Security audit

informat

Security checks across malware telemetry and agentic risk

Overview

The skill matches its Informat platform-management purpose, but it exposes broad admin, data-mutation, code-execution, web, email, and credential-adjacent capabilities that need careful review before installation.

Install only for trusted users who are allowed to administer the target Informat team/apps and mutate production data. Use a least-privilege Informat agent token, avoid granting this skill in shared or untrusted sessions, review generated scripts before saving or running them, and require explicit human confirmation for deletes, publishing, outbound email/web calls, token access, and any script that invokes system/process/eval capabilities.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (87)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill explicitly relies on runtime-injected environment-backed secrets and identifiers such as INFORMAT_HOST, INFORMAT_AGENT_TOKEN, and INFORMAT_AGENT_THREAD_ID, and it invokes local Node tooling with broad platform access, yet it does not declare permissions or constraints for env/secret use. This creates a capability mismatch: an orchestrator or reviewer may treat the skill as lower-privilege than it really is, increasing the chance of unsafe deployment or unintended secret exposure through spawned commands, logs, or downstream scripts.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documentation explicitly exposes `informat.system.runProcess(args)` for arbitrary system command execution, including passing command arrays and timeouts, which materially expands the skill from platform automation into host-level command execution. In a multi-tenant low-code environment, this is dangerous because generated scripts could be induced to run shell commands, access local files, invoke interpreters, or pivot beyond intended platform boundaries if the runtime is insufficiently sandboxed.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The document states that only methods provided in the document may be used, and the module index later defines the approved SDK surface, but `informat.system.runProcess` is introduced separately outside that indexed API set. This inconsistency weakens trust boundaries and reviewability, making it easier for high-risk capabilities to be smuggled into generated scripts or overlooked by users and controls that rely on the documented module inventory.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The documented `informat.app.eval(script)` API enables arbitrary JavaScript execution from a string, which materially expands this app-operations surface into a code-execution primitive. In an agent skill context, any LLM- or user-influenced input reaching this API can become remote code execution within the platform script environment, allowing abuse of other privileged APIs, data access, and destructive actions.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The APIs `weworkAccessToken`, `dingtalkAccessToken`, `feishuAccessToken`, and `feishuTenantAccessToken` expose live third-party integration credentials directly through an application helper object. In an agent skill, this creates a secret-exfiltration path and enables unauthorized calls to external enterprise services, potentially crossing application boundaries and impacting messaging, directory, or automation systems.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: `informat.app.appEnvProp(id)` provides direct reads of application environment variables, which commonly contain secrets, internal endpoints, and sensitive configuration. In the skill context this broadens the feature from app operations into general secret/config disclosure, and an agent could leak or misuse values without additional safeguards.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The documented `informat.system.runProcess` API exposes arbitrary OS command execution from within the skill environment. In a platform-operations skill, this materially expands the attack surface to host-level execution, enabling command injection, data exfiltration, persistence, or destructive system changes if an agent or script can invoke it.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: `informat.system.runNodeJS` allows spawning NodeJS subprocesses with attacker-controlled script path, command-line arguments, stdin, and environment variables. This is effectively arbitrary code execution on the host/runtime and is especially dangerous because env injection and script selection can be combined to bypass intended application boundaries.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: `informat.system.invokeLibrary` permits invocation of arbitrary static methods from extension libraries by identifier, class name, and method name. That creates a broad external code-execution primitive outside the declared platform-management purpose, allowing unreviewed or overly powerful libraries to execute sensitive operations.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The documentation exposes a utility function that returns system environment variables, which can include sensitive values such as credentials, tokens, internal paths, host details, or SSH-related metadata. In an agent/platform scripting context, this meaningfully expands information disclosure risk because downstream scripts may read and exfiltrate host environment data without any documented restriction, warning, or least-privilege justification.

Context-Inappropriate Capability

High

Confidence: 90% confidence
Finding: The schema permits agents to be configured with `_web_content`, enabling outbound network/web retrieval that is not constrained in the schema. This can be abused for data exfiltration, prompt injection ingestion, SSRF-like access depending on backend implementation, or retrieval of untrusted content that influences agent behavior.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The schema permits agents to be configured with `_web_content`, enabling outbound network/web retrieval that is not constrained in the schema. This can be abused for data exfiltration, prompt injection ingestion, SSRF-like access depending on backend implementation, or retrieval of untrusted content that influences agent behavior.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The file defines a function named _javascript_eval whose explicit purpose is to execute arbitrary JavaScript provided as a string. That is a broad code-execution primitive unrelated to a narrowly scoped Informat operation and can be abused to run unintended logic, bypass higher-level safety controls, or process attacker-supplied code if exposed through an agent workflow.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill includes a generic HTTP client that can access arbitrary public URLs with configurable method, headers, body, and redirect behavior, which is broader than the stated Informat-platform scope. In an agent skill, this expands the attack surface for prompt-influenced data exfiltration, untrusted content retrieval, and use as a relay to interact with third-party services unrelated to the platform task.

