T09 · Insecure Skill Coding Practices
Error
- Location
lib/query.py:16- Finding
Hard-Coded Shared CMDB Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Cmdb Query
Security checks for vulnerabilities and agentic risk
Overview
This CMDB query skill matches its stated purpose, but it exposes reusable credentials, disables TLS checks, and can query sensitive internal asset models.
Do not install this skill as published unless the CMDB password has been rotated and removed, TLS verification is fixed with a trusted internal CA, and the skill is restricted to approved non-sensitive resource labels and safe output fields. Treat the exposed credential as compromised.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
lib/query.py:35- Finding
TLS Certificate Verification Disabled for Authentication and CMDB Queries
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
lib/query.py:60- Finding
Unrestricted Resource Label Permits Queries of Sensitive Credential Models
- Content
View full analysis
Dict[str, Any]: """ 查询资源实例 Args: label: 资源类型标识符（如 host, application, RDS_database） query_filter: 查询条件，例如 {"$or": [{"name": {"$regex": "test"}}]} page: 页码 page_size: 每页数量 Returns: 查询结果 """ url = f"{BASE_URL}/cloudresources/resource/instance/{label}" headers = { "Authorization": f"Token {get_token()}", "Content-Type": "application/json" } body = { "query_filter": query_filter or {}, "format_user_field": "true" } # 分页参数在 URL 上 params = {"page": page, "page_size": page_size} # 注意：跳过证书验证 response = requests.post( url, json=body, params=params, headers=headers, verify=False, # 跳过证书验证 timeout=60 ) ``` The declared model list includes sensitive authentication and account-related records: ```markdown ### 堡垒机/账号 - `baolj_data` - 非强国堡垒机资源 - `Y_baolj_data` - 强国_堡垒机资源 - `sshprivatekey` - 堡垒机远程登陆私钥 - `jw_front_computer` - 经纬前置机账号 - `ziyuan_models` - 资源账号申请模型 - `ziyuan_users` - 资源账号平台用户表单 - `yewu_model` - 业务账号申请模型 - `yewu_users` - 业务账号平台用户表单 ``` ### Technical Analysis The Skill's legitimate function is CMDB asset discovery, but the implementation accepts any caller-provided resource label and sends it to the CMDB. There is no client-side allowlist limiting queries to ordinary inventory models such as hosts, applications, or databases. The documentation explicit ...[truncated 1788 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose says this is a CMDB query skill, but the content also embeds authentication behavior, credentials, environment-based filtering, pagination, and broad asset-model enumeration that are not transparently disclosed. This mismatch can mislead reviewers and users about the skill's real reach, especially because it can authenticate into an internal system and retrieve more data than the description implies.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Publishing hardcoded authentication material without any warning or protection is a direct secret exposure. In this context the danger is elevated because the target is an internal CMDB containing high-value inventory and account-related metadata, so exposed credentials materially lower the barrier to reconnaissance and follow-on compromise.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file exposes a hardcoded CMDB username and password in plaintext. Anyone with access to the skill can reuse those credentials to authenticate to an internal asset inventory system, potentially enumerating sensitive infrastructure such as hosts, databases, network assets, and even key-related records.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill performs authenticated network access to an internal CMDB but does not declare any explicit tool scope or allowed tools. That weakens reviewability and policy enforcement, making it easier for a consumer to invoke network behavior that is broader than the metadata suggests.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The manifest description and the operational instructions are presented entirely in Chinese, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. Under the stated policy, forcing a language without opt-in is a natural-language policy concern.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
This example sends authenticated requests to an internal CMDB endpoint and retrieves host inventory data. Network transmission alone is not always unsafe, but here it becomes security-relevant because it is coupled with exposed credentials and broad internal asset enumeration, enabling reconnaissance against sensitive infrastructure.
