捷帮定时任务

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:37 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent cron-task manager, but it automatically creates and stores an API key, sends task data to a third-party service, and relies on an undeclared networking dependency.

Review before installing. Use this only if you are comfortable sending scheduled-task details to www.jiebang.site and storing a bearer API key in a plaintext file under the skill directory. Avoid putting secrets, customer data, or sensitive operational details in task names, descriptions, tags, or completion messages. The publisher should declare and pin the networking dependency, use safer credential storage, disclose the privacy model, and add explicit confirmation before registration and deletion.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: main.py:128
• Finding: Task Completion Messages Are Exposed Through URL Query Parameters<![CDATA[ ## Vulnerability Details **File Location**: `main.py:128-139` **Vulnerability Type**: Sensitive information exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code ```python body = {"status": status} if message: body["message"] = message try: resp = requests.post( f"{BASE_URL}/api/cron-task/{task_id}/done", headers=headers, params=body, timeout=15 ) ``` ### Technical Analysis The `status` and user-controlled completion `message` are passed through the HTTP client's `params` argument. This places both values in the request URL query string rather than the POST body. URLs are routinely recorded by web-server access logs, reverse proxies, API gateways, observability platforms, and network debugging tools. Although HTTPS protects the URL while it is in transit, it does not prevent endpoint infrastructure from logging it. Completion messages can contain error details, operational data, customer references, or other sensitive information derived from the user's task. Using query parameters is not necessary for the declared completion-update functionality. The request already declares a JSON content type, so these values should be sent in a JSON request body. ### Attack Path 1. A user or agent invokes `done --msg` with sensitive operational information. 2. `complete_task()` assigns that information to `body["message"]`. 3. The HTTP client serializes `body` into the URL because it is supplied as `params=body`. 4. The resulting URL is processed by the remote server and any intervening proxy or API gateway. 5. Access logs or monitoring records retain the full query string. 6. Anyone with access to those records can recover the completion message. This does not provide direct local code execution or privilege escalation, but it expands access to sensitive content beyond the intended API data-processing path. ### Impact Assessment The exposed scope is limited to the completion statu ...[truncated 350 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Send completion data in the POST body: ```python resp = requests.post( f"{BASE_URL}/api/cron-task/{task_id}/done", headers=headers, json=body, timeout=15 ) ``` Additional hardening should include: - Validate and limit the length of completion messages. - Warn users not to include credentials or unnecessary personal data. - Configure servers, gateways, and monitoring systems to redact sensitive fields. - Confirm that the service does not include request bodies in unrestricted diagnostic logs. - Add a regression test verifying that `message` never appears in the generated URL. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: main.py:16
• Finding: API Key Is Stored in Plaintext Without Enforced Restrictive Permissions<![CDATA[ ## Vulnerability Details **File Location**: `main.py:16, 25-28` **Vulnerability Type**: Insecure local credential storage **Risk Level**: Medium ### Vulnerable Code ```python KEY_FILE = Path(__file__).parent / ".jiebang_api_key" ``` ```python def save_api_key(key): """保存API Key到本地文件""" KEY_FILE.write_text(key.strip()) return key ``` ### Technical Analysis The API key is written as plaintext into the Skill's installation directory. `Path.write_text()` does not explicitly enforce owner-only permissions; the effective permissions depend on the process umask and existing file mode. If the installation directory is shared, backed up, packaged, or inspected by another local process, the credential may become accessible outside the intended user context. Storing the key beside executable project files also increases the risk of accidental distribution. A copied or archived project directory can include `.jiebang_api_key` even though it is not part of the reviewed source tree. The API key is necessary to authenticate to the declared service, but placing it in the project directory without explicit access controls exceeds the minimum safe credential-storage practice. ### Attack Path 1. The user runs `ensure-key`. 2. The remote service returns an API key. 3. `save_api_key()` writes the key to `.jiebang_api_key` using default filesystem permissions. 4. Another local user, process, backup job, or packaging operation reads or copies the file. 5. The attacker uses the stolen bearer token against `www.jiebang.site`. 6. Subject to the server-side authorization attached to that token, the attacker can inspect or manipulate the victim's remote task data. Exploitation requires local file access, access to an exposed backup, or accidental distribution of the credential file. ### Impact Assessment A stolen API key may permit unauthorized access to all capabilities exposed to that identity, including listing tasks, reading logs, creating tasks, mar ...[truncated 191 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Prefer an operating-system credential manager or a platform-provided secret store. If file storage is unavoidable: - Store the key in a user-private configuration directory rather than the Skill installation directory. - Create the file atomically with mode `0600`. - Reject or repair files that are readable by group or other users. - Prevent symlink following when creating or replacing the credential file. - Add `.jiebang_api_key` to packaging and version-control exclusion rules. - Provide key revocation and rotation instructions. - Avoid printing any portion of the key unless the preview is strictly required. A POSIX-oriented implementation should create a temporary file with owner-only permissions, write the key, and atomically replace the destination. ]]>

