个人SKILL

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:21 AM UTC
• Version: 1.0.2

Overview

This Golang guidance skill is mostly coherent, but its examples could lead users to log sensitive MCP request and response data in production systems.

Review before installing if this skill may be used to generate production Go code. Require redacted or allowlisted logging, avoid raw request/response dumps, validate configured MCP endpoints, and add response-size limits and error handling when adapting its examples.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL-logging.md:70

Finding

Unredacted MCP Request and Response Data Written to Logs

Content

View full analysis

Vulnerability Details

File Location: SKILL-logging.md:70-73, SKILL-logging.md:79-85, SKILL-logging.md:94-97, and SKILL-logging.md:117-118
Vulnerability Type: Sensitive information exposure through logging
Risk Level: Medium

Vulnerable Code

go

if resp.StatusCode != http.StatusOK {
    xlogging.D().Error(fmt.Sprintf("mcp service returned non-200 status: %d, body: %s", resp.StatusCode, string(body)))
    return nil, fmt.Errorf("unexpected status code: %d", resp.StatusCode)
}

Additional affected examples include:

go

xlogging.D().Debug(fmt.Sprintf("mcp request params: %+v", params))

go

if resp.StatusCode != 200 {
    xlogging.D().Warn(fmt.Sprintf("mcp service returned non-200 status: %d, body: %s", resp.StatusCode, body))
}

go

func callMCPTool(ctx context.Context, toolName string, params map[string]interface{}) (interface{}, error) {
    xlogging.D().Debug(fmt.Sprintf("calling mcp tool: %s, params: %+v", toolName, params))

    start := time.Now()
    resp, err := mcpClient.Call(ctx, toolName, params)
    if err != nil {
        xlogging.D().Error(fmt.Sprintf("mcp tool %s failed: %+v", toolName, err))
        return nil, err
    }

    xlogging.D().Info(fmt.Sprintf("mcp tool %s success, cost: %v", toolName, time.Since(start)))
    return resp, nil
}

Technical Analysis

The Skill recommends logging complete MCP request parameters and complete non-success response bodies. Request parameters may contain organization names, UUIDs, search terms, procurement criteria, personal information, or credentials introduced by future callers. Error responses may contain backend diagnostics, internal identifiers, request content, stack traces, or secrets.

Although the document separately prohibits logging passwords, tokens, and personal information, the examples do not implement redaction or field selection. Because these examples are presented as ...[truncated 1459 chars]

Remediation

View remediation

Remediation Suggestions

• Replace complete parameter logging with an explicit allowlist of non-sensitive metadata, such as tool name, request ID, parameter count, and execution duration.
• Do not log response bodies by default. Record the HTTP status, request ID, endpoint identifier, and a sanitized error category instead.
• Implement centralized redaction for tokens, authorization headers, cookies, passwords, UUIDs, personal data, and query text.
• Apply strict length limits after redaction if body excerpts are explicitly required for diagnostics.
• Disable Debug and Trace output in production and ensure runtime configuration cannot enable them without authorization.
• Add automated tests that verify secrets and representative personal information never appear in generated log output.
• Update the Skill examples so their implementation is consistent with the document's stated prohibition against sensitive-data logging.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL-flow-analysis.md:72

Finding

Configuration-Controlled MCP Endpoint Permits Data Exfiltration and SSRF

Content

View full analysis

Vulnerability Details

File Location: SKILL-flow-analysis.md:72-88 and SKILL-flow-analysis.md:271-289
Vulnerability Type: Unvalidated outbound network destination
Risk Level: Medium

Vulnerable Code

go

// 读取配置
config, err := os.ReadFile("mcp-config.json")
if err != nil {
    xlogging.D().Error(fmt.Sprintf("read mcp-config.json failed: %+v", err))
    return err
}

var mcpConfig map[string]struct {
    URL string `json:"url"`
}
if err := json.Unmarshal(config, &mcpConfig); err != nil {
    xlogging.D().Error(fmt.Sprintf("parse mcp-config.json failed: %+v", err))
    return err
}

serviceURL := mcpConfig["BID_ASSISTANT_URL"].URL
if serviceURL == "" {
    xlogging.D().Error("BID_ASSISTANT_URL not configured")
    return fmt.Errorf("service URL not configured")
}

The value is subsequently used as the request destination:

go

func (c *MCPClient) Call(ctx context.Context, toolName string, params interface{}) ([]byte, error) {
    start := time.Now()
    xlogging.D().Debug(fmt.Sprintf("mcp call start: %s", toolName))

    reqBody, _ := json.Marshal(map[string]interface{}{
        "tool":   toolName,
        "params": params,
    })

    req, err := http.NewRequestWithContext(ctx, "POST", c.baseURL, bytes.NewReader(reqBody))
    if err != nil {
        xlogging.D().Error(fmt.Sprintf("create request failed: %+v", err))
        return nil, err
    }
    req.Header.Set("Content-Type", "application/json")

    resp, err := c.client.Do(req)

Technical Analysis

Network access is necessary for the declared MCP-client functionality. However, the Skill accepts the complete destination URL from mcp-config.json without validating its scheme, hostname, port, resolved address, or trust relationship.

