Security audit

Ai Coach Batch Session Summary

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent as an ASR report generator, but it handles private recording transcripts in ways that can expose them through public reports and bundled live-looking test data.

Install only in an environment where users understand that recording transcripts may be fetched, summarized, written to local temporary files, and uploaded to an externally reachable report link. Before approval, require private or expiring authenticated report delivery, removal of live transcript test artifacts, redaction of identifiers and raw excerpts by default, validation of custom dimensions and upload destinations, and locally bundled or integrity-pinned report scripts.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/publish_asr_report.py:71
Finding: Public disclosure of sensitive recording excerpts through persistent report URLs
Content: View full analysis
[{alias_display}] ' if alias_display else "" items.append( f'
{alias_html}{html.escape(tag)}' f"{html.escape(snippet)}
" ) ``` The Skill explicitly requires public-link delivery: ```markdown This Skill's generated HTML must be delivered to the user through a publicly accessible download link. https://chat-minio.tongfudun.com/legionclaw/{objectName} ``` ### Technical Analysis The report contains verbatim excerpts from private recordings and may include customer names, financial discussions, personal circumstances, and confidential business information. The publisher uploads this report to a shared bucket with `Content-Disposition: inline`, and then constructs a stabl ...[truncated 2054 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_asr_insight_html.py:61
Finding: Stored script injection through unvalidated custom dimension names
Content: View full analysis
` element. In HTML parsing, the literal sequence `` terminates the script element even when it appears inside a JavaScript string. An attacker w ...[truncated 1859 chars]
Remediation: View remediation
` with `\u003e` - `&` with `\u0026` - U+2028 with `\u2028` - U+2029 with `\u2029` 4. Prefer placing chart data in a non-executable element such as: ```html ``` The contents must still be HTML-safe before parsing with `JSON.parse`. 5. Alternatively, generate chart initialization without embedding untrusted strings in executable markup. 6. Add a restrictive Content Security Policy that blocks arbitrary inline scripts and unauthorized outbound connections. 7. Add regression tests using ``, HTML event handlers, quotes, Unicode separators, and oversized custom dimension values. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/publish_asr_report.py:67
Finding: Environment-controlled upload destination enables silent report exfiltration
Content: View full analysis
= 300: return { "ok": False, "error": f"报告上传失败（HTTP {res.status}）", "objectName": obj, } ``` ### Technical Analysis `LEGION_UPLOAD_URL` can replace the intended upload endpoint with an arbitrary URL. The code does not enforce: - An exact destination hostname. - HTTPS. - A permitted port or path. - Certificate pinning or an organizational trust boundary. - Redirect restrictions. - Agreement between the upload destination and returned download base. Because the multipart body contains the complete generated HTML report, control over the process environment is sufficient to redirect sensitive transcript-derived content to an attacker-controlled server. Environment-based configuration may be operationally useful, but allowing unrestricted destinations for sensitive data violates least privilege. A lower-trust launcher, CI configuration, wrapper, container configuration, or adjacent automation component can alter the destination without modifying the audited ...[truncated 1193 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: asr_insight_template.html:75
Finding: Third-party CDN scripts execute in pages containing sensitive report data
Content: View full analysis
', f"crossorigin=\"anonymous\" onerror=\"this.onerror=null;this.src='{CHART_JS_CDN_FALLBACK}'\">", 1, ) ``` The template executes either remote resource: ```html ``` ### Technical Analysis Opening a generated report causes the browser to fetch and execute JavaScript from an external CDN. If the primary request fails, another external CDN is automatically trusted. No Subresource Integrity hash is supplied. Consequently, the effective code executed by a report can change after the Skill package has been audited, without any local source change. Compromise of either CDN, its account, DNS resolution, TLS trust path, or upstream package delivery can introduce arbitrary JavaScript into every opened report. The remote script executes in the context of a page containing private transcript excerpts. The fallback broadens the supply-chain trust boundary instead of failing closed. Loading the external resources may also disclose client network metadata and potentially the report URL through service logs or referrer behavior. ### Attack Path 1. An attacker compromises or substitutes the Chart.js asset delivered by either configured CDN. 2. A victim opens a ...[truncated 855 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: test-output/asr_completed_live.json:1
Finding: Live recording transcripts and persistent identifiers are bundled in test artifacts
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (29)

Tainted flow: 'req' from os.environ.get (line 81, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 93% confidence
Finding: The upload destination is derived from environment variables (LEGION_UPLOAD_URL / LEGION_DOWNLOAD_BASE) and then used in urlopen without any allowlist, scheme restriction, or host validation. If an attacker can influence the runtime environment, they can redirect the HTML report upload to an arbitrary endpoint, causing exfiltration of potentially sensitive ASR analysis content and enabling SSRF-like outbound requests from the agent environment.
Content: Scanner excerpt · scripts/publish_asr_report.py (reported line 88)May include surrounding context.
python
headers={"Content-Type": f"multipart/form-data; boundary={boundary}"}, ) try: with urlopen(req, timeout=120) as res: if res.status < 200 or res.status >= 300: return { "ok": False,

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The manifest frames the skill as batch recording analysis, but the implementation also retrieves backend data, derives identifiers from session context, uploads generated artifacts, and exposes them via a public link. This description-behavior mismatch is dangerous because it obscures data access and publication behavior from users and reviewers, increasing the chance of unintended data disclosure.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · test-output/asr_insight_20260521_204814.html (reported line 1)May include surrounding context.
html
<!DOCTYPE html> <html lang="zh-CN"> <head> <meta charset="utf-8" />

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · test-output/asr_insight_20260521_211222.html (reported line 1)May include surrounding context.
html
<!DOCTYPE html> <html lang="zh-CN"> <head> <meta charset="utf-8" />

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · test-output/fix_test.html (