T08 · Insecure Dependencies

Warning

• Location: main.py:12
• Finding: Networking Dependency Is Undeclared and Unpinned<![CDATA[ ## Vulnerability Details **File Location**: `main.py:12`; `requirements.txt:1` **Vulnerability Type**: Uncontrolled third-party dependency and supply-chain risk **Risk Level**: Medium ### Vulnerable Code ```python from coze_workload_identity import requests ``` The dependency manifest contains only: ```text # 捷帮定时任务 - 无额外依赖，使用Python标准库 ``` ### Technical Analysis `coze_workload_identity` is imported by the program but is not a Python standard-library module and is not declared in `requirements.txt`. No reviewed version, hash, lockfile, or provenance information is provided. The imported package supplies the `requests` object used for every outbound API operation. It therefore receives authorization headers containing the bearer API key and processes all task payloads and responses. If an incorrect, compromised, or attacker-controlled package is resolved in the runtime environment, it can intercept credentials and user content or modify network requests. The audit does not establish that the package itself is malicious. The confirmed defect is that the package is undeclared and unpinned despite occupying a security-sensitive position. ### Attack Path 1. The Skill is installed in an environment where `coze_workload_identity` must be resolved externally or is already supplied by an unverified source. 2. A compromised repository, dependency-confusion condition, or environment manipulation causes an unintended package version to be imported. 3. The imported package exposes a compatible `requests` interface. 4. The Skill passes API keys, task data, and completion messages to that interface. 5. Malicious dependency code copies the information, redirects requests, or alters responses under the privileges of the Skill process. Successful exploitation grants the dependency the same local execution rights as the Python process. There is no evidence in the reviewed project that this path is currently being exploited. ### Impact Assessment A malicious ...[truncated 400 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Declare `coze_workload_identity` explicitly in the dependency manifest. - Pin it to a reviewed version and use cryptographic package hashes or a lockfile. - Document the trusted package source and expected publisher. - Generate and review a software bill of materials. - Run dependency vulnerability and provenance checks during builds. - Correct the inaccurate statement that the project uses only the standard library. - If the specialized wrapper is unnecessary, replace it with an explicitly declared, well-maintained HTTP client. - Test the resolved package identity and version in CI before release. ]]>

