T09 · Insecure Skill Coding Practices
Error
- Location
PUBLISH.md:117- Finding
Credential-Like QQ Mail Authorization Code Exposed in Documentation
- Content
View full analysis
- Remediation
View remediation
Security audit
Qq Mail Monitor
Security checks for vulnerabilities and agentic risk
Overview
The skill is a QQ Mail monitor, but it handles mailbox credentials and advertised mail automation too loosely for sensitive email access.
Review before installing. This skill requires access that can read QQ Mail inbox metadata and send mail through the configured account. Do not use it with a primary or sensitive mailbox unless the exposed auth-code-like value has been removed and revoked, credentials are moved out of source files into a safer secret store, and cron/TTS behavior is explicitly confirmed and limited.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/qq_mail_auto_check.py:18- Finding
Mailbox Credentials Are Designed to Be Stored in Plaintext Source Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the actual behavior is primarily a self-addressed SMTP test or narrow message inspection rather than the broad mail automation described, users may enable the skill in contexts involving verification codes or auto-replies without understanding its true behavior. That discrepancy can lead to unsafe operational reliance and unnecessary credential exposure.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the actual behavior is primarily a self-addressed SMTP test or narrow message inspection rather than the broad mail automation described, users may enable the skill in contexts involving verification codes or auto-replies without understanding its true behavior. That discrepancy can lead to unsafe operational reliance and unnecessary credential exposure.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the actual behavior is primarily a self-addressed SMTP test or narrow message inspection rather than the broad mail automation described, users may enable the skill in contexts involving verification codes or auto-replies without understanding its true behavior. That discrepancy can lead to unsafe operational reliance and unnecessary credential exposure.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the actual behavior is primarily a self-addressed SMTP test or narrow message inspection rather than the broad mail automation described, users may enable the skill in contexts involving verification codes or auto-replies without understanding its true behavior. That discrepancy can lead to unsafe operational reliance and unnecessary credential exposure.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
用户配置方式
bash # 1. 复制示例文件 cp .env.example .env # 2. 编辑 .env 填入真实信息 QQ_MAIL_EMAIL=your_qq_number@qq.com
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
1. 复制示例文件
cp .env.example .env
2. 编辑 .env 填入真实信息
QQ_MAIL_EMAIL=your_qq_number@qq.com QQ_MAIL_AUTH_CODE=your_auth_code
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents capabilities for IMAP/SMTP access, automatic mail checking, and mail sending, and includes a configuration example with an authorization code. However, it does not warn users that the skill will access mailbox contents, store state, and require sensitive email credentials, which could affect privacy and account security.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Line L105 states that code must contain clear Chinese comments, which is a natural-language policy constraint. This forces a specific language choice without offering alternatives, opt-in, or documenting a justified region-specific requirement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README promotes reading, monitoring, sending, and even TTS-broadcasting email content, but it does not clearly disclose the privacy implications of exposing subjects, senders, message bodies, or one-time codes to the assistant UI, logs, notifications, or nearby listeners. In this context, the skill is specifically designed to process sensitive mailbox data, so the missing warning meaningfully increases the risk of accidental disclosure of personal, corporate, or authentication-related information.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill describes scripts that read from and write local state and connect to external mail servers, but it declares no explicit tool scope or permission boundaries. That makes the operational trust model unclear and can allow broader-than-expected file and network access when the skill is invoked.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises TTS reminders of email subject and sender without clearly warning that spoken alerts can disclose sensitive information to nearby people or devices. Since emails often contain private or security-relevant information, audible notification of metadata materially increases confidentiality risk in shared environments.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Broad invocation phrases like changing check frequency, pausing monitoring, or checking mail now lack explicit scope constraints, confirmation boundaries, or exclusions. In a mail skill, ambiguous triggers can cause unintended access to inbox data or unexpected task changes, especially when paired with network and file capabilities.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill mentions attachment handling and automatic download/save scenarios without warning about local storage, data retention, or modification risks. Saving attachments can consume disk space, persist sensitive files, and introduce malicious content onto the local system if users are not clearly informed and controls are absent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The summary embeds metadata declaring the skill language as "zh-CN", and the rest of the document consistently presents the skill as Chinese-only. The policy requires flagging language or locale constraints when they are imposed without explicit user opt-in or a clearly documented regional justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code logs into a personal QQ mailbox using an authorization code and fetches email contents/metadata, which is a privacy-sensitive network operation. While the comments explain how to configure the account, they do not disclose to the user that the script will connect to the mailbox and retrieve message data for monitoring.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script is designed to authenticate to QQ Mail using credentials stored directly in source code variables, which encourages insecure secret handling. If a user replaces the placeholders with a real email address and authorization code and then stores, shares, or commits the file, those secrets can be exposed and abused for mailbox access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script prints email subject, sender, and date to stdout and packages them into JSON for external handling without any privacy warning, consent gate, or output minimization. In the context of email monitoring, these fields can contain sensitive personal or operational information and may be exposed to logs, other tools, or unauthorized viewers.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The changelog and feature description are entirely presented in Chinese, including a claim of complete Chinese documentation. For a general-purpose skill, this can constitute a language-policy concern if users are not offered a language choice or informed that the skill is Chinese-only.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
All user-facing text in the script, including the title, instructions, status output, and errors, is presented only in Chinese. This can violate a language/locale choice policy when the skill does not document that it is region-specific or provide any user opt-in for the forced locale.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and implementation are limited to checking the inbox for the latest message, recording its ID, and emitting structured output. The manifest describes broader capabilities including TTS voice reminders and mail sending/receiving, which are not implemented in this file, creating a description-to-behavior mismatch for this skill file.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The docstring presents the script as a monitor that outputs results for outside handling such as notification or speech. In practice, the code also maintains local state by reading and writing a mailbox state file, which is an additional side effect not reflected by the stated intent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The natural-language strings and documentation in this file are entirely Chinese, and runtime output is also emitted only in Chinese. There is no indication that the user can choose another language or that the locale restriction is intentional and documented as a region-specific constraint.
- Content