T09 · Insecure Skill Coding Practices
Error
- Location
scripts/guanyuan.js:240- Finding
Stored bearer token can be transmitted to an unrelated configured host
- Content
View full analysis
- Remediation
View remediation
Security audit
guanyuan data
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent GuanYuan data export tool, but it stores and sends API secrets in ways that could expose account tokens or credentials.
Review before installing. Do not paste real tokens into shell commands, avoid storing account passwords in config files, restrict ~/.guanyuan permissions, verify baseUrl before every use, and avoid exporting sensitive data into shared, synced, or source-controlled folders. Expect output files to be overwritten.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/guanyuan.js:185- Finding
Authentication secrets are stored without explicit restrictive filesystem permissions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/guanyuan.js:598- Finding
Documented token argument exposes bearer tokens through command-line metadata
- Content
View full analysis
``` ```js console.log(' guanyuan token eyJ0eXAiOiJKV1QiLCJhbGci...'); ``` ### Technical Analysis Bearer tokens supplied as command-line arguments can be exposed through shell history, process listings, process accounting, audit systems, terminal telemetry, command logging, and diagnostic collection. The implementation offers an interactive alternative, but the token is accepted directly from `process.argv`, and the unsafe form is explicitly promoted in the Skill instructions and CLI help. This makes accidental secret disclosure likely. Additionally, the interactive path uses ordinary `readline` input and does not disable terminal echo, so the token remains visible while it is entered. ### Attack Path 1. The user follows the documented example and runs `guanyuan token `. 2. The shell records the complete command in history, or the operating system exposes the argument through process inspection or accounting. 3. A local user, support bundle, monitoring service, or logging system captures the command line. 4. The bearer token is extracted. 5. The observer reuses the token against the GuanYuan API until it expires or is revoked. ### Impact Assessment The observer obtains the same GuanYuan API privile ...[truncated 335 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - **Password Handling**: Passwords are automatically Base64 encoded before API call - **URL Support**: baseUrl can include protocol prefix (http:// or https://) - **CSV Escaping**: Special characters (commas, quotes, newlines) are properly escaped - **File Safety**: Existing files are overwritten without warning - **Data Limits**: Use `--limit` to control API response size - **Sampling**: Use `--sample` to export only N rows without fetching all data - **No Credentials Required**: Can work with just baseUrl + domain + token command
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill documents code capabilities involving environment access but does not declare any tool scope or permission boundaries. Missing explicit scope increases the chance that an agent or user enables broader access than intended, reducing reviewability and making misuse of local secrets or runtime context easier.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation explicitly allows
guanyuan token <token>on the command line without warning that command arguments may be recorded in shell history or exposed via process listings. This can leak long-lived bearer tokens to other local users, monitoring tools, terminal logs, or incident artifacts.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs users to store API credentials and tokens in
~/.guanyuan/config.jsonand~/.guanyuan/user.tokenwithout warning that these are sensitive secrets. Local plaintext secret storage can lead to credential theft from backups, shared accounts, weak filesystem permissions, or accidental disclosure during support and debugging.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill states that existing files are overwritten without warning but provides no safeguards or guidance to prevent accidental data loss. In a data-export tool, this is especially risky because exports may destroy existing local files or overwrite prior datasets and metadata without user confirmation.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
export PATH="$PATH:~/workload/skills/guanyuan-data"
或创建软链接到 /usr/local/bin
sudo ln -sf ~/workload/skills/guanyuan-data/index.js /usr/local/bin/guanyuan
text ## 配置
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README explicitly instructs users to place a plaintext password in ~/.guanyuan/config.json and states that a token will be auto-saved locally. Storing long-lived credentials and session tokens unencrypted on disk materially increases the risk of credential theft from local compromise, backups, shared accounts, or accidental disclosure.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The documented setup creates persistent local storage for credentials in ~/.guanyuan/config.json, including the account password, which extends the exposure window far beyond a single session. This persistence increases the likelihood that secrets are recovered by malware, local attackers, backups, or accidental disclosure.
- Content
创建配置文件
~/.guanyuan/config.json：bash mkdir -p ~/.guanyuan cat > ~/.guanyuan/config.json << 'EOF' { "baseUrl": "https://your-guanyuan-domain.com",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API 参考 - [用户登录 API](https://api.guandata.com/apidoc/docs-site/345092/710/api-3470502) - [获取卡片数据 API](https://api.guandata.com/apidoc/docs-site/345092/710/api-3471043) ## 技术栈
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API 参考 - [用户登录 API](https://api.guandata.com/apidoc/docs-site/345092/710/api-3470502) - [获取卡片数据 API](https://api.guandata.com/apidoc/docs-site/345092/710/api-3471043) ## 技术栈
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API 参考 - [用户登录 API](https://api.guandata.com/apidoc/docs-site/345092/710/api-3470502) - [获取卡片数据 API](https://api.guandata.com/apidoc/docs-site/345092/710/api-3471043) ## 技术栈
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## API 参考 - [用户登录 API](https://api.guandata.com/apidoc/docs-site/345092/710/api-3470502) - [获取卡片数据 API](https://api.guandata.com/apidoc/docs-site/345092/710/api-3471043) ## 技术栈
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Nearly all comments, prompts, help text, and status messages are hard-coded in Chinese, with no option for the user to select another language and no justification that the tool is intended only for a Chinese-speaking environment. This is a natural-language locale policy concern because the skill imposes a specific language by default.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
js }, null, 2)); console.error(''); console.error('创建命令：'); console.error(' mkdir -p ~/.guanyuan'); console.error(' cat > ~/.guanyuan/config.json << \'EOF\''); console.error(' {'); console.error(' "baseUrl": "https://your-guanyuan-domain.com",');
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script persistently stores authentication tokens in ~/.guanyuan/user.token and may also rely on credentials from ~/.guanyuan/config.json, but it does not warn users that long-lived secrets are being written to local disk. On multi-user systems, shared environments, backups, or endpoint compromise, these files can be recovered and reused to access the Guanyuan API, increasing the blast radius of a local compromise.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The CSV export path writes card data and metadata to disk without an explicit warning that the exported contents may contain sensitive business data, field names, and schema details. Users may inadvertently save regulated or confidential data into insecure locations, source-controlled folders, synced directories, or shared workspaces, causing unintended disclosure.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
Natural-language policy issues apply to all file types, and this README appears to require Chinese-language comprehension throughout the skill documentation. There is no indication that the skill is region-specific or that users can opt into another language, which can violate a language-choice policy if organizational standards require neutrality or user choice.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation encourages exporting card data and metadata to local CSV/JSON files but does not warn that these outputs may contain sensitive business or personal data. This can lead users to save data into insecure locations, commit it to repositories, or share it without appropriate handling controls.
- Content
Static analysis
No suspicious patterns detected.