T09 · Insecure Skill Coding Practices
Error
- Location
scripts/iflow_common.py:20- Finding
Bearer Credentials Can Be Redirected to an Arbitrary API Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
iflow-nb
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real iflow knowledge-base integration, but it grants broad remote storage, sharing, deletion, and credentialed API authority with several under-scoped safety controls.
Review this skill before installing. Use it only for content you are comfortable sending to iflow, avoid secrets or regulated data, pin installer versions, store the API key with restrictive permissions, keep IFLOW_BASE_URL unset unless you fully trust the endpoint, and require explicit confirmation before all-file generation, sharing links, imports, and any delete or batch-delete action.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pipeline_web_search.py:52- Finding
Unvalidated Search Report URL Enables Server-Side Request Forgery and Data Relay
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
README.md:37- Finding
Recommended API-Key Storage Does Not Enforce Restrictive File Permissions
- Content
View full analysis
~/.config/iflow-nb/api_key # Option B - Environment variable export IFLOW_API_KEY="your_api_key" ``` The runtime reads the file without checking its permissions, owner, or file type: ```python config_path = Path.home() / ".config" / "iflow-nb" / "api_key" if config_path.exists(): key = config_path.read_text().strip() ``` ### Technical Analysis The recommended setup relies entirely on the user's current `umask`. It does not explicitly apply mode `0700` to the credential directory or mode `0600` to the API-key file. In an environment with a permissive `umask`, the resulting key file may be readable by other local users. The loader also does not reject symbolic links, files owned by another account, or files with group/world-readable permissions. A local attacker who can replace the file through a writable directory or symlink condition could also influence which credential is loaded, although practical exploitability depends on local filesystem permissions. ### Attack Path 1. A user follows the recommended setup command in an environment with permissive default file permissions. 2. The API-key file is created with group-readable or world-readable permissions. 3. Another local account or process reads `~/.config/iflow-nb/api_key`. 4. The attacker uses the recovered credential against the iflow API. 5. The attacker gains the same API capabilities granted to the victim's key. ### Impact Assessment The scope is limited to attackers with local filesystem access, but successful exploitation exposes the complete bearer credential. Resulting privileges may include access to knowledge bases, files, generated reports, sharing operations, content modification, deletion operations, and ser ...[truncated 57 chars]- Remediation
View remediation
"$HOME/.config/iflow-nb/api_key" chmod 600 "$HOME/.config/iflow-nb/api_key" ``` The loader should additionally: 1. Use `lstat()` and reject symbolic links. 2. Require the credential file to be a regular file. 3. Verify that the current user owns the file. 4. Reject group-readable, group-writable, world-readable, or world-writable modes. 5. Verify that the parent directory is not writable by untrusted users. 6. Prefer an operating-system credential manager or secret-management service where available. 7. Document environment-variable leakage risks in process managers, debug dumps, CI logs, and child processes. 8. Apply the same corrected instructions in both `README.md` and `SKILL.md`. ]]>
T08 · Insecure Dependencies
Warning
- Location
README.md:20- Finding
Installation Instructions Execute an Unpinned Third-Party Package
- Content
View full analysis
- Remediation
View remediation
install iflow-nb ``` 2. Publish and verify integrity hashes or signed release attestations. 3. Document the expected package publisher, version, checksum, and verification procedure. 4. Prefer downloading a signed, immutable Skill archive when installation does not require executable package logic. 5. Use a lockfile and integrity metadata for dependencies involved in the installation process. 6. Run installation in a restricted environment without unrelated credentials or sensitive environment variables. 7. Regularly review the pinned version and update it only after security verification. 8. Consider recommending `npm exec --ignore-scripts` where compatible, while noting that this does not prevent execution of the requested package's primary command. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The declared purpose emphasizes broad knowledge-base assistance, but the documented behavior includes destructive file deletion and renaming flows that are not clearly surfaced in the high-level description. That mismatch can mislead users and orchestration layers about the real risk profile, causing destructive operations to be triggered under a benign-seeming skill label.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger conditions are extremely broad and match ordinary phrases like '记一下', '帮我记个笔记', or '存一下这个信息', causing the skill to activate for common conversation that may not imply consent to external storage or content generation. In this context, over-triggering is dangerous because the skill can upload user text, files, or URLs to a remote service and even create/share knowledge-base artifacts.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill documents that if no files are specified, generation should use the entire knowledge base by default. That creates a clear data-minimization and unintended disclosure risk, because a vague request can cause all stored documents to be processed and potentially surfaced in generated outputs without the user realizing the scope.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction to not ask the user and to directly use all files materially increases the chance of silent over-collection. In a knowledge-base skill, users may store mixed personal, internal, or confidential content, so automatic inclusion of all files can expose unrelated sensitive material in reports, PPTs, podcasts, or other generated artifacts.
- Content
Tainted flow: 'files' from open (line 65, file read) → requests.post (network output)
High
- Category
- Data Flow
- Confidence
- 80% confidence
- Finding
File contents flow to a network sink. This may indicate data exfiltration of sensitive files.
