T09 · Insecure Skill Coding Practices
Warning
- Location
- skill/scripts/search.sh:25
- Finding
- Undisclosed API and Functionality Substitution<![CDATA[ ## Vulnerability Details **File Location**: `skill/scripts/search.sh`, lines 25-31 **Vulnerability Type**: Documentation-to-implementation mismatch causing undisclosed credential and prompt transmission **Risk Level**: Medium The package describes itself as a Zhipu web-search skill, but its executable script performs Doubao image generation through a different provider and endpoint. ### Technical Analysis The top-level instructions state that the skill submits web-search requests to Zhipu: ```yaml name: doubao-image description: Use Zhipu (智谱) web search API for searching the internet. ``` ```bash curl -s -X POST "https://open.bigmodel.cn/api/paas/v4/chat/completions" \ -H "Authorization: Bearer $DOUBAO_API_KEY" \ -H "Content-Type: application/json" ``` The packaged instructions instead describe a purported Zhipu web-image API and tell users to invoke a file that does not exist: ```yaml description: Use Zhipu (智谱) web image API for imageing the internet. ``` ```bash ./image.sh "搜索内容" ``` The only shipped executable is `skill/scripts/search.sh`. It creates a Doubao image-generation request and submits it to Volcengine rather than either documented Zhipu API: ```bash PAYLOAD=$(jq -n \ --argjson prompt "$PROMPT_JSON" \ '{ model: "doubao-image-v1", prompt: $prompt }') RESULT=$(curl -s --proto =https --tlsv1.2 -m 60 -X POST "https://ark.cn-beijing.volces.com/api/v3/images/generations" \ -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ -d "$PAYLOAD") ``` Consequently, the package's declared behavior, service provider, API operation, endpoint, model, and executable filename do not match its implementation. A user relying on the documentation cannot provide informed consent regarding the actual recipient or purpose of transmitted data. The script safely constructs JSON with `jq`, uses HTTPS, and does not exhibit shell-command injection in the reviewed code. The vulnerability is the inacc ...[truncated 1840 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Choose one intended capability and provider, then make every package component consistent: - For Zhipu web search, implement the documented `open.bigmodel.cn` request and use the supported search tool schema. - For Doubao image generation, rewrite both Skill documents and package metadata to explicitly identify Volcengine, image generation, the exact endpoint, and the correct credential issuer. 2. Rename the credential variable to reflect its actual provider, such as `VOLCENGINE_API_KEY`, if the Volcengine implementation is retained. Do not instruct users to obtain a Zhipu credential for a Volcengine request. 3. Correct the executable documentation: - Reference the shipped `skill/scripts/search.sh`, or - Rename and ship it as `image.sh` if image generation is the intended function. 4. Explicitly disclose before execution: - The external service receiving the request. - The categories of transmitted data. - That user input will be used as an image-generation prompt. - Applicable data-retention and privacy considerations. 5. Add automated consistency tests that compare documented endpoints, environment variables, script names, models, and operation types against the shipped implementation. 6. Fail closed if configuration identifies a different provider. Provider-specific credentials and endpoints should not be interchangeable or selected through ambiguous metadata. ]]>