T08 · Insecure Dependencies
Warning
- Location
SKILL.md:13- Finding
Unpinned Third-Party Dependencies Create Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Pill Counter Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real pill-counting tool, but its AI mode can upload medication images externally and its file handling is broader than its declared workspace scope.
Review before installing. Use the local OpenCV mode for sensitive medication photos unless you are comfortable sending the image to Xiaomi MiMo. Run it only on files inside the declared pill-counter workspace, and avoid using output paths that could overwrite important files.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/pill_counter.py:304- Finding
User-Controlled Paths Bypass the Declared Filesystem Scope
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/pill_counter.py:326- Finding
Default Execution Creates and May Overwrite Undisclosed Output Files
- Content
View full analysis
_report.csv` or `_result.jpg` already exists beside the input. 3. The analysis succeeds. 4. The script opens or writes the derived destination without checking whether it exists. 5. The existing file is truncated or replaced by generated output. Alternatively, no prior file needs to exist: the Skill still creates files that the user did not explicitly request. ### Impact Assessment The issue permits unintended file creation and replacement within directories writable by the invoking p ...[truncated 221 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly describes an AI mode that compresses and base64-encodes user images before sending them to an external MiMo API, but the documentation does not clearly warn users that local image content leaves the device and may be processed by a third party. Because pill images can contain sensitive medical context, packaging, labels, or other identifying information, this creates a real privacy and data-handling risk through inadequate disclosure rather than direct code exploitation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script’s docstring, prompts, CLI help, and runtime output are written in Chinese, with no user option to select another language or indication that the tool is intentionally limited to a Chinese-speaking context. This can violate language/locale policy when a skill imposes a specific language without opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
In AI mode, the script base64-encodes the input image and sends it to a third-party API, but the CLI help and flow do not clearly warn users that image contents leave the local machine. If pill photos contain patient information, labels, or other sensitive context, this can cause an unintended privacy and compliance breach.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The script sends user-supplied image data to an external domain over the network as part of AI mode. In this skill context, images of medication may include sensitive health-related information, making silent external transmission materially risky even though it is functionally intended.
- Content
python {"type": "image_url", "image_url": {"url": f"data:image/jpeg;base64,{img_b64}"}} ]}]} req = urllib.request.Request("https://api.xiaomimimo.com/v1/chat/completions", data=json.dumps(payload).encode(), headers={"Content-Type": "application/json", "Authorization": f"Bearer {api_key}"})
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The docstring at L198 says this function performs '多参数投票检测' and nearby comments describe using 3 parameter sets and a stabilized voting-style result. However, after collecting all groups, the code at L211-L216 simply selects the one group whose count is closest to the median and assigns it directly to
merged, never calling the actual merge routinemerge_pills_groupsdefined earlier. This is an intent/code contradiction, not merely missing detail.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
文件中的自然语言说明整体仅使用中文，未提供用户可选择语言的说明，也没有表明该技能仅面向特定中文区域或场景。根据规则，若技能强制特定语言而无用户选择或合理地域限定，可构成语言/locale 政策问题。
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The code accesses a local configuration file and reads an API credential from it to authorize remote requests. This is sensitive credential handling, but there is no comment, docstring warning, or user-facing notice that the skill will access stored API credentials when AI mode is used.
- Content