T09 · Insecure Skill Coding Practices
Error
- Location
scripts/jf_client.py:107- Finding
Configurable API Endpoint Allows Disclosure of Images and Authentication Metadata
- Content
View full analysis
- Remediation
View remediation
Security audit
jf-open-algo-assistant
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real JFTech image-analysis helper, but it handles credentials and media too broadly and can install an unpinned remote skill.
Install only if you trust the publisher and will use it in an authorized JFTech environment. Avoid custom endpoints, protect or rotate any appSecret used with it, do not commit config.json, and review/pin the jf-open-pro-capture dependency before allowing automatic installation or camera capture.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/jf_client.py:76- Finding
Application Secret Is Stored in Plaintext and Accepted as a Command-Line Argument
- Content
View full analysis
- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:137- Finding
Unpinned Remote Skill Is Downloaded and Immediately Trusted
- Content
View full analysis
``` The surrounding workflow directs the Agent to copy the `jf-open-pro-capture` subdirectory into the local Skills directory, verify only that `SKILL.md` exists, and then read and follow that downloaded Skill without waiting for a refreshed or separately reviewed Skill registry. ### Technical Analysis The dependency is retrieved from the current state of a remote repository rather than a reviewed commit, signed release, or content-addressed artifact. Consequently, the effective instructions and scripts used at runtime can change after this Skill has been audited. Checking only for the existence of `SKILL.md` establishes neither authenticity nor integrity. It does not detect: - A compromised upstream repository - A compromised maintainer account - A malicious force-push or branch update - Substitution of scripts in the downloaded Skill - New instructions that request additional credentials or unsafe actions The workflow is especially sensitive because the downloaded capture Skill is expected to handle camera device serial numbers, device administrator passwords, tokens, and captured imagery. Reading and following a mutable remote `SKILL.md` also creates an instruction-injection channel in addition to the conventional code supply-chain risk. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or the branch used by the clone operation. 2. The attacker modifies `jf-open-pro-capture`, including its scripts or `SKILL.md`. 3. A user selects the documented automatic installation option. 4. The Agent clones the latest mutable repository state. 5. The malicious subdirectory is copied into the local Skills directory. 6. The workflow valid ...[truncated 1034 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The code is related to the declared domain—calling Jiefeng open-platform AI algorithms on images—but it represents a lower-level API client rather than the described interactive assistant. Its core functions are credential configuration, signature generation, connectivity testing, algorithm-app opening, and direct invocation of a provided app UUID with an image path or URL. The declared description emphasizes scenario-driven user interaction, selection/recommendation from a predefined 52-algorithm catalog, support for camera snapshot acquisition via another skill, and structured reporting. Those behaviors are absent from this code chunk. Therefore the description materially overstates and mischaracterizes the implemented behavior.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to perform network access and write local files/configuration, but it does not declare any explicit tool scope or permission boundaries. That makes the effective capability surface broader than the manifest communicates, increasing the chance of unintended credential handling, API calls, or filesystem modification without clear user/admin review.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The listed triggers include generic phrases such as "AI检测", "算法调用", "图片分析", and "检测服务等", which are broad enough to match many ordinary requests outside this specific JFTech platform skill. The description does not provide exclusion conditions or negative examples to narrow when the skill should activate versus when a general image-analysis skill would be more appropriate.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill includes instructions to automatically install another skill by cloning/downloading remote content and copying it into the local skills directory. This creates a supply-chain and arbitrary code/trust expansion risk: a conversational flow about image analysis should not silently extend local capabilities by fetching and installing additional artifacts from the network.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This JSON manifest presents user-facing names, categories, scene labels, and descriptions predominantly in Chinese across the file, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking region. Under the stated policy, a fixed language or locale without user opt-in or clear justification is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This manifest exposes numerous surveillance-oriented capabilities targeting workers, customers, and visitors, including employee behavior monitoring, age/gender analysis, theft detection, and perimeter monitoring, but provides no user-facing privacy, consent, or lawful-use warning. In this skill context, the danger is elevated because the catalog makes it easy to operationalize privacy-sensitive monitoring across images, video streams, and camera captures without any built-in friction, disclosure, or policy gating.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document instructs callers to send image URLs or base64-encoded images together with a device serial number to a remote third-party API, but it does not warn about the privacy, confidentiality, and compliance implications of transmitting user media and identifiers off-platform. In this skill’s context, users may analyze camera captures, local photos, or surveillance imagery, so missing disclosure and consent guidance increases the risk of accidental exposure of sensitive visual data, metadata, and device identifiers.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script persists app credentials, including the secret, to a local config.json file in plaintext without any warning or protection. This creates an avoidable credential exposure risk if the workstation is shared, backed up insecurely, checked into source control, or read by other local processes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The client allows a user-supplied endpoint to override the expected JF platform API host, and the same request includes authentication headers plus potentially sensitive image/device data. In the context of a platform-specific assistant, this broadens behavior from calling the intended service to exfiltrating credentials and payloads to arbitrary servers, which is a real security boundary violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The call command sends either a base64-encoded local image or a remote image URL together with the provided SN value to an external API endpoint. Although network transmission is core to the client's purpose, the code does not provide an explicit user-facing disclosure at the point of transmission that local file contents and identifier data are being uploaded.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The manifest description and the operational guidance are written as if the interaction and outputs are expected in Chinese, and no user language choice or opt-in is offered. Because the skill is positioned as a general assistant rather than a clearly region-limited compliance tool, this can conflict with language/locale choice expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The document presents all operational guidance, warnings, and API usage instructions only in Chinese. Under the language/locale policy, forcing a specific language without user opt-in or justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
Natural-language strings in the module docstring and command descriptions are presented only in Chinese, with no indication that the user can choose another language. The policy requires flagging language-forcing behavior when a specific language is imposed without opt-in or justification.
- Content