T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:158- Finding
Hardcoded WeCom Application Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
火一五企微
Security checks for vulnerabilities and agentic risk
Overview
The skill is for WeCom messaging rules, but it exposes credential material and directs automatic cross-user storage of personal profile data.
Do not install this version without review. The publisher should remove and rotate the exposed WeCom credentials and webhook material, replace examples with placeholders or a secure integration layer, require explicit confirmation before sending messages or files, and stop storing user profile data in shared memory.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:232- Finding
Exposed WeCom Robot Webhook Credential Material
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:257- Finding
Automatic Collection and Cross-User Storage of Personal Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (17)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs automatic collection and shared-memory storage of user profile data without any user-facing warning or consent flow. This is dangerous because users are not informed that identity attributes are being fetched from an external API and persisted in a cross-session shared location.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is presented as a messaging/rules standard, but it embeds live WeCom credentials, agent identifiers, and webhook capability that enable real outbound actions. This materially expands the skill from guidance into an operational secret-bearing integration, creating immediate risk of unauthorized messaging, abuse of enterprise channels, and credential leakage.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The skill includes credential acquisition flow for obtaining an access token, and elsewhere provides the corresponding secret and tenant details needed to authenticate. Exposed enterprise API credentials can allow attackers or unintended agents to impersonate the application, send messages, and query user data.
- Content
常用API
bash # 获取Access Token curl -s "https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=$CORP_ID&corpsecret=$SECRET" # 发送应用消息（私聊）
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Automatic periodic and per-conversation retrieval of user information is specified without privacy warning, making the collection invisible to the affected users. Hidden recurring collection significantly raises compliance and trust risks, especially when paired with persistence across sessions.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directs ongoing harvesting of user profile data and persistence in a shared memory accessible across users, combining overcollection with insecure storage design. This makes the context more dangerous because the capability is automatic, repeated, and normalized as part of routine conversation handling.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 100% confidence
- Finding
This section explicitly pairs a live-looking corporate ID with a hardcoded secret and token retrieval command, which is direct credential exposure. In context, the skill also includes message-send and user-lookup calls, so the leaked secret can be used for both outbound messaging and user data access.
- Content
执行方式
bash # 获取 Access Token CORP_ID="wwd00a4d7e69fffdf1" SECRET="Jg7-sBKn1rhynH_NUgAf-C6dxmNrpUIxLz8qfQ109OQ" TOKEN=$(curl -s "https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=$CORP_ID&corpsecret=$SECRET" | grep -o '"access_token":"[^"]*"' | cut -d'"' -f4)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The session-start workflow stores identity metadata in shared memory for all users without warning that it is cross-user accessible. This creates a clear risk of privacy violation and unauthorized disclosure because identifying data is normalized into a public/shared context.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly states that public/shared memory is shared by all users and still instructs storing identity details there. This is a direct privacy and segregation failure that could expose user names, IDs, and gender across unrelated users or workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill mandates outbound WeCom transmission for files and messages by default, but does not clearly warn users that content will be sent externally or that fallback methods may be used on failure. This can lead to unexpected external transmission of sensitive material and reduced user control over delivery paths.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases for proactive outbound messaging are broad enough to match ordinary conversational text, which can cause unintended sends to enterprise contacts. In a system with real messaging capability, ambiguous triggers increase the chance of accidental data disclosure or unauthorized communication.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill mandates automatic retrieval of user profile data and storage into shared memory even though its stated purpose is messaging rules. This is unnecessary data collection and persistence, and shared storage increases the chance of cross-user exposure and misuse of personal information.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions require collecting and storing identity data in shared memory across conversations, which violates data minimization and separation principles. Shared persistence of personal data can expose one user's information to unrelated contexts, tools, or users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill forces gender-based honorifics and defaults to a gendered form of address without user choice. While not a classic technical exploit, it drives unnecessary collection/inference of sensitive personal attributes and can produce harmful or inappropriate communications.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
This snippet performs real external transmission to the WeCom message API using an access token, enabling outbound delivery of content to enterprise recipients. In the context of a skill file, embedding executable transmission patterns increases the chance of unauthorized or accidental exfiltration and misuse.
- Content
md TOKEN=$(curl -s "https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=$CORP_ID&corpsecret=$SECRET" | jq -r '.access_token') curl -s -X POST "https://qyapi.weixin.qq.com/cgi-bin/message/send?access_token=$TOKEN" \ -H "Content-Type: application/json" \ -d '{ "touser": "用户ID",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The documented commands fetch tokens and send messages to external WeCom endpoints, so the skill contains actionable external communication behavior rather than passive policy text. This is risky because it can be repurposed for unauthorized outbound messaging or data transfer if the embedded configuration is valid.
- Content
bash # 获取Access Token curl -s "https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=$CORP_ID&corpsecret=$SECRET" # 发送应用消息（私聊） curl -s -X POST "https://qyapi.weixin.qq.com/cgi-bin/message/send?access_token=$TOKEN" \
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill broadens into periodic and conversation-triggered harvesting of user information from the WeCom API, which is outside the narrow scope of formatting or delivery rules. Continuous collection tied to routine interactions creates a surveillance-like behavior and increases privacy and data handling risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The repeated policy reinforces use of gendered honorifics based on retrieved profile information without offering a neutral option or user preference. This increases privacy and dignity risks by operationalizing personal attribute inference in routine messaging.
- Content