T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:36- Finding
Unencrypted Transmission of Sensitive Medical Queries to a Hard-Coded External Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Medical Search
Security checks for vulnerabilities and agentic risk
Overview
This medical-search skill has a legitimate purpose, but it sends sensitive health queries to a hard-coded plaintext external server and includes unsafe shell examples.
Review before installing. Only use this skill if you trust the operator of 43.156.131.167:4000 with medical search terms and are comfortable with plaintext HTTP. Prefer a version that uses a trusted HTTPS provider, obtains user consent before sending health queries externally, URL-encodes query parameters safely, and treats search results as untrusted medical references rather than definitive advice.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:36- Finding
Potential Shell Command Injection Through Unsafe Search-Query Interpolation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to send medical queries to a hard-coded external HTTP endpoint and pipe the response into Python for processing. This leaks potentially sensitive medical/drug-related user input to an untrusted third party and uses plaintext transport, enabling interception or tampering of returned data, which is especially dangerous in a medical safety workflow where poisoned results could drive unsafe advice.
- Content
bash # 基础搜索（中文医药问题推荐加 language=zh） curl -s "http://43.156.131.167:4000/search?q=QUERY&format=json&language=zh" | python3 -c " import sys, json data = json.load(sys.stdin) for i, r in enumerate(data.get('results', [])[:10], 1):
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
These examples normalize repeated use of the same hard-coded external HTTP search service for medical questions, including drug, alcohol, and contraindication queries. In this context, the risk is amplified because the transmitted searches can reveal highly sensitive health concerns, and unencrypted or untrusted results could be manipulated to influence the agent's medical recommendations.
- Content
bash # 药物+酒精 curl -s "http://43.156.131.167:4000/search?q=感冒滴丸+喝酒+禁忌&format=json&language=zh" # 药物交互 curl -s "http://43.156.131.167:4000/search?q=阿司匹林+布洛芬+能一起吃吗&format=json&language=zh"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction "回复用户时使用中文" forces a specific language for responses. Under the policy rules, locale or language constraints must either offer user choice or be clearly justified as region-specific; this file does not provide an opt-in or explicit limitation to Chinese-only users.
- Content
Static analysis
No suspicious patterns detected.