- Content
1. 列出所有主机
bash curl -s -X POST "https://10.255.227.233/cmdb/v1/api/cloudresources/resource/instance/host" \ -H "Authorization: Token YOUR_TOKEN" \ -H "Content-Type: application/json" \ -d '{"query_filter": {}, "format_user_field": "true"}' | jq '.data.items[] | {name, ip, env}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
This example performs authenticated transmission to query internal application asset data using regex filtering. In context, the risk is not the POST itself but that the skill enables structured enumeration of internal applications via an internal API, which is sensitive operational intelligence if accessed by unintended parties.
- Content
2. 按名称模糊查询应用（含 cmdb 字样）
bash curl -s -X POST "https://10.255.227.233/cmdb/v1/api/cloudresources/resource/instance/application" \ -H "Authorization: Token YOUR_TOKEN" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This example transmits authenticated queries for internal database asset information, including environment-based filtering that can help identify production systems. In the context of an internal CMDB and exposed credentials, such requests facilitate targeted reconnaissance and increase the value of any unauthorized access.
- Content
3. 查询特定环境的数据库
bash curl -s -X POST "https://10.255.227.233/cmdb/v1/api/cloudresources/resource/instance/RDS_database" \ -H "Authorization: Token YOUR_TOKEN" \ -H "Content-Type: application/json" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This Python code performs remote HTTP POST requests to authenticate with the CMDB and query resource data, including sending a username/password and authorization token, but it provides no user-facing confirmation, warning, or logging that sensitive system data will be transmitted over the network. The existing comments and docstrings are developer-oriented and do not disclose this behavior to the user at runtime.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This request transmits hardcoded CMDB credentials to an external service while TLS certificate verification is disabled in the same call path. In a CMDB context, intercepted credentials can grant access to sensitive infrastructure inventory, making this materially more dangerous than ordinary outbound network traffic.
- Content
python data = {"username": USERNAME, "password": PASSWORD} # 注意：这个 API 需要跳过证书验证 response = requests.post( url, json=data, verify=False, # 跳过证书验证
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Disabling TLS certificate verification during authentication makes credential theft and session interception significantly easier via man-in-the-middle attacks. In this CMDB skill, the risk is amplified because the compromised account can reveal internal asset inventory and possibly broader environment structure.
- Content
python response = requests.post( url, json=data, verify=False, # 跳过证书验证 timeout=30 )
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This outbound request sends CMDB query results and authorization tokens over a connection configured to skip certificate validation. Because the tool queries infrastructure asset data, a man-in-the-middle attacker could intercept or tamper with inventory responses, leading to disclosure or operational misuse.
- Content
python params = {"page": page, "page_size": page_size} # 注意：跳过证书验证 response = requests.post( url, json=body, params=params,
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Skipping certificate validation for authenticated CMDB queries allows attackers on the network path to read or alter sensitive asset data returned by the service. The context makes this especially dangerous because CMDB contents often include high-value infrastructure mapping information.
- Content
python json=body, params=params, headers=headers, verify=False, # 跳过证书验证 timeout=60 )
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes a query skill for asset data by resource type with name-based filtering. In addition to querying instances, the code implements
list_all_models(), which calls a metadata endpoint to retrieve all resource model definitions, expanding behavior beyond asset-data querying into schema/model enumeration.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This request enumerates CMDB model definitions using an authorization token over a TLS session with verification disabled. Even though it may not transmit credentials directly, it can still expose authenticated metadata and permit traffic interception or response manipulation.
- Content
python "Content-Type": "application/json" } response = requests.post( url, json={}, headers=headers,
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Using verify=False for model-definition requests creates the same man-in-the-middle weakness for authenticated metadata retrieval. While model metadata may be somewhat less sensitive than full asset records, it still reveals internal schema and can be tampered with.
- Content
python url, json={}, headers=headers, verify=False, timeout=30 )
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
User-facing strings such as the module description, CLI description, help text, and runtime output are in Chinese, but the file does not offer users a language option or explain that the tool is intended only for a Chinese-speaking environment. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.
- Content
Static analysis
No suspicious patterns detected.