ABS · AI Business System

• Outcome: Pass
• Latest audit: Oct 15, 2026 · 3:32 AM UTC
• Version: 1.2.1

Overview

This is a disclosed ABS API integration; its main risks are normal for this kind of tool and center on careful handling of the user's ABS token and uploaded business files.

Install only if you trust the ABS service and are comfortable letting the agent act with your ABS account permissions. Treat the ABS token as a secret, revoke it when no longer needed, and do not upload confidential reports, spreadsheets, documents, or photos unless you have approval to send them to ABS.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Tainted flow: 'request' from os.environ.get (line 154, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/abs.py (reported line 162)May include surrounding context.

python

if data is not None:
        request.add_header("Content-Type", "application/json; charset=utf-8")
    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:
            return response.read()
    except urllib.error.HTTPError as exc:
        raise AbsError(explain(exc), 2 if exc.code == 401 else 3) from None

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This instruction directs the agent to obtain and use the user's ABS access token for higher-privilege operations. Even though the skill says not to repeat the token back, collecting secrets through the conversation channel is risky because chat transcripts, logs, prompt history, or downstream tooling may capture the credential.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

**`search` works right away, with no account or token** — run it first for any question in scope and answer
from what it returns. The other commands (`card`, `ask`, `courses`, `course`, `plan`, `diagnose`, `page`) need
the user's ABS access token:

1. Run `python3 scripts/abs.py whoami` to see whether a token is connected.
2. If there is none (or it was rejected) and the user needs more than search, ask them:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

This finding is the same risky behavior from another matcher on the same line: directing users to generate access tokens and share them through the chat interface. The danger is heightened by the skill's ability to perform network calls, planning, diagnosis, and file-based operations as the authenticated user once the token is stored.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

1. Run `python3 scripts/abs.py whoami` to see whether a token is connected.
2. If there is none (or it was rejected) and the user needs more than search, ask them:
   “Please create an access token in ABS → **Personal Settings → Access tokens**, copy it, and paste it here.”
   中文：「请在 ABS 的**个人设置 → 访问令牌**里生成一个令牌，复制后发给我。」
3. Run `python3 scripts/abs.py login <token>`. It checks the token and saves it in the user's config file
   (readable only by the user). **Never repeat the token back in the conversation.**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

This finding is the same risky behavior from another matcher on the same line: directing users to generate access tokens and share them through the chat interface. The danger is heightened by the skill's ability to perform network calls, planning, diagnosis, and file-based operations as the authenticated user once the token is stored.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

1. Run `python3 scripts/abs.py whoami` to see whether a token is connected.
2. If there is none (or it was rejected) and the user needs more than search, ask them:
   “Please create an access token in ABS → **Personal Settings → Access tokens**, copy it, and paste it here.”
   中文：「请在 ABS 的**个人设置 → 访问令牌**里生成一个令牌，复制后发给我。」
3. Run `python3 scripts/abs.py login <token>`. It checks the token and saves it in the user's config file
   (readable only by the user). **Never repeat the token back in the conversation.**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

#!/usr/bin/env python3
"""ABS Skill command line: lets an AI agent use ABS (AI Business System) with the user's access token.

No third-party packages; Python 3.8+. Run `python3 abs.py --help`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

#!/usr/bin/env python3
"""ABS Skill command line: lets an AI agent use ABS (AI Business System) with the user's access token.

No third-party packages; Python 3.8+. Run `python3 abs.py --help`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api.md (reported line 4)May include surrounding context.

md

#!/usr/bin/env python3
"""ABS Skill command line: lets an AI agent use ABS (AI Business System) with the user's access token.

No third-party packages; Python 3.8+. Run `python3 abs.py --help`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/abs.py (reported line 2)May include surrounding context.

python

#!/usr/bin/env python3
"""ABS Skill command line: lets an AI agent use ABS (AI Business System) with the user's access token.

No third-party packages; Python 3.8+. Run `python3 abs.py --help`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/abs.py (reported line 35)May include surrounding context.

python

#!/usr/bin/env python3
"""ABS Skill command line: lets an AI agent use ABS (AI Business System) with the user's access token.

No third-party packages; Python 3.8+. Run `python3 abs.py --help`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/abs.py (reported line 176)May include surrounding context.

python

#!/usr/bin/env python3
"""ABS Skill command line: lets an AI agent use ABS (AI Business System) with the user's access token.

No third-party packages; Python 3.8+. Run `python3 abs.py --help`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/abs.py (reported line 185)May include surrounding context.

python

#!/usr/bin/env python3
"""ABS Skill command line: lets an AI agent use ABS (AI Business System) with the user's access token.

No third-party packages; Python 3.8+. Run `python3 abs.py --help`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/abs.py (reported line 261)May include surrounding context.

python

#!/usr/bin/env python3
"""ABS Skill command line: lets an AI agent use ABS (AI Business System) with the user's access token.

