T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/train_lookup.py:111- Finding
API Key Exposure Through Command-Line Arguments and URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
火车订票班次查询 - 聚合数据
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward Chinese train timetable lookup tool, but users should handle the Juhe API key carefully.
Install only if you are comfortable using Juhe for train lookups. Prefer JUHE_TRAIN_KEY as an environment variable, avoid passing the key with --key, do not commit scripts/.env, and treat route/date searches as data sent to Juhe.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The skill instructs users to write the API key into scripts/.env, which places a live credential in the project workspace where it may be accidentally committed, read by other tools, or exposed through logs and backups. Storing secrets in repo-adjacent files without explicit exclusion guidance is a common credential leakage path.
- Content
md # 方式一：环境变量（推荐，一次配置永久生效） export JUHE_TRAIN_KEY=你的AppKey # 方式二：.env 文件（在脚本目录创建） echo "JUHE_TRAIN_KEY=你的AppKey" > scripts/.env # 方式三：每次命令行传入
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The documented command-line form passes the API key as --key on the shell command line, which can expose the secret through shell history, process listings, job logs, telemetry, or screenshots. Compared with environment variables, argv-based secrets are significantly easier to leak to other local users or monitoring systems.
- Content
md export JUHE_TRAIN_KEY=你的AppKey # 方式二：.env 文件（在脚本目录创建） echo "JUHE_TRAIN_KEY=你的AppKey" > scripts/.env # 方式三：每次命令行传入 python scripts/train_lookup.py --key 你的AppKey 北京 上海 2026-03-25
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python API Key 配置（任选其一，优先级从高到低）: 1. 环境变量: export JUHE_TRAIN_KEY=your_api_key 2. 脚本同目录的 .env 文件: JUHE_TRAIN_KEY=your_api_key 3. 直接传参: python train_lookup.py --key your_api_key 北京 上海 2026-03-25 免费申请 API Key: https://www.juhe.cn/docs/api/id/817
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python API Key 配置（任选其一，优先级从高到低）: 1. 环境变量: export JUHE_TRAIN_KEY=your_api_key 2. 脚本同目录的 .env 文件: JUHE_TRAIN_KEY=your_api_key 3. 直接传参: python train_lookup.py --key your_api_key 北京 上海 2026-03-25 免费申请 API Key: https://www.juhe.cn/docs/api/id/817
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python if env_key: return env_key env_file = Path(__file__).parent / ".env" if env_file.exists(): for line in env_file.read_text(encoding="utf-8").splitlines(): line = line.strip()
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documents use of environment variables, local files, and outbound network access, but does not declare an explicit tool scope or permissions model. That omission can cause the agent or user to invoke the skill without clear understanding of what resources it will access, increasing the chance of unintended secret exposure or third-party data transmission.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language instructions, examples, and interface descriptions consistently force a single language/locale context. Under the stated policy, a skill should not impose a specific language without user opt-in unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language instructions and output text that force a specific language/locale for all users. The policy scope for SQP-3 applies to all file types, and there is no indication that the tool is region-specific only or that users can select their preferred language.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description says the skill uses the juhe.cn API, but it does not clearly warn users that their travel search details such as stations and date will be sent to an external third-party service. This is a privacy/transparency issue because users may assume the query is handled locally.
- Content