Security audit

Km Destine Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to support real KTV booking and payment flows, but it needs review because it uses broad transaction authority, global external tooling, background polling, and insecure temporary files for order data.

Review before installing. Only use this with a trusted @ktvme/km-bot package version, avoid global unpinned installs, validate payment link and QR-code destinations, and ensure order-status files do not expose names, phone numbers, or booking details in shared temporary storage.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

Location: reference/cli-install.md:43
Finding: Unpinned Global Installation of an Executable npm Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/poll_order_status.py:45
Finding: Predictable Temporary Result Path Allows Symlink Following and File Overwrite
Content: View full analysis
.json` as a symbolic link. When polling finishes, the script follows that link and overwrites the linked target if the polling process has permission. Lack of `order_id` validation also means that a directly invoked script can receive path separators or traversal components. In the intended workflow the identifier comes from the booking API, but the script itself does not enforce that trust boundary. ### Attack Path 1. A local attacker learns or predicts the order identifier, or waits for a known polling command. 2. The attacker creates a symbolic link: ```bash ln -s /path/writable/by/victim /tmp/poll_result_ORDER_ID.json ``` 3. The victim runs: ```bash python3 scripts/poll_order_status.py ORDER_ID ``` 4. ...[truncated 939 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/poll_order_status.py:100
Finding: Complete Order Records Containing Personal Data Are Written to Shared Temporary Storage
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: reference/subflow-pay.md:53
Finding: Backend-Provided Payment URLs Are Presented Without Scheme or Domain Validation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation rules are overly broad and require invocation for common terms like singing,聚会, or 团建, which can capture many ordinary conversations unrelated to actual booking intent. Overbroad triggering can route users into login, payment, and ordering flows unnecessarily, causing privacy exposure, unintended transactions, and confused-deputy behavior when the agent invokes powerful actions without sufficiently specific user intent.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file is entirely framed as a Chinese-only API instruction document ('订单 API') and includes prescriptive user-facing output text only in Chinese, with no indication that users may choose another language or that the skill is limited to a Chinese-language or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/api-order.md (reported line 77)May include surrounding context.
md
**返回字段说明**： | 字段 | 类型 | 说明 | | ------------------ | ------ | ------------------------------------------------------------------------------------------ | | ret | Number | 错误码，0成功 | | data.operate_id | String | 订单号 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/api-order.md (reported line 80)May include surrounding context.
md
| 字段 | 类型 | 说明 | | ------------------ | ------ | ------------------------------------------------------------------------------------------ | | ret | Number | 错误码，0成功 | | data.operate_id | String | 订单号 | | data.payment_link | String | 支付url，直接展示成超链接，点击去支付，必须展示 | | data.qr_code | String | 支付二维码url，直接在线展示，无需下载，无需思考（**直接按最合理的方式展示给用户扫码支付** | | data.expire_time | String | 有效期（格式: yyyy-MM-dd HH:mm:ss），即锁定包厢时间 + 支付时间，**超出则无法下单** |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/api-order.md (reported line 153)May include surrounding context.
md
**请求参数**： | 字段 | 类型 | 必填 | 说明 | | ---- | ------ | ------ | ----------------------------------------------------------------------------------------------------------------------------------- | | opid | String | **是** | 订单号（来自 `roomHourCreateOrder` 返回的 `operate_id`，**必须用字符串传递**） |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill file is written entirely in Chinese and presents all user-facing instructions, warnings, and error messages in that language, with no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file title and all user-facing instructions are written only in Chinese, with no indication that the skill is region-specific or that other languages are supported. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The skill file is predominantly written in Chinese and does not provide an opt-in, alternative language, or a documented justification that it is intended only for a Chinese-speaking or region-specific audience. Under the policy rule for language/locale constraints, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/error-handling.md (reported line 52)May include surrounding context.
md
> 💳 支付信息（`payment_link` / `qr_code` / `expire_time`）由 `roomHourCreateOrder` 直接返回，无独立支付接口。 | 场景 | 处理策略 | | ------------------------------ | --------------------------------------------------------------------------------------- | | 二维码/链接无法打开 | 引导用户点击打开 `payment_link`扫码支付；仍不行则按下方「超时」处理 | | 超过 `expire_time` 未支付 | ⚠️ **禁止直接重新下单**；重新 `queryRoomAvailability` 查时段 → 用户重选 → 下新单 |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire skill, including prompts and interaction examples, is written exclusively in Chinese and instructs the agent to interact with the user in Chinese. There is no indication that the user can choose another language or that the skill is restricted to a China-specific or Chinese-only deployment context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file’s operational instructions, example user-facing messages, and required dialogue are entirely specified in Chinese, with no indication that the agent should adapt to the user’s preferred language. This creates a natural-language locale constraint that is not documented as optional or region-justified within the file.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs the agent to execute a local Python script and manage background tasks as part of a payment flow. Granting a booking/payment skill permission to run arbitrary local processes expands its capabilities beyond normal API orchestration and creates an unnecessary code-execution surface that could be abused if the script path, arguments, or surrounding runtime are tampered with.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The subflow relies on local filesystem state under /tmp to pass payment results between tasks and the agent. Using shared temporary files for payment coordination can expose sensitive order data, enable tampering or race conditions in multi-tenant environments, and gives the skill broader host interaction than is needed for KTV booking.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/poll_order_status.py (reported line 29)May include surrounding context.
python
def query_order_status(order_id: str) -> dict | None: """调用 km-bot 查询订单状态，参数名为 oid""" try: result = subprocess.run( ["km-bot", "call", "saasktv", "getOrderDetail", json.dumps({"oid": order_id})], capture_output=True,

