specifically warn that remote tool calls can write to disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Exposing shell command execution to a cloud-connected bot is highly dangerous in this skill context because the whole purpose is bridging remote agents to the local machine. Combined with the weak default API key, 0.0.0.0 binding, and the shell=True implementation flaw, this creates a realistic path to full host compromise.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/coze-plugin-setup.md:26

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/server.py:305