Intent-Code Divergence

Low

Confidence: 90% confidence
Finding: The description claims the function is only for fetching public web resources, but the schema permits POST requests, custom headers, and request bodies/forms, enabling outbound data submission. This mismatch can mislead reviewers and downstream policy layers, causing them to underestimate the capability and associated exfiltration or misuse risk.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The activation rule is extremely broad: it auto-loads whenever the user mentions Informat or many generic platform features such as APIs, scripts, tables, dashboards, schedules, and records. Over-broad triggering increases the chance that high-impact operational instructions are injected into unrelated conversations, causing accidental execution paths, unintended data access, or destructive admin actions in contexts where the user did not intend to use this privileged skill.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The skill instructs the agent to maintain and rewrite a local progress file across conversations, but it does not require user notice or consent for that persistent local state. Even if the file only stores operational metadata, silent persistence can retain app IDs, workflow identifiers, or business context longer than expected and may leak across sessions, users, or resumptions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation explicitly exposes APIs that return platform access tokens for WeCom, DingTalk, and Feishu without any adjacent warning about secrecy, storage, logging, or least-privilege handling. In an agent skill context, this can normalize unsafe use of bearer tokens in generated scripts or automations, increasing the chance of credential leakage and unauthorized access to connected enterprise services.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The documentation describes retrieval of HTTP headers and request IP data but does not warn that these may contain personal data, authentication material, or spoofable values depending on deployment. In an agent setting, omission of privacy and trust-boundary guidance can lead developers to collect, log, or make authorization decisions from this data unsafely.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation presents MD5 as a generic encoding-related function without any warning that MD5 is cryptographically broken and unsuitable for passwords, signatures, or integrity/security-sensitive uses. In a low-code platform context, users may copy this example into workflows, scripts, or APIs and incorrectly rely on MD5 for security, leading to weak authentication or collision-prone integrity checks.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: These APIs document bulk retrieval of user and department information, including role lists, department membership, names, and other directory metadata, without any warning about authorization, least privilege, or privacy constraints. In a platform skill for operating the Informat system, this omission is more dangerous because users may assume unrestricted use is acceptable and build automations or scripts that enumerate personnel data beyond intended access boundaries.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The documented hierarchy and department traversal APIs enable discovery of reporting chains, leaders, parent departments, and recursive child department structures, but the documentation provides no warning that these functions can expose sensitive organizational topology. In the context of an enterprise platform skill, this increases risk of internal reconnaissance, privilege targeting, and broad org-chart enumeration if developers or agents use these methods without enforcing authorization controls.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation advertises highly privileged plugins such as web access, code execution, record insert/update/delete, script execution, and outbound email/notification capabilities without pairing them with any security guidance, approval requirements, or least-privilege constraints. In an AI assistant context, this is dangerous because prompt misalignment, prompt injection, or user abuse could lead operators to enable powerful actions without understanding the risk, increasing the chance of data loss, unauthorized access, spam, or remote interaction through the assistant.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document describes direct HTTP invocation of automations, including passing arguments via a URL query parameter, but does not warn about authentication, authorization, transport security, logging exposure, or sensitive data leakage through URLs. In a low-code automation platform, this omission can lead users to expose internal automations or send secrets in ways that are captured by browser history, proxies, and server logs.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation explicitly exposes functions that retrieve highly sensitive execution-context secrets and metadata, including WeCom, DingTalk, and Feishu access tokens, HTTP headers, clipboard contents, and request IP. In a skill intended to guide an agent on how to operate the platform, documenting these capabilities without strong guardrails, least-privilege guidance, or warnings about credential handling materially increases the risk of secret exfiltration, impersonation, unauthorized API calls, and privacy violations.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/doc/markdown/script/app.md:370

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/doc/markdown/script/codec.md:218

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/doc/markdown/script/system.md:361