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest frames the skill as an API-driven KTV booking workflow, but the implementation instructions expand into agent-level orchestration with background jobs, blocking waits, and local file handling. This mismatch is dangerous because it hides privileged runtime behaviors behind a benign booking description, making security review, least-privilege enforcement, and user consent harder.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: All user-facing examples and required interaction patterns are presented only in Chinese, and the file does not state that the skill is China-only or that users may choose another language. This can violate language/locale policy when a skill implicitly forces one language without user opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs the agent to spawn a background Python process, block on task output, and read a local file in /tmp as part of payment handling. That behavior exceeds a normal API-only booking scope and introduces unnecessary local execution and file-based state dependencies, which increase attack surface and create opportunities for tampering, stale state reuse, or operational denial-of-service if multiple tasks contend or block indefinitely.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · skill.md (reported line 293)May include surrounding context.
md
### 快速步骤索引 | 步骤 | 接口 | 输入 | 输出 | 关键约束 | | -------- | --------------------------------- | --------------------------------------------------------------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------ | | Step 1 | （无，纯对话） | 用户消息 | 城市区域/商家名 + 日期 + 到店时间 | 三要素缺一不可；到店时间必须明确或代选并告知；齐全则跳过追问 | | Step 2 | searchCompany | keyword | companycode, companyid, companyphone | 关键词优先级：门店名 > 地址 > 城市；首次可能超时需重试 |

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: 该文档从标题开始整体以中文编写，未见任何关于可选语言、用户语言偏好或区域限定的说明。根据规则，若技能内容强制特定语言且未提供用户选择，属于自然语言层面的语言/区域策略违规。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing natural-language instructions exclusively in Chinese, and it does not state that the skill is region-specific or offer an alternative language choice. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file contains user-facing guidance exclusively in Chinese, but it does not state that the skill is intended only for Chinese-speaking users or offer any language/locale choice. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: Line L048 states that after roomHourCreateOrder, no further payment interface needs to be called. However, the rest of the document instructs the agent to poll order status via a script and process payment outcome before proceeding, which contradicts the absolute phrasing of '无需再调用任何支付接口'.
Content: No source excerpt is available for this finding.