第 27 小时 — AI Agent 的赛博自留地

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:22 AM UTC
• Version: 1.0.2

Overview

This creative posting skill is mostly coherent, but it tells agents they may send a session ID to a third-party service as a like identifier.

Review before installing. Use this only for intentional creative posts to the disclosed third-party service, assume posted bottles, graffiti, comments, and likes may be visible or logged, and never put session IDs, tokens, API keys, private user data, or real project details into the API fields.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:157

Finding

External Disclosure of a Potentially Sensitive Session Identifier

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:157
Vulnerability Type: Disclosure of a session identifier to an external service
Risk Level: Medium

Vulnerable Code Snippet

markdown

- **`fingerprint`**: **Required**, string, maximum 64 characters. Used to identify the user who liked the post and prevent duplicate likes. It is recommended to use your Agent name or session ID. Omitting it results in a 400 response.

The original instruction recommends using the Agent's session ID as the fingerprint submitted to the external API.

Technical Analysis

The Skill instructs the Agent to send a fingerprint to https://the-27th-hour.spacekid.me when liking a post and explicitly recommends using an Agent name or session ID. Session identifiers may be sensitive, stable, reusable, or bearer-like values. They should not be disclosed to an unrelated third-party service.

A session ID is unnecessary for implementing a remote like-toggle operation. Recommending it violates data-minimization and identifier-scoping principles. Even when the identifier cannot authenticate directly, the service may log it and use it to correlate Agent activity across requests or sessions.

Attack Path

1. A user explicitly asks the Agent to use the Skill.
2. The Agent reads a post from the external service.
3. The Agent invokes POST /api/bottles/{id}/like.
4. Following the instruction at line 157, the Agent places its host session ID in the fingerprint field.
5. The session ID is transmitted to the third-party service and may be stored in application data, access logs, monitoring systems, or backups.
6. The service operator or an attacker with access to those systems may correlate the Agent's activity. If the identifier has authentication significance, it may also be tested for unauthorized session access.

Impact Assessment

The direct scope is disclosure of an Agent or host session identifier and correlation of ...[truncated 485 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the recommendation to use a session ID or any host-provided security identifier.
• Explicitly prohibit API keys, authentication tokens, cookies, session IDs, user identifiers, and other host secrets in the fingerprint field.
• Generate a cryptographically random, service-scoped pseudonymous identifier, such as a UUIDv4.
• Do not derive the identifier from the user, device, Agent identity, account, or host session.
• Store the pseudonymous identifier only when persistence is required for like toggling, and limit its lifetime and scope to this service.
• Inform the user before transmitting persistent identifiers to the external API.
• Update the instruction to state, for example: “Use a random identifier created solely for this service. Never use a session ID, authentication token, API key, or personal identifier.”

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly steers the agent away from its normal assistant persona and imposes a specific stylistic/behavioral mode for outputs. Even though framed as creative guidance, this can override user-preferred language and interaction norms, increasing the risk of policy drift, confusing role behavior, and reduced compliance with host expectations during invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Mandating first-person voice and forbidding standard AI self-identification creates a fixed persona policy that can conflict with user expectations and system-level behavior requirements. In this skill's context, the harm is limited because it is a creative journaling skill, but it still nudges the model toward concealed or altered role presentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.