other

Note

• Location: main.py:83
• Finding: User Task Content Is Sent to a Third-Party Service Without a Clear Privacy Disclosure<![CDATA[ ## Vulnerability Details **File Location**: `main.py:17, 83-100` **Vulnerability Type**: Undisclosed third-party transmission and retention of user-provided data **Risk Level**: Low ### Vulnerable Code ```python BASE_URL = "https://www.jiebang.site" ``` ```python body = {"name": name, "schedule": cron} if retries: body["max_retries"] = retries if tags: body["tags"] = tags if isinstance(tags, list) else tags.split(",") if template: body["template"] = template if description: body["description"] = description try: resp = requests.post( f"{BASE_URL}/api/cron-task", headers=headers, json=body, timeout=15 ) ``` ### Technical Analysis Task names, schedules, tags, template identifiers, and descriptions are transmitted to `www.jiebang.site`. Other commands also retrieve remote task data and submit execution status or messages. This network behavior is relevant to the declared API-backed task-management functionality and is not evidence of unrelated exfiltration. However, the Skill documentation does not clearly explain which user fields leave the local environment, that an external operator receives them, or what retention and deletion rules apply. Natural-language task descriptions can reveal working hours, business activities, financial monitoring routines, customer references, or other sensitive context. The risk therefore concerns transparency, data minimization, and informed consent rather than an unauthorized network destination proven to be malicious. ### Attack Path 1. A user describes a task in natural language. 2. The agent maps the request to command-line fields such as `--name`, `--tags`, or `--desc`. 3. `create_task()` places those values into a JSON payload. 4. The payload is sent to `https://www.jiebang.site/api/cron-task`. 5. The external service processes and may retain the submitted information. 6. Service operators, compromised service infrastructure, or parties with legitim ...[truncated 552 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Clearly disclose before first use that task data is transmitted to `www.jiebang.site`. - Enumerate the transmitted fields, processing purpose, retention period, deletion behavior, and service operator. - Obtain user confirmation before uploading potentially sensitive descriptions or messages. - Minimize submitted data and avoid sending full conversational context. - Add client-side warnings against including credentials, personal data, or confidential business information. - Provide a local-only mode where feasible. - Publish or link to a privacy policy and explain how users can revoke the API key and delete stored data. - Ensure transport security, server-side access controls, and log redaction are documented and tested. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs the agent to run local Python commands, register for an API key, save that credential locally, and interact with a remote service, but it declares no explicit tool scope or permission boundaries. That creates an avoidable trust gap: the skill can trigger file and network operations without transparent constraints, increasing the chance of unintended credential storage, file access, or network use when activated.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation text is very broad and can match common conversation terms like reminders, periodic tasks, scheduling, or market-watching, which may cause the skill to trigger when the user did not intend to authorize external API use or local command execution. In this skill's context, accidental activation is more dangerous because use of the skill can lead to credential registration, local file writes, and network requests.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill says API key registration is automatic and that the key will be saved to a local file, but it does not clearly warn the user about credential creation, persistence, storage location, or security implications. This can lead to users unknowingly allowing secret material to be stored on disk, where it may be exposed through weak file permissions, backups, logs, or later local access.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The API key is written to a local file in the skill directory with no warning, permission hardening, or secure storage. Any other process, user, backup system, or packaging step that can read that directory may obtain the credential and use the remote cron-task account.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill automatically provisions a third-party API credential and persists it locally without explicit user consent. This expands the skill's effective capabilities beyond simple local task handling into remote account creation and credential lifecycle management, creating undisclosed external dependency and account linkage risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill silently performs remote registration to an external service when no key is present, causing network transmission and account creation without user awareness. Even though the posted JSON is empty, the action can still create persistent external state and may expose metadata such as source IP, environment, or agent usage patterns.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 注册新key
    try:
        resp = requests.post(
            f"{BASE_URL}/api/auth/register",
            headers={"Content-Type": "application/json"},
            json={},

• Confidence: 93% confidence
• Finding: This code transmits data to an external service to register an API key, creating an outbound network dependency and remote account state. In this skill, the transmission is more sensitive because it is automatic and tied to credential issuance, rather than being an obviously user-initiated one-time setup step.

External Transmission

Medium

• Category: Data Exfiltration

Content

body["description"] = description

    try:
        resp = requests.post(
            f"{BASE_URL}/api/cron-task",
            headers=headers,
            json=body,

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The delete operation immediately issues a destructive remote request with no confirmation, dry-run, or secondary check. In an agent context, this increases the risk of accidental or prompt-induced deletion of scheduled tasks and loss of operational state.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The human-facing description and command help text are written entirely in Chinese, with no indication that other languages are supported or that the locale restriction is intentional. This can constitute a language/locale policy issue when the skill effectively forces one language without user opt-in.

Static analysis

No suspicious patterns detected.