The code does not require HTTPS, establish an allowlist of approved MCP hosts, reject embedded user information, restrict redirects, or prevent access ...[truncated 1730 chars]

Remediation

View remediation

Remediation Suggestions

• Parse the configured value with net/url and reject malformed URLs.
• Require HTTPS except for explicitly approved local development environments.
• Maintain an allowlist of trusted MCP hostnames and permitted ports.
• Reject URL user information, fragments, unexpected paths, and unsupported schemes.
• Resolve the hostname and reject loopback, unspecified, link-local, multicast, private, and cloud-metadata addresses unless specifically required.
• Use a custom http.Client.CheckRedirect policy that rejects redirects or revalidates every redirect destination.
• Apply outbound firewall or egress-proxy restrictions so the process can contact only authorized MCP services.
• Protect mcp-config.json with appropriate ownership and write permissions.
• Authenticate the MCP server and verify its TLS certificate.
• Document the exact data transmitted and obtain explicit authorization before sending sensitive query fields.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL-flow-analysis.md:279

Finding

Unbounded MCP Response Read Can Exhaust Process Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL-flow-analysis.md:279-280
Vulnerability Type: Unbounded response processing and ignored errors
Risk Level: Low

Vulnerable Code

go

reqBody, _ := json.Marshal(map[string]interface{}{
    "tool":   toolName,
    "params": params,
})

go

body, _ := io.ReadAll(resp.Body)

Technical Analysis

io.ReadAll reads until end-of-file without imposing a maximum response size. A malicious, compromised, or malfunctioning MCP endpoint can therefore return an extremely large response and force the process to allocate excessive memory.

The response-read error is discarded. This can cause the application to treat partial data as a complete response or obscure the actual cause of a failed operation. The request serialization error is also ignored, which may allow an empty or invalid request body to proceed when unsupported values are supplied.

The HTTP timeout limits elapsed request time but does not impose a deterministic response-size or memory-allocation limit.

Attack Path

1. The application calls a malicious or compromised MCP endpoint.
2. The endpoint sends a very large or continuous response body.
3. io.ReadAll repeatedly allocates memory while consuming the response.
4. The process experiences memory pressure, garbage-collection overhead, or termination due to out-of-memory conditions.
5. Alternatively, a connection error produces partial data, but the ignored error allows subsequent code to process it as though the read completed successfully.

Impact Assessment

Exploitation can degrade service performance or terminate the process, causing denial of service for users relying on the MCP client or hosting service. It does not directly provide code execution, elevated operating-system permissions, or access to unrelated files.

The scope is the affected process and potentially other workloads sharing the same memory-constrained ...[truncated 18 chars]

Remediation

View remediation

Remediation Suggestions

• Enforce a documented maximum response size with io.LimitReader or http.MaxBytesReader, allowing one extra byte to detect oversized responses.
• Abort processing and return a dedicated error when the configured limit is exceeded.
• Check and handle errors returned by both json.Marshal and io.ReadAll.
• Validate Content-Length when present, while retaining the streaming limit because the header may be absent or dishonest.
• Prefer streaming JSON decoding where the response structure permits it.
• Define separate response-size limits for list, detail, and report operations according to legitimate business requirements.
• Add tests covering oversized responses, truncated bodies, serialization failures, slow streams, and connection interruptions.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The title and description are written entirely in Chinese and present the skill as operating in that language, but there is no statement that the user may choose another language or that Chinese is required for a documented regional-compliance reason. The policy for this audit flags language or locale constraints when a skill effectively mandates a language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description labels this as a Chinese-language logging standard ("Golang 日志规范") and prescribes a fixed logging form, but it does not indicate that language choice is optional or justified by a documented locale requirement. This can violate language/locale policy by forcing a specific language convention without user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file says the skill applies to "所有 Golang 开发场景的日志记录" (all Golang development logging scenarios), which is an extremely broad trigger scope without constraints or exclusion conditions. That ambiguity could cause unintended invocation for routine Golang work whenever logging is tangentially involved.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly warns against logging sensitive data, but its examples encourage logging full request parameters and full response bodies, which commonly contain tokens, credentials, personal data, or internal identifiers. Because this is a reusable logging skill for broad Golang development scenarios, developers are likely to copy these examples directly into production code, creating systematic data leakage through logs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill description and headings are written entirely in Chinese and present the skill as a general-purpose Golang development guide for all project scenarios, but there is no indication that Chinese is optional or required for a region-specific reason. This can violate language/locale policy because it implicitly forces one language without user opt-in.

Content

No source excerpt is available for this finding.