- Content
python if file_path: data = {"collectionId": collection_id, "type": file_type} files = {"file": (os.path.basename(file_path), open(file_path, "rb"))} r = requests.post(f"{BASE_URL}/api/v1/knowledge/upload", data=data, files=files, headers=headers, timeout=(10, 120)) resp = r.json() files["file"][1].close()
Tainted flow: 'files' from open (line 65, file read) → requests.post (network output)
High
- Category
- Data Flow
- Confidence
- 80% confidence
- Finding
File contents flow to a network sink. This may indicate data exfiltration of sensitive files.
- Content
python ("content", (None, url)), ("file", ("", b"")), # 空文件，兼容 type=HTML 时需要 file 字段 ] r = requests.post(f"{BASE_URL}/api/v1/knowledge/upload", files=files, headers=headers, timeout=(10, 120)) resp = r.json() else:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README advertises delete and batch-management capabilities for notebooks and files but does not warn about irreversible or hard-to-reverse data loss. In an agentic setting, destructive actions may be triggered from natural-language requests, so omission of deletion safeguards increases the risk of accidental loss of user knowledge-base contents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README describes file upload, URL import, web search, and content generation through an external service without warning that user files, URLs, search queries, and generated content may be transmitted to third-party APIs. In this skill’s context, that is materially risky because users may provide confidential documents or sensitive research notes, and broad trigger behavior makes unintended transmission more likely.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### 1. Get an API Key Visit [platform.iflow.cn](https://platform.iflow.cn/profile?tab=apiKey) to create your API key. ### 2. Configure Credentials
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example and surrounding trigger guidance are overly broad and include ordinary note-taking language such as recording daily expenses, which can cause the agent to invoke this skill for routine user inputs that do not clearly imply external storage or content generation. In this skill’s context, that increases the chance of silently transmitting personal notes or incidental sensitive information to the iflow service without sufficiently explicit user intent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documents use of environment variables, local config files, shell commands, file operations, and outbound network access, but it declares no explicit tool scope or allowed-tools boundary. This creates excessive implicit authority: an agent may grant the skill broader capabilities than necessary, increasing the blast radius if the instructions are misused or if prompt injection occurs through user content or imported web pages.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
The setup recommends persisting the API key in a plaintext file under ~/.config/iflow-nb/api_key. Plaintext secret storage increases exposure to local compromise, accidental backup/sync leakage, or unintended reads by other tools and skills with file access.
- Content
bash # 方式 A — 配置文件（推荐） mkdir -p ~/.config/iflow-nb && echo "your_api_key" > ~/.config/iflow-nb/api_key # 方式 B — 环境变量 export IFLOW_API_KEY="your_api_key"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The sharing feature creates a link exposing a read-only snapshot of the entire knowledge base and generated outputs, but the flow lacks a strong user-facing privacy warning at the point of action. Because knowledge bases may contain sensitive notes, uploaded files, and generated reports, accidental sharing could disclose substantial private or proprietary information.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md iflow_api() { local method="$1" path="$2" body="$3" if [ "$method" = "GET" ]; then curl -s -X GET "${IFLOW_URL}${path}" \ -H "Authorization: Bearer $IFLOW_KEY" \ -H "Content-Type: application/json" else
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill example, including user input, workflow instructions, and user-facing output, is written exclusively in Chinese with no indication that language selection is optional or configurable. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file presents all user-facing instructions, examples, and confirmation text exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which it is not here.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The example instructs the agent to immediately create and return a share link for an entire knowledge base, while only mentioning the exposure scope afterward. This can cause unintended disclosure because a user may not realize the link grants read access to all files and generated content in the shared knowledge base before the action is performed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example instructs the agent to write user-pasted content to a local temporary file and then upload it to a remote knowledge base, but it does not require any user notice, consent, or data-sensitivity check before local persistence and network transmission. In a knowledge-management skill, pasted content may contain meeting notes, personal data, credentials, or confidential business information, so silent staging on disk and upload increases privacy and data-handling risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The example instructs the agent to automatically import externally gathered research results and generate derivative artifacts without any explicit user confirmation, retention notice, or warning about persistence. This can cause unintended storage of third-party or sensitive content, trigger side effects the user did not clearly authorize, and increase privacy, compliance, and provenance risks because searched content is persisted into a knowledge base and reused for report generation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example establishes a default workflow where web search results are automatically imported into a knowledge base and then used to generate a report unless the user explicitly asks for a search-only mode. This can cause unintended persistence of third-party content, sensitive queries, or inappropriate material, and may trigger downstream actions with cost, privacy, or compliance consequences without clear user confirmation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly documents a bulk-delete endpoint for files but does not attach the same clear user-confirmation warning that it applies to other destructive actions such as deleting a knowledge base or a single file. In an agent setting, that omission increases the chance the agent performs irreversible mass deletion from a loosely phrased user request or from ambiguous context without a second confirmation step.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
}"
text > **⚠️ 超时设置**：由于接口可能较慢，使用 curl 直接调用时需加 `--max-time 120`： > ```bash > curl -s --max-time 120 -X POST "${IFLOW_URL}/api/v1/knowledge/searchChunk" \ > -H "Authorization: Bearer $IFLOW_KEY" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The API documents a destructive knowledge-base deletion operation as idempotent and straightforward, but provides no guidance that callers should obtain explicit user confirmation or warn about irreversible data loss. In an agent skill that can act on natural-language requests, this increases the risk that ambiguous prompts, prompt injection, or misclassification could trigger permanent deletion without the user's informed consent.
- Content
Static analysis
No suspicious patterns detected.