T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/converter.py:116- Finding
Cross-Service API Credential Disclosure During Subscription Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Document Format Converter
Security checks for vulnerabilities and agentic risk
Overview
The skill is mainly a file converter, but it needs review because it can send an environment credential to a third-party verification service and cache account-related metadata locally.
Review this before installing in environments with sensitive environment variables. Do not run it with OPENAI_API_KEY set unless you are comfortable with accepted-prefix values being sent to YK Global for validation, and avoid Feishu delivery for sensitive documents unless the destination and payload are clearly understood. Pin dependencies and treat the cleanup commands as manual maintenance steps, not automatic install steps.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (29)
Tainted flow: 'req' from os.environ.get (line 121, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 97% confidence
- Finding
The script sends an API key sourced from user input or the OPENAI_API_KEY environment variable to an external verification endpoint. In a file-conversion skill, transmitting unrelated credentials off-host creates a real exfiltration risk, especially because users may unknowingly supply a powerful OpenAI credential that is then disclosed to a third party.
- Content
python }, data=b"{}", # POST body required ) with urllib.request.urlopen(req, timeout=10) as resp: data = json.loads(resp.read().decode("utf-8")) # 修正：使用 valid 字段 if data.get("valid", False):
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 94% confidence
- Finding
The pre-publish cleanup instructions include destructive deletion commands such as 'rm -rf ./output' and multiple 'find ... -delete' patterns. Even though the paths are somewhat scoped, these commands normalize running bulk deletion from the repository root and can cause unintended data loss if executed from the wrong directory or after path changes/symlink issues.
- Content
md find . -type d -name ".pytest_cache" -exec rm -rf {} + 2>/dev/null || true # 清理 output 目录（如果有） rm -rf ./output 2>/dev/null || true # 清理测试生成的文件 find . -type f -name "*.tmp" -delete
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill advertises Feishu webhook integration to push conversion results and notifications, but it does not clearly warn users that file-derived content or metadata may be transmitted to an external service. In a batch conversion tool, users may process sensitive business documents, so silent or poorly disclosed outbound sharing increases the risk of accidental data exfiltration.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md **System-level dependencies:** - Tesseract OCR (for PDF text extraction) - Ubuntu/Debian: `sudo apt install tesseract-ocr` - macOS: `brew install tesseract` - Windows: Download from [UB-Mannheim/tesseract](https://github.com/UB-Mannheim/tesseract/wiki)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md **System-level dependencies:** - Tesseract OCR (for PDF text extraction) - Ubuntu/Debian: `sudo apt install tesseract-ocr` - macOS: `brew install tesseract` - Windows: Download from [UB-Mannheim/tesseract](https://github.com/UB-Mannheim/tesseract/wiki)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly advertises pushing conversion results to Feishu but does not warn that file contents, extracted OCR text, or metadata may be transmitted to an external service. In a batch conversion tool that may process sensitive business documents, this omission can lead users to enable outbound sharing without understanding the privacy and data-handling implications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill states that converted files and notifications are sent to Feishu, but it does not clearly warn users that uploaded content may be transmitted to an external platform. This creates a real privacy and data-handling risk, especially if users convert sensitive documents and do not realize results will be shared outside the immediate execution environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises automatic Feishu group push of conversion results without any visible warning, consent flow, or description of what data is transmitted. Because converted files may contain sensitive business or personal information, silent or poorly disclosed external delivery creates a real data-leakage risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file's docstrings, status messages, quota messages, and result-card text are written in Chinese only, and the CLI does not provide any language or locale selection. This imposes a specific language on all users without opt-in, which matches the language/locale policy violation criteria.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill performs external token-verification calls that are not necessary for local file format conversion. This expands the trust boundary, leaks metadata and credentials to a remote service, and creates privacy and supply-chain risk in a tool whose expected behavior is offline document conversion.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The API key is transmitted to a remote service without an explicit user-facing warning at the point of use. This is dangerous because users may believe the tool only converts files locally, while their credential is silently sent to an external domain for verification.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code repurposes OPENAI_API_KEY to determine subscription plan for a converter skill, which is unrelated to the stated functionality. This can cause accidental disclosure of a sensitive environment secret to the remote verification service and may also break user expectations about how their credentials are used.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The OCR feature is described as automatically extracting text from scanned PDFs, but there is no warning that scanned documents may contain confidential or regulated data that will be processed and converted into machine-readable text. This omission can lead users to run OCR on sensitive documents without understanding the privacy implications or downstream exposure in outputs and logs.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The documented configuration sets
