T09 · Insecure Skill Coding Practices
Error
- Location
references/token-server/README.md:46- Finding
Unauthenticated and Over-Privileged RTC Token Issuance
- Content
View full analysis
- Remediation
View remediation
Security audit
Voice Ai Integration
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for Shengwang voice and RTC integration, but it needs review because its token-server and remote-document guidance can create real security exposure if followed as-is.
Review before installing. If used, do not deploy the token endpoint as written: require caller authentication, authorize channel and UID server-side, avoid wildcard and publisher-by-default tokens, shorten expirations, and add rate limits. Treat fetched docs and cloned samples as untrusted until reviewed, pin or verify token-builder source, keep all secrets server-side, and add consent and retention controls before enabling recording.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
references/token-server/README.md:21- Finding
Unpinned Remote Cryptographic Source Is Copied into Generated Projects
- Content
View full analysis
⚠️ **DO NOT** use `agora-token-builder`, `agora-token`, or any third-party token package from PyPI / npm / Maven. > These are unofficial, outdated, and may generate incompatible tokens (v1 instead of v2). > The ONLY supported source is the official [AgoraDynamicKey](https://github.com/AgoraIO/Tools) repo below. Clone the repo: ```bash git clone --depth 1 https://github.com/AgoraIO/Tools.git ``` After download, find your language under `Tools/DynamicKey/AgoraDynamicKey//src/`: | Language | Source path | Builder file | |----------|------------|--------------| | Go | `go/src/rtctokenbuilder2/` | `RtcTokenBuilder2.go` | | Java | `java/src/main/java/io/agora/media/` | `RtcTokenBuilder2.java` | | Python3 | `python3/src/` | `RtcTokenBuilder2.py` | | Node.js | `nodejs/src/` | `RtcTokenBuilder2.js` | | PHP | `php/src/` | `RtcTokenBuilder2.php` | | C++ | `cpp/src/` | `RtcTokenBuilder2.h` | > Go projects: copy `rtctokenbuilder2` source files into your project. The Tools repo is not a standalone Go module. ``` ### Technical Analysis The Skill instructs users to clone the current default branch of a remote repository and copy token-generation source into their applications. The command is not pinned to a reviewed commit or signed release, and no checksum, signature, or source verification step is required. HTTPS protects the connection to GitHub but does not make repository contents immutable. A compromised upstream account, repository, or future unsafe commit could change the code retrieved after this Skill has been audited. This is especially sensitive because the copied component performs cryptographic token generation ...[truncated 1185 chars]- Remediation
View remediation
``` 5. Document the exact required files and expected hashes for each supported language. 6. Require a source review before copying files that will process the App Certificate. 7. Prefer an official, versioned, integrity-verifiable package or release artifact where available. 8. Add dependency monitoring and periodically review the pinned revision for security fixes. 9. Never automatically update the cryptographic component from the remote default branch during application startup or deployment. ]]>
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:18- Finding
Mutable Remote Documentation Is Trusted Without Integrity or Prompt-Boundary Controls
- Content
View full analysis
**⚠️ Execute this BEFORE any routing or code generation.** Check if `references/docs.txt` already exists. If it does, skip this step entirely. If it does not exist, download it: ```bash bash skills/voice-ai-integration/scripts/fetch-docs.sh ``` This downloads a static doc index from `doc.shengwang.cn` — no user data is sent. If download fails, proceed with local reference docs and fallback URLs. ``` ```markdown Network behavior: - `fetch-docs.sh` downloads a static file from `doc.shengwang.cn/llms.txt` — no user data is sent - `fetch-doc-content.sh` fetches a single doc page by URI from `doc-mcp.shengwang.cn` — only the doc URI is sent, no user context ``` From `scripts/fetch-docs.sh`: ```bash DOCS_URL="https://doc.shengwang.cn/llms.txt" SCRIPT_DIR="$(dirname "$0")" OUTPUT_FILE="${SCRIPT_DIR}/../references/docs.txt" MAX_RETRIES=3 for i in $(seq 1 $MAX_RETRIES); do echo "Downloading doc index (attempt ${i}/${MAX_RETRIES}) ..." if curl -fSL --retry 2 --max-time 120 -o "${OUTPUT_FILE}" "${DOCS_URL}"; then ``` From `scripts/fetch-doc-content.sh`: ```bash DOC_URI="$1" BASE_URL="https://doc-mcp.shengwang.cn/doc-content-by-uri" FULL_URL="${BASE_URL}?uri=${DOC_URI}" if ! curl -fSL --max-time 30 --retry 2 "$FULL_URL" 2>/dev/null; then ``` From `references/doc-fetching.md`: ```markdown ## Step 1: Ensure doc index exists Check if `references/docs.txt` exists. If not, download it: ```bash bash skills/voice-ai-integration/scripts/fetch-docs.sh ``` ## Step 2: Find the document URI Search `references/docs.txt` for keywords. Each entry f ...[truncated 2485 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (41)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Field | Type | Required | Notes | |-------|------|----------|-------| | `token` | string | yes | Volcengine access token | | `app_id` | string | yes | Volcengine app ID | | `voice_type` | string | yes | e.g. `BV700_streaming` | | `cluster` | string | no | e.g. `volcano_tts` |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to execute shell commands and perform network downloads, but it does not declare any explicit tool scope or allowed-tools boundary. That creates a capability mismatch where an agent runtime may permit broader shell use than intended, increasing the risk of arbitrary command execution, unexpected external access, or unsafe follow-on actions if the skill is invoked in the wrong context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger description is very broad and includes generic terms such as AI agent, recording, token, video call, and live streaming, which can cause the skill to activate for unrelated requests. Because the skill can then drive shell-based doc fetching and routing decisions, unintended invocation expands the attack surface and may lead to unnecessary network activity or execution of privileged workflow steps.