Security audit

Statistics Skill

Security checks for vulnerabilities and agentic risk

Overview

This statistics helper does what it claims, but it sends pasted research results to Moonshot/Kimi using a bundled API key without clear user consent or privacy disclosure.

Review this skill before installing. Do not paste confidential, regulated, unpublished, or participant-level research data unless your organization allows Moonshot/Kimi processing. The embedded API key should be removed and rotated by the publisher, and the skill should disclose remote transmission and local autosave before use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/statistics_interpreter.R:8
Finding: Hardcoded Moonshot API Credential in Source Code
Content: View full analysis
`. 5. Requests are attributed to the credential owner's account until the key is revoked, expires, or is otherwise disabled. ### Impact Assessment An attacker may obtain the API privileges granted to the exposed key. Depending on the Moonshot account configuration, this can include: - Unauthorized ...[truncated 457 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/statistics_interpreter.R:14
Finding: User-Provided Statistical Data Is Transmitted to a Third Party Without Documentation or Consent
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A live hard-coded API key is embedded directly in the script, which exposes the credential to anyone with access to the code and enables unauthorized use of the external API. This can lead to account abuse, billing fraud, service disruption, and compromise of any privileges tied to that key.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The script is explicitly configured to communicate with an external API endpoint, which means user-supplied statistical content leaves the local environment. In a research-assistance context, this is security-relevant because pasted outputs may contain confidential study data, unpublished findings, or regulated information.
Content: Scanner excerpt · scripts/statistics_interpreter.R (reported line 10)May include surrounding context.
text
# ========== 请在这里填写你的API信息 ========== KIMI_API_KEY <- "sk-kwe4WnYviimoCDIXOXgG82Xh91c9hWSNNobXj3OMUvfabOSF" KIMI_BASE_URL <- "https://api.moonshot.cn/v1" # =========================================== # 调用Kimi API进行解读

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises direct interpretation of pasted SPSS/statistical output, but actually forwards the user-provided content to a third-party API. This creates a data exposure risk, especially if users paste unpublished research results, student data, or sensitive study outputs without realizing they are leaving the local environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: User-entered statistical results are transmitted to an external API without any clear warning, consent flow, or privacy notice. In this context, users may reasonably expect a local helper, so silent transmission increases the chance of accidental disclosure of confidential or unpublished research data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest-style description is written entirely in Chinese, while the rest of the skill documentation is in English, and there is no indication that users can choose or opt into a language/locale. This may violate language-choice policy because it imposes a specific language in user-facing skill metadata without justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This plain-text skill file is entirely written in Chinese and provides no indication that the language choice is optional or limited to a justified region-specific context. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is reportable across all file types.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The prompt explicitly requires output '用中文输出' and does not provide any user opt-in or alternative language selection. This is a natural-language locale constraint and may violate language policy expectations when the skill is not clearly documented as Chinese-only or region-specific.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The script automatically saves generated interpretations to a local file, which may persist potentially sensitive research summaries without the user's explicit awareness. While local storage is less severe than external exfiltration, it still creates confidentiality and retention risks on shared or unmanaged systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script writes output to disk automatically without warning or confirmation, creating unnecessary data persistence. On multi-user machines or synced folders, these saved interpretations could be accessed by others or retained longer than intended.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.