AI-powered DP Data Processing Pipeline Designer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:41 AM UTC
• Version: 2.0.1

Overview

The skill fits its DP pipeline purpose, but it should be reviewed because it handles an API key, can submit and start jobs, and documents an unencrypted HTTP server example for that key.

Install only if you can configure DP_SERVER_URL with HTTPS and trust the DP platform endpoint. Avoid using the documented HTTP example with a real API key, do not print any part of the key in logs, and confirm that submitted jobs cannot affect production data unless that is intended.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: skill.json:9

Finding

API Key May Be Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: skill.json, line 9
Vulnerability Type: Plaintext transmission of sensitive credentials
Risk Level: High

Vulnerable Code

json

{"name": "DP_SERVER_URL", "required": true, "description": "DP platform service address, for example http://8.130.64.180"}

The quoted description is an English rendering of the metadata value; the security-relevant URL is unchanged.

Technical Analysis

The example configures DP_SERVER_URL with an unencrypted http:// endpoint. According to SKILL.md, every API request must include the DP_API_KEY in the X-DP-API-Key HTTP header. The skill does not require HTTPS or reject plaintext HTTP URLs.

If an operator follows the provided example, requests containing the complete API credential may traverse the network without transport encryption. An attacker with an appropriate network position could inspect the request, recover the header, or modify API traffic.

Attack Path

1. A user configures DP_SERVER_URL using the documented plaintext HTTP example.
2. The agent sends a DP API request with the required X-DP-API-Key header.
3. An attacker capable of observing the relevant network path captures the unencrypted request.
4. The attacker extracts the API key from the header.
5. The attacker uses the stolen credential against the DP API, subject to the permissions and quota assigned to that key.

Impact Assessment

Successful exploitation could disclose the complete DP API key and allow unauthorized API operations within the compromised key's authorization scope. Depending on server-side permissions, this could include viewing, submitting, starting, or monitoring data-processing jobs. The finding does not establish that the key grants administrative or host-level privileges.

Remediation

View remediation

Remediation Suggestions

• Replace the plaintext example with an https:// URL.
• Validate DP_SERVER_URL before making requests and reject the http scheme.
• Permit plaintext transport only through an explicit, narrowly scoped development override that never accepts production credentials.
• Require valid TLS certificate and hostname verification.
• Ensure command output and diagnostic logs redact the X-DP-API-Key header.
• Rotate any API key that may previously have been transmitted over plaintext HTTP.
• Document the expected trust model, certificate requirements, and credential-rotation process.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:50

Finding

API Key Prefix Is Exposed in Command Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 50
Vulnerability Type: Partial sensitive credential disclosure
Risk Level: Low

Vulnerable Code

bash

echo "API Key verified: ${DP_API_KEY:0:8}****"

Technical Analysis

The initialization guidance prints the first eight characters of DP_API_KEY. Although this does not directly expose the complete credential, API keys should be treated as opaque secrets and should not be reproduced in terminal output, agent responses, CI logs, execution transcripts, or monitoring systems.

Revealing a stable prefix reduces the unknown portion of the credential and can help correlate the same key across environments or logs. The practical severity depends on the key format, entropy, and access to the generated output. The audited files do not establish that disclosure of the prefix alone is sufficient to authenticate.

Attack Path

1. A user or automation process runs the documented initialization check.
2. The first eight characters of the API key are written to command output.
3. The output is retained in a terminal transcript, CI log, agent conversation, or centralized logging platform.
4. A party with access to those records obtains the key prefix.
5. The disclosed prefix may be combined with other leaks, predictable key-generation weaknesses, or exposed metadata to identify or narrow recovery of the credential.

Impact Assessment

The immediate impact is partial disclosure of an authentication secret. This may facilitate credential correlation and compound other credential exposures. On the available evidence, the prefix alone does not provide DP API access, so no direct privilege gain is confirmed.

Remediation

View remediation

Remediation Suggestions

• Do not print any portion of DP_API_KEY.

• Replace the output with a non-sensitive status message such as:

  bash

  echo "DP API key is configured."
  

• Configure execution and HTTP tooling to redact authentication headers and sensitive environment variables.

• Prevent secret-bearing command output from being stored in agent transcripts, CI logs, or telemetry.

• Rotate the key if its prefix has been exposed in broadly accessible records and additional leakage is suspected.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation text is broad and loosely scoped: it triggers on generic phrases like creating pipelines, data flows, Flink jobs, Kafka reads, and writing to databases. That can cause the skill to activate in contexts beyond the intended DP platform workflow, increasing the chance of unintended API-oriented guidance, mishandling sensitive infrastructure requests, or interfering with other more appropriate skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The activation description is written as a Chinese-only trigger specification, while the rest of the document is mixed Chinese and English, and there is no statement that the skill supports multiple languages or is limited to a China-specific deployment. This can create a language-policy issue by implicitly constraining invocation behavior to one language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest includes user-facing descriptions for required configuration fields entirely in Chinese, while the rest of the metadata is in English. This creates a locale-specific experience without opt-in or explanation, which matches the policy category for language or locale constraints.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skill.json:9