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This README promotes server-side recording of RTC audio/video to cloud storage but does not mention consent, notification, retention, or legal/privacy obligations. In a developer-facing integration skill, that omission can lead users to deploy recording features that capture conversations without appropriate disclosure or authorization, creating privacy and compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README instructs users that Quickstart requires an App ID and App Certificate and points to token/auth flows, but it does not warn that the App Certificate is a sensitive secret that must never be embedded in client code, committed to repositories, or exposed in logs. In a voice/RTC integration skill, this omission can lead users to handle credentials insecurely during setup, enabling token forgery or unauthorized use of Shengwang services if the certificate leaks.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md def create_agent_with_retry(payload, max_retries=3): for attempt in range(max_retries): resp = requests.post(url, json=payload, headers=headers) if resp.status_code in (200, 201): return resp.json() if resp.status_code in (503, 504):
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file describes an interrupt endpoint whose purpose is to stop an agent from speaking or thinking, but the response text says the returned agent information means 'the agent starts broadcasting specified content.' That is an active contradiction in the documentation, not merely an omission, and could mislead integrators about the side effects of calling this API.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This is a markdown file, so SQP-2 applies to missing warnings in the skill description. The document explains that requests can interrupt the agent immediately and even set
interruptabletofalse, but it presents these as features without a caution about user experience, conversation disruption, or non-interruptible playback.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file documents a configuration-changing API that can materially alter a running agent's behavior. Although it notes that the field will overwrite the creation-time configuration, it does not clearly warn users about the operational impact or advise caution before making the change.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The document includes a directly usable Basic Auth credential construction pattern using customer key and secret, but it does not warn readers to treat these values as secrets, avoid embedding them in client-side code, or store them securely. In API integration documentation, this omission can lead developers to copy the pattern into insecure contexts, increasing the risk of credential exposure and unauthorized API access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file documents an API that returns stored short-term memory, including user and assistant messages. Because the operation exposes potentially sensitive conversation history, the documentation should include a clear privacy warning or handling guidance for users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file describes sending authentication material in the
Authorizationheader, including RTC Token and Basic Auth examples, but it does not include any warning about treating these values as sensitive credentials. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors affecting privacy or system integrity; credential handling is security-sensitive and should be explicitly cautioned.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire skill document, including title, description, and operational instructions, is presented only in Chinese. This can constitute a language/locale policy violation because it imposes a specific language without user opt-in and does not document a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Line L046 defines
properties.asr.languagewith a default of"zh-CN"and presents language handling as a fixed default rather than a user-selected preference. Under the policy rule, forcing a specific language or locale without explicit opt-in is a natural-language policy concern unless clearly justified as region-specific.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "enable_aivad": true }, "llm": { "url": "https://api.minimax.chat/v2/text/chatcompletion_v2", "api_key": "xxx", "system_messages": [ {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "enable_aivad": true }, "llm": { "url": "https://api.minimax.chat/v2/text/chatcompletion_v2", "api_key": "xxx", "system_messages": [ {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "enable_aivad": true }, "llm": { "url": "https://api.minimax.chat/v2/text/chatcompletion_v2", "api_key": "xxx", "system_messages": [ {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md } }, "llm": { "url": "https://api.openai.com/v1/chat/completions", "api_key": "your_openai_api_key", "system_messages": [ {
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The natural-language content, including the title, description, and operational instructions, is fixed to Chinese. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a locale-policy issue.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## 服务器 - `https://api.agora.io/cn/api/conversational-ai-agent`
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## 服务器 - `https://api.agora.io/cn/api/conversational-ai-agent`
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## 服务器 - `https://api.agora.io/cn/api/conversational-ai-agent`
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## 服务器 - `https://api.agora.io/cn/api/conversational-ai-agent`
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## 服务器 - `https://api.agora.io/cn/api/conversational-ai-agent`
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## 服务器 - `https://api.agora.io/cn/api/conversational-ai-agent`
Static analysis
No suspicious patterns detected.