T09 · Insecure Skill Coding Practices
Error
- Location
scripts/see.py:62- Finding
Untrusted or Plaintext Vision Endpoint Can Receive Sensitive Images and API Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Vision
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent image-analysis helper, but it can send local images, prompts, and an API key to arbitrary configured endpoints, including unsafe project-provided or HTTP endpoints.
Install only if you trust the configured vision endpoint and understand that image contents and prompts may leave your machine. Prefer local or HTTPS endpoints, avoid project-controlled endpoint settings in untrusted repositories, and do not reuse a sensitive global API key with arbitrary VISION_BASE_URL values.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
例如：
bash mkdir -p ~/.claude/skills cp -r vision ~/.claude/skills/
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
例如：
bash mkdir -p ~/.claude/skills cp -r vision ~/.claude/skills/
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
例如:
bash mkdir -p ~/.claude/skills cp -r vision ~/.claude/skills/
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README explains configuration of arbitrary OpenAI-compatible vision endpoints and says local files are converted and sent, but it does not prominently warn that images, OCR targets, and user prompts may be transmitted to external services. This creates a real privacy and data-handling risk because users may unintentionally send screenshots, documents, credentials, or other sensitive content off-host.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill invokes a Python script that reads local files, accesses environment-derived configuration, and can send data to remote HTTP(S) endpoints, yet the skill metadata declares no explicit tool scope or permissions. That omission weakens reviewability and policy enforcement because consumers cannot easily tell that using the skill may read images and transmit them off-host.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger language is very broad ('use this WHENEVER you need to look at...') and includes many generic image-related phrases, which can cause the skill to activate in situations where external delegation was not intended. In this skill's context, over-activation matters because activation can lead to local image reading and transmission of image content or URLs to a third-party endpoint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description explains that a script sends the image to a configurable OpenAI-compatible vision model, but it does not clearly warn the user at the point of use that local images and remote image URLs may be transmitted to an external endpoint. This creates a real privacy and data-handling risk because users may provide screenshots, documents, or internal diagrams without informed consent about off-device processing.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 0% confidence
- Finding
No genuine natural-language language/locale policy violation was identified in this file. The content is written in Chinese, but it does not force a specific output language or locale on the user.
- Content
Static analysis
No suspicious patterns detected.