T09 · Insecure Skill Coding Practices
Warning
- Location
idcard.py:25- Finding
Sensitive National ID Number and API Credential Transmitted in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
ID Card Number Origin Query - 身份证号码归属地查询
Security checks for vulnerabilities and agentic risk
Overview
The skill appears purpose-built for ID-card lookup, but it sends sensitive national ID data and an API key to a third-party API without a clear privacy warning.
Review before installing. Use it only if users understand that ID-card queries may be sent to JisuAPI, avoid submitting full national ID numbers when a six-digit region code is enough, and treat the JISU_API_KEY as a secret that may appear in provider or proxy logs because the script sends it in URL parameters.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill uses sensitive environment data and makes outbound API calls, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens reviewability and sandbox policy enforcement, making it easier for a skill to access secrets and transmit user data to a third party without clear operator awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This skill is designed to send Chinese national ID numbers to a third-party API, but the description does not warn users that highly sensitive personal data will leave the local system. Because ID card numbers directly encode identity attributes and can be used for profiling or misuse, silent transmission materially increases privacy and compliance risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
This line defines an external endpoint used for ID card lookups, confirming outbound data transmission to a third-party service. External transmission is not automatically insecure, but in this skill it becomes security-relevant because the transmitted field is highly sensitive identity data and the remote processing is not clearly disclosed by the manifest.
- Content
python import requests IDCARD_QUERY_URL = "https://api.jisuapi.com/idcard/query" CITY2CODE_URL = "https://api.jisuapi.com/idcard/city2code"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python IDCARD_QUERY_URL = "https://api.jisuapi.com/idcard/query" CITY2CODE_URL = "https://api.jisuapi.com/idcard/city2code" def query_idcard(appkey: str, req: dict):
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The implementation does not perform local parsing as described; instead, it acts mainly as a proxy to external endpoints. This is dangerous because users and platform operators may trust the skill under a false assumption that sensitive data is processed locally, leading to uninformed disclosure of personal information to a third party.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
At line 37 the code sends the full ID card number to an external API without any in-skill warning, consent step, or privacy notice. Since ID card numbers are sensitive PII, transmitting them off-platform can expose users to privacy violations, regulatory issues, or unauthorized retention by the third-party provider.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill loads a secret API key from the environment and sends user-supplied ID card data to a third-party service, while the manifest describes the capability as local parsing/query behavior. Because Chinese ID card numbers are highly sensitive personal data containing region, birth date, and identity-linked information, this mismatch creates a meaningful privacy and data-handling risk through undisclosed external transmission.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The natural-language description and inline documentation are presented in Chinese only, with no indication that the skill is region-specific or that users may choose another language. This can violate language or locale policy when a skill imposes a language without opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.