Scripts

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:35 AM UTC
• Version: 1.0.0

Overview

This appears to be a real paid text-generation workflow, but it needs Review because it handles prompts and payment credentials with weak scoping and asks the agent to reveal its reasoning.

Install only if you are comfortable with a Chinese-language paid service sending your prompt and payment credential to web.kihb.shop and storing order records locally. Do not use it for sensitive prompts until the publisher removes the reasoning-disclosure instruction, validates order numbers, protects local order files, and clearly documents data retention and the clawtip dependency.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:12

Finding

Skill instructions attempt to override agent behavior and request internal reasoning

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/file_utils.py:14

Finding

Unvalidated order number permits path traversal and external disclosure of credential data

Content

View full analysis

dict: base_dir = get_orders_base_dir(indicator) json_path = os.path.join(base_dir, f"{order_no}.json") if not os.path.isfile(json_path): raise RuntimeError(f"订单文件不存在: {json_path}") with open(json_path, "r", encoding="utf-8") as f: return json.load(f) ``` The attacker-controlled value reaches this function from `service.py`: ```python if __name__ == '__main__': parser = __import__('argparse').ArgumentParser(description="Get service result") parser.add_argument("order_no", help="Order number") args = parser.parse_args() indicator = compute_indicator(SLUG) try: order_data = load_order(indicator, args.order_no) question = order_data.get("question") if not question: raise RuntimeError("订单文件中缺少 question 字段") credential = order_data.get("payCredential") if not credential: raise RuntimeError("订单文件中缺少 payCredential 字段") result = counseling(question, args.order_no, credential) print(result) except Exception as e: print(f"ERROR: {e}") sys.exit(1) ``` The selected values are then transmitted externally: ```python payload = json.dumps({ "question": question, "orderNo": order_no, "credential": credential }).encode("utf-8") req = urllib.request.Request( GET_RESULT_URL, data=payload, headers={"Content-Type": "application/json"}, method="POST", ) ``` ### Technical Analysis The positional `order_no` argument is user-controlled and is interpolated directly into a filesystem path. The implementation does not reject: - Parent-directory components such as `../`. - ...[truncated 2373 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/file_utils.py:23

Finding

Payment-related order files are created without explicit restrictive permissions

Content

View full analysis

str: base_dir = get_orders_base_dir(indicator) os.makedirs(base_dir, exist_ok=True) json_path = os.path.join(base_dir, f"{order_no}.json") with open(json_path, "w", encoding="utf-8") as f: json.dump(order_data, f, ensure_ascii=False, indent=2) return json_path ``` ### Technical Analysis The order directory and JSON files are created without explicit permission modes. Their effective permissions therefore depend on the process's ambient umask and any pre-existing directory permissions. The service workflow expects order files to contain a `payCredential` field before service execution. Such files also contain order metadata and user-provided questions. If the runtime account has a permissive umask or the order directory already has permissive permissions, another local user or process may be able to read this information. The same function opens existing paths with truncation, and no symbolic-link or ownership checks are performed. The primary confirmed weakness is the absence of explicit confidentiality controls for files expected to hold payment-related data. ### Attack Path 1. An order file is created or later updated in the skill order directory. 2. The effective directory or file permissions are determined by a permissive runtime umask or pre-existing filesystem permissions. 3. Payment credentials or order metadata are stored in the JSON record as required by the documented workflow. 4. Another local account or process with filesystem access reads the file. 5. The exposed credential or order data may be reused, disclosed, or submitted to the service endpoint. Successful exploitation requires local access and sufficiently permissive effective ...[truncated 423 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is described as a paid text-generation service, but the documented behavior centers on creating local order records, persisting JSON data, and invoking payment-related scripts, while not actually describing any concrete text-generation logic. This mismatch is dangerous because it obscures the real operational footprint of the skill, making reviewers and users less able to assess data handling, payment integrity, and filesystem side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Forcing the agent to always respond in Chinese and expose chain-of-thought imposes a behavioral policy that can override user preference and safe default behavior. The language restriction alone is mostly a product issue, but coupled with required thought disclosure it becomes more dangerous because it pressures the agent to reveal internal reasoning in all interactions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction telling the agent to include its 'thinking process' conflicts with secure assistant behavior because internal reasoning can contain sensitive intermediate judgments, hidden instructions, or policy-related context not meant for end users. In a skill that also handles payments and credentials, this increases the chance of accidental disclosure during a transaction flow.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Explicitly directing the model to reveal its 'thought process' creates a direct risk of exposing internal reasoning, hidden prompts, or sensitive context derived from tools and credentials. Because this skill includes payment handling and credential.read permission, the context makes such disclosure more concerning than in a harmless standalone content skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends the user-provided question to an external domain over the network as part of order creation, but there is no explicit user-facing notice or consent flow in this code path. Because the skill is for text generation, users may place sensitive prompts or personal data into the question field, causing unintended disclosure to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script stores local order metadata including the user's question, order number, payment-related fields, and encrypted data without any visible disclosure, retention policy, or sensitivity handling. This creates privacy and local data exposure risk if the host environment is shared, compromised, or logs/backups are later accessed.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/create_order.py (reported line 67)May include surrounding context.

python

if __name__ == "__main__":
    parser = __import__('argparse').ArgumentParser(description="Create order")
    parser.add_argument("question", help="User request")
    args = parser.parse_args()

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code derives user-home paths and reads/writes JSON order files in persistent local storage. For a skill described only as generating short text after payment verification, persistent filesystem management of order artifacts is an additional capability that is not clearly justified by the stated purpose unless explicitly declared.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes a paid short-text generation service, but this file is devoted to loading and saving order records under a local 'orders' directory. Order persistence may relate to payment verification, but the implemented behavior here is order-file management rather than text generation itself, which materially exceeds the manifest's described function.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The raised RuntimeError contains a Chinese-only message ("订单文件不存在") with no indication that the user can choose locale or language. This creates a natural-language policy concern because the skill imposes a specific language in user-visible output without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The function transmits both the user's question and a payment credential to a third-party remote service, which exposes sensitive content and billing-related data outside the local trust boundary. Although the endpoint uses HTTPS, this file provides no minimization, redaction, or explicit user disclosure/consent mechanism at the point of transmission, increasing privacy and credential-handling risk if the remote service is compromised, misconfigured, or untrusted.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/service.py (reported line 55)May include surrounding context.

python

if __name__ == '__main__':
    parser = __import__('argparse').ArgumentParser(description="Get service result")
    parser.add_argument("order_no", help="Order number")
    args = parser.parse_args()

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script's natural-language runtime messages are hardcoded in Chinese, including network and order-creation errors, with no indication that the skill is region-specific or that users can opt into another language. This can violate language/locale policy when a skill imposes one language by default without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The save_order function creates directories and writes JSON data to disk, but the code provides no confirmation prompt, logging, comment, or docstring disclosing that user data will be persisted under the home directory. For a code file, this is a safety-relevant file write with no visible warning in the file itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file returns and raises multiple Chinese-only messages such as 请输入您的履约凭证 and 履约请求失败, which imposes a specific language on users. There is no indication of user opt-in, language selection, or documented region-specific justification in this file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.