No third-party packages; Python 3.8+. Run `python3 abs.py --help`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

TIMEOUT_FAST, TIMEOUT_SLOW = 60, 180  # plans and diagnoses run AI models on the server
NO_TOKEN = (
    "`search` works without a token. To read whole tool cards, ask ABS, see courses, plan or diagnose, "
    "ask the user to create an access token in ABS → Personal Settings → Access tokens "
    "(个人设置 → 访问令牌), then run `login <token>`."
)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/abs.py (reported line 35)May include surrounding context.

python

TIMEOUT_FAST, TIMEOUT_SLOW = 60, 180  # plans and diagnoses run AI models on the server
NO_TOKEN = (
    "`search` works without a token. To read whole tool cards, ask ABS, see courses, plan or diagnose, "
    "ask the user to create an access token in ABS → Personal Settings → Access tokens "
    "(个人设置 → 访问令牌), then run `login <token>`."
)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/abs.py (reported line 177)May include surrounding context.

python

TIMEOUT_FAST, TIMEOUT_SLOW = 60, 180  # plans and diagnoses run AI models on the server
NO_TOKEN = (
    "`search` works without a token. To read whole tool cards, ask ABS, see courses, plan or diagnose, "
    "ask the user to create an access token in ABS → Personal Settings → Access tokens "
    "(个人设置 → 访问令牌), then run `login <token>`."
)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/abs.py (reported line 250)May include surrounding context.

python

TIMEOUT_FAST, TIMEOUT_SLOW = 60, 180  # plans and diagnoses run AI models on the server
NO_TOKEN = (
    "`search` works without a token. To read whole tool cards, ask ABS, see courses, plan or diagnose, "
    "ask the user to create an access token in ABS → Personal Settings → Access tokens "
    "(个人设置 → 访问令牌), then run `login <token>`."
)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 81% confidence

Finding

The login command accepts a bearer token as a positional CLI argument. On many systems, command-line arguments are visible to other local users via process listings, shell history, audit logs, or job-control tools, so a valid ABS token may be exposed during login.

Content

Scanner excerpt · scripts/abs.py (reported line 232)May include surrounding context.

python

token = args.token_value.strip()
    if not token.startswith(TOKEN_PREFIX):
        raise AbsError(
            f"That does not look like an ABS access token (it should start with {TOKEN_PREFIX}).", 1
        )
    base, _ = resolve(args)
    me = call(base, token, "GET", "/me")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

The CLI parser defines login TOKEN, again requiring the access token to be supplied as a positional argument. In the context of an agent skill handling user credentials, this increases local secret-exposure risk through shell history and process inspection.

Content

Scanner excerpt · scripts/abs.py (reported line 464)May include surrounding context.

python

sp.set_defaults(handler=handler)
        return sp

    add("login", cmd_login, "check an access token and save it for this user", lang=False).add_argument(
        "token_value", metavar="TOKEN"
    )
    add("logout", cmd_logout, "remove the saved token from this computer", lang=False)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes local Python scripts and, by design, uses shell, network, file read/write, and environment access, but it does not declare any explicit tool scope or permissions boundary. This increases the blast radius of misuse because the agent may be allowed broader capabilities than users or platform policy expect, especially when handling tokens, files, and uploaded diagnostics.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation states that the user's bearer token is sent on every authenticated API call, but it does not include any user-facing warning about credential handling, scope, or privacy implications. In an agent-skill context, this can cause users or integrators to unknowingly authorize broad data access and transmission to a third-party service, increasing the chance of inappropriate token exposure or consent failures.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The diagnosis endpoint accepts company information and base64-encoded file contents, which may include sensitive operational, commercial, or personal data, yet the documentation gives no warning that this data will be uploaded to an external service. In this skill's business-diagnostics context, users are especially likely to submit proprietary internal documents, making silent transmission materially risky.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The file documents external transmission of queries, tokens, and potentially uploaded business content to a remote domain (for example, ucai.net). External transmission is expected for an API integration, but in a security review of an agent skill it remains a real data-flow risk because business questions, source materials, and authentication data leave the local trust boundary.

Content

Scanner excerpt · references/api.md (reported line 39)May include surrounding context.

403 the role cannot do it; 404 not found or not visible; 413 file too large; 429 too many calls; 503 the AI model is unavailable.

curl

bash

curl -H "Authorization: Bearer $ABS_TOKEN" "https://www.ucai.net/api/agent/v1/search?q=SMED&lang=en"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition is overly broad because it activates ABS for generic requests about 'running operations or a business the lean / operational-excellence way,' which can match many business questions beyond the skill's narrowly intended domain. Over-broad routing can cause the agent to invoke this skill unnecessarily, exposing user data to the tool, creating incorrect tool-selection behavior, and making prompt-injection or unsafe downstream actions more reachable.

Content

No source excerpt is available for this finding.

Tainted flow: 'data' from pathlib.Path.read_text (line 59, file read) → pathlib.Path.write_bytes (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/abs.py (reported line 440)May include surrounding context.

python

base, token = resolve(args)
    data = fetch(base, token, "GET", f"/pages/{urllib.parse.quote(args.pdf)}/{args.page}", accept="image/png")
    target = Path(args.out or f"abs-page-{Path(args.pdf).stem}-p{args.page}.png")
    target.write_bytes(data)
    print(
        f"Saved page {args.page} of {args.pdf} to {target.resolve()} ({len(data)} bytes). Open it to check."
    )

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The line states that lang is zh or en, which imposes a fixed language set. Under the policy, language restrictions should either be user-selectable with clear opt-in or justified as a documented locale-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.