T09 · Insecure Skill Coding Practices
Error
- Location
scripts/polish.R:10- Finding
Hardcoded Moonshot API Credential in polish.R
- Content
View full analysis
- Remediation
View remediation
Security audit
Literature Review Polisher
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with polishing literature reviews, but it embeds a real-looking API key and sends user drafts to an external AI service with limited disclosure.
Review this carefully before installing. Do not use it with confidential, unpublished, regulated, or student-identifying drafts unless you are comfortable sending the text to Moonshot/Kimi. The publisher should revoke the exposed API key, remove it from both scripts, require users to provide their own key through environment configuration, and warn before saving output files.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/polish.R.R:10- Finding
Hardcoded Moonshot API Credential in Duplicate polish.R.R Script
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
User-supplied literature review text is transmitted to an external API with no warning, consent, or privacy notice. Because academic drafts can contain unpublished ideas, identifiable student data, or proprietary research, silent transmission to a third party creates a substantial confidentiality and compliance risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
All user-facing prompts, instructions, and expected interaction flow are hard-coded in Chinese, which imposes a specific language on users without opt-in. The file does not document that this is a China-specific or Chinese-only tool, nor does it provide a way to choose another language.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 100% confidence
- Finding
The file contains a hardcoded live-looking API key alongside the external endpoint. Embedding secrets directly in source code risks credential theft through repository exposure, reuse by unauthorized parties, unexpected billing, and abuse of the linked account.
- Content
text # ========== 请在这里填写你的API信息 ========== KIMI_API_KEY <- "sk-kwe4WnYviimoCDIXOXgG82Xh91c9hWSNNobXj3OMUvfabOSF" KIMI_BASE_URL <- "https://api.moonshot.cn/v1" # =========================================== # 调用Kimi API进行润色
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill sends the user's full literature review to a third-party API, which exceeds a simple local 'polish and improve' expectation and creates an undisclosed data-sharing boundary. Literature reviews may contain unpublished research, student work, or confidential material, so transmitting them externally without explicit disclosure can expose sensitive intellectual property and personal data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The API-generated result is automatically written to disk without prior warning or confirmation. This creates an unnecessary persistence channel for potentially sensitive academic content and may violate user expectations, especially on shared machines or managed environments.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
User-facing prompts, instructions, and model prompts are all hard-coded in Chinese, and the script does not provide any mechanism to select another language or locale. This creates a natural-language policy concern because it imposes a specific language on users without explicit opt-in.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 100% confidence
- Finding
The file contains a hardcoded API key alongside the external service endpoint, which exposes a live credential to anyone with access to the skill source. Hardcoded secrets can be abused for unauthorized API usage, billing fraud, service impersonation, and potential access to submitted user content or account metadata depending on provider permissions.
- Content
text # ========== 请在这里填写你的API信息 ========== KIMI_API_KEY <- "sk-kwe4WnYviimoCDIXOXgG82Xh91c9hWSNNobXj3OMUvfabOSF" KIMI_BASE_URL <- "https://api.moonshot.cn/v1" # =========================================== # 调用Kimi API进行润色
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
User-supplied literature review text is sent to an external API service without an explicit warning, consent step, or privacy notice. Academic drafts may contain unpublished research, sensitive personal data, or proprietary material, so silent transmission to a third party creates confidentiality and compliance risks.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes a text-improvement skill for students and researchers, which implies analysis and rewriting of user-provided text. At L175-L178, the code additionally persists output to disk without that storage behavior being reflected in the stated description, expanding behavior beyond simple polishing.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script automatically saves polished output to a local file without advertising this behavior in the skill description. This can leave potentially sensitive academic content on disk unexpectedly, increasing the chance of unauthorized access, backup leakage, or accidental sharing on multi-user systems.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code saves the generated output to a timestamped file as a side effect of running the full report. While the save location is shown afterward, there is no advance warning or confirmation before the file write occurs.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
A dedicated connection-testing routine sends a probe request to the external model API independent of any literature review task. While not inherently dangerous, this capability is not justified by the manifest's stated purpose of polishing literature reviews.
- Content