T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/birthday_pwd_query.py:22- Finding
Configurable API Base URL Can Exfiltrate the AppKey
- Content
View full analysis
- Remediation
View remediation
Security audit
生日密码 - 即刻数据
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it says, but it has an under-disclosed API endpoint override that can send the user's AppKey to an unexpected server if the runtime environment is influenced.
Install only if you trust the runtime environment and can ensure JIKE_API_BASE_URL is unset or restricted to the legitimate Jike API host. Treat the Jike AppKey like a secret because this skill sends it in the request URL, and avoid using a high-value shared key unless endpoint validation is added.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)
Tainted flow: 'url' from os.environ.get (line 139, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
The destination base URL is taken from the JIKE_API_BASE_URL environment variable and then used in urlopen(), while the request also includes the sensitive appkey. In an agent/runtime environment where environment variables can be influenced, this can redirect requests and exfiltrate the AppKey and user query to an attacker-controlled endpoint, making this an SSRF-style credential leakage risk.
- Content
python """ url = f"{API_BASE_URL}{API_PATH}?{urllib.parse.urlencode({**params, 'appkey': appkey})}" try: with urllib.request.urlopen(url, timeout=15) as response: return json.loads(response.read().decode("utf-8")) except urllib.error.HTTPError as exc: return {"code": exc.code, "message": f"接口请求失败: HTTP {exc.code}", "data": ""}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python env_value = os.environ.get(env_name, "").strip() if env_value: return env_value env_file = Path(__file__).parent / ".env" if not env_file.exists(): return "" for line in env_file.read_text(encoding="utf-8").splitlines():
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill invokes a Python script that requires environment variables, reads local files, and performs network access, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates an overbroad execution model where a host agent may grant more capability than users or reviewers can easily see, increasing the risk of unintended data access or outbound requests.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "title": "生日密码 - 即刻数据", "description": "生日密码。输入 MM-DD 生日，查询幸运、健康、建议、名人、塔罗、箴言、优点和缺点。", "env": "JIKE_BIRTHDAY_PWD_QUERY_KEY", "api_url": "https://api.jikeapi.cn/v1/birthday/pwd", "homepage": "https://www.jikeapi.cn/" }
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
json "title": "生日密码 - 即刻数据", "description": "生日密码。输入 MM-DD 生日，查询幸运、健康、建议、名人、塔罗、箴言、优点和缺点。", "env": "JIKE_BIRTHDAY_PWD_QUERY_KEY", "api_url": "https://api.jikeapi.cn/v1/birthday/pwd", "homepage": "https://www.jikeapi.cn/" }
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code places the AppKey into the query string, which commonly gets recorded in logs, proxies, browser/history-like tooling, monitoring systems, and error reports. Even over HTTPS, URL-based secret transmission increases exposure because many systems log full URLs by default.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language description and all user-facing messages are fixed in Chinese, and the script explicitly states it outputs Chinese text. This forces a specific language/locale without any user opt-in or documented justification for a locale-restricted use case.
- Content
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python """ params = {} for param_name, _ in REQUIRED_PARAMS + OPTIONAL_PARAMS: value = getattr(args, param_name, "") value = validate_date_param(param_name, str(value)) if value: params[param_name] = value
Static analysis
No suspicious patterns detected.