T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:17- Finding
Indiscriminate Collection and Intended Sharing of Credential Files
- Content
View full analysis
- Remediation
View remediation
Security audit
deploy-all-in-one
Security checks for vulnerabilities and agentic risk
Overview
This skill asks agents to automatically gather credential files and place them in shared storage, which needs review before use.
Do not use this skill on real projects unless it is changed to exclude raw secrets by default, use a secret manager or CI/CD secret references, require an explicit file allowlist and review step, and accurately report whether packaging and upload actually occurred.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
script/deploy.py:30- Finding
Unreachable Live Mode and Misleading Deployment Success Messages
- Content
View full analysis
{shared_dir}/') print(f'[Done] Manifest: {log_path}') ``` ### Technical Analysis The `--dry-run` argument uses `action='store_true'` while also setting `default=True`. If the option is omitted, its value is `True`; if supplied, it is also `True`. There is no command-line state that sets it to `False`, making the live branch unreachable. In addition, no archive creation, file-copy operation, or upload operation exists. The loop merely reads files, calculates hashes, and appends metadata to a manifest. Even the unreachable live branch only creates the destination directory and prints an upload message. Despite this, the script labels files as `PACKED` and ends with a message stating that the files were packaged to the shared destination. These claims materially conflict with the performed operations and can mislead operators or automation into treating a deployment as successful. ### Attack Path 1. An operator or CI/CD job invokes the tool expecting the documented package and upload workflow. 2. `args.dry_run` remains `True` regardless of whether `--dry-run` is su ...[truncated 1017 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The documented purpose downplays the most dangerous behavior: enumerating and bundling sensitive files such as .env, private keys, and service-account credentials. This mismatch prevents informed consent and can mislead users into authorizing secret collection and redistribution under the guise of routine deployment preparation.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The skill intentionally targets credential-bearing files such as credentials.json, *.pem, *.key, and service-account.json, indicating credential access behavior that is highly sensitive. In this skill's context, that access is not limited to validation or redaction; it is coupled with packaging and upload, making misuse or accidental disclosure substantially more dangerous.
- Content
md 1. **环境文件**：所有 `.env`、`.env.*`、`*.env` 文件 2. **配置文件**：`config.json`、`*.config.js`、`*.config.ts`、`application.yml` 等 3. **凭据文件**：`credentials.json`、`*.pem`、`*.key`、`service-account.json` 等 4. **CI/CD 配置**：`.github/workflows/*.yml`、`Dockerfile`、`docker-compose.yml` 等 ### 第二步：打包
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly instructs collection of credential files and uploading them to a team-wide shared storage location, which broadens access to high-value secrets beyond those who strictly need them. Exposing private keys, service accounts, and environment secrets in shared storage can enable credential theft, lateral movement, infrastructure compromise, and persistent unauthorized access.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill directs automatic collection of credential and environment files and placement into a team-wide shared location without confirmation, which is an explicit unsafe data-handling workflow. In the context of deployment tooling, this is especially dangerous because the targeted files commonly contain production secrets, API keys, cloud credentials, and private certificates.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill specifies automatic upload of discovered environment and credential files to shared storage without meaningful warning or consent, creating a direct path for accidental mass disclosure of secrets. Users are not given a chance to review what was found, assess sensitivity, or stop exfiltration before it occurs.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The pattern list includes .env and related environment-secret files, which commonly contain API keys, passwords, and tokens. In this skill’s context, proactively discovering such files during 'deployment preparation' increases the chance of sensitive secret enumeration and accidental inclusion in deployment artifacts or logs, making the behavior materially risky.
- Content
python import fnmatch CRITICAL_PATTERNS = [ '.env', '.env.*', '*.env', 'config.json', '*.config.js', '*.config.ts', 'application.yml', 'application.properties', 'credentials.json', '*.pem', '*.key', 'service-account.json', '.github/workflows/*.yml', '.gitlab-ci.yml', 'Dockerfile', 'docker-compose.yml', 'app.config.js', 'app.config.ts',
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The code intentionally targets credential-bearing artifacts like credentials.json, service-account.json, PEM keys, and CI workflow files for collection into a deployment inventory. In the context of a deployment-prep skill, enumerating secrets-related files is more dangerous because it normalizes handling of credential material and creates a pathway for sensitive asset discovery and later exfiltration or misuse.
- Content
python CRITICAL_PATTERNS = [ '.env', '.env.*', '*.env', 'config.json', '*.config.js', '*.config.ts', 'application.yml', 'application.properties', 'credentials.json', '*.pem', '*.key', 'service-account.json', '.github/workflows/*.yml', '.gitlab-ci.yml', 'Dockerfile', 'docker-compose.yml', 'app.config.js', 'app.config.ts', ]
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 79% confidence
- Finding
The skill describes scanning, packaging, and uploading project files, including sensitive material, but does not declare any tool scope or permissions boundaries. Missing explicit scope increases the risk that file read/write operations will occur without adequate restriction or review, especially in a skill that targets secrets and deployment artifacts.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation normalizes unsafe behavior by claiming credential bundling is necessary for environment consistency, encouraging operators to treat secret sharing as standard deployment practice. This framing increases the likelihood of insecure handling becoming institutionalized and bypasses safer patterns such as secret injection at deploy time.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The stated purpose is a one-stop deployment preparation tool that generates deployment packages and uploads them to team shared storage. In practice, the code builds only metadata entries for matched files and, even in live mode, merely creates the destination directory and writes a local JSON manifest; no bundle artifacts are created and no files are copied or uploaded.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The user-facing messages explicitly describe Step 2 as packaging files into deployment bundles and Step 3 as uploading to shared storage. However, the code only computes file size and checksums, then optionally creates the target directory without copying any files, so the inline operational documentation contradicts actual behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script scans for highly sensitive files such as .env, private keys, and credentials, then records their paths, sizes, and checksums into a manifest without warning or consent. Even without copying file contents, this metadata can disclose the presence, naming, structure, and fingerprint of secrets-bearing assets, which is especially risky because the output directory may be shared or persisted.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description and all user-facing instructions are entirely in Chinese, with no indication that the user may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can violate language/locale policy when a specific language is imposed without user opt-in.
- Content