ocr_lang: chi_sim+eng, which imposes a specific language/locale combination in natural-language behavior. The README does not indicate that users can choose OCR languages or that this locale default is justified by a region-specific purpose.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language instructions and usage examples are entirely in Chinese, with no indication that users may choose another language or that the skill is intended only for a Chinese-speaking audience. This can violate language/locale policy when a skill imposes a language without opt-in or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
SQP-3 covers natural-language policy violations across all file types, including forcing a specific language without user opt-in. This file presents all user-facing content in Chinese only, with no indication of multilingual support, user choice, or a documented region-specific limitation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Token verification results are cached locally without clear disclosure, creating unintended persistence of account-related metadata on disk. Although the cache key is truncated and not the full secret, the presence of validation state, tier, prefix, and quota data may still expose sensitive operational details to other local users or forensic inspection.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency is specified with a lower bound only, which allows future installs to pull in any newer release, including versions with breaking changes or newly introduced vulnerabilities. This weakens build reproducibility and supply-chain assurance because the actual installed version cannot be verified from the manifest alone.
- Content
text pandas>=2.0.0 openpyxl>=3.0.0 python-docx>=1.0.0 pytesseract>=0.3.10
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
Pandas has at least one known advisory, but the manifest does not pin a version, so it is impossible to determine whether deployed environments will install an affected release. This is dangerous because security posture depends on resolver behavior rather than an explicitly reviewed version.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The openpyxl requirement is unpinned, so dependency resolution may select different versions over time or across environments. This creates supply-chain risk and makes it difficult to determine whether deployments include a vulnerable or incompatible release.
- Content
text pandas>=2.0.0 openpyxl>=3.0.0 python-docx>=1.0.0 pytesseract>=0.3.10 pdf2image>=1.16.0
Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
Openpyxl has known historical XXE-related advisories, and the lack of a pinned version means the package selected during installation may or may not be vulnerable. Because this skill likely handles document or spreadsheet content, uncertainty around parser-library versions is more concerning than in a purely local utility.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Using python-docx with only a minimum version permits uncontrolled upgrades to later versions that may contain security regressions or unexpected behavior. It also prevents reliable auditing because the manifest does not describe the exact package version that will be installed.
- Content
text pandas>=2.0.0 openpyxl>=3.0.0 python-docx>=1.0.0 pytesseract>=0.3.10 pdf2image>=1.16.0 Pillow>=10.0.0
Unverifiable Dependency: python-docx has 2 known advisory(ies) (CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
Python-docx has known XXE-related advisories, and without exact version pinning, the dependency manifest cannot demonstrate that installations avoid those affected versions. Document-processing libraries are often exposed to attacker-supplied files, which increases the practical risk of unverifiable dependency state.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The pytesseract entry is not pinned to a single version, so installations are not reproducible and may consume unreviewed upstream releases. In security-sensitive environments, that increases supply-chain uncertainty even if no specific exploit is evident from this file alone.
- Content
text pandas>=2.0.0 openpyxl>=3.0.0 python-docx>=1.0.0 pytesseract>=0.3.10 pdf2image>=1.16.0 Pillow>=10.0.0 requests>=2.28.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
An unpinned pdf2image dependency allows environment-dependent resolution, making builds inconsistent and complicating security review. If a later version introduces a flaw, the manifest provides no protection against silently adopting it.
- Content
text openpyxl>=3.0.0 python-docx>=1.0.0 pytesseract>=0.3.10 pdf2image>=1.16.0 Pillow>=10.0.0 requests>=2.28.0
Static analysis
No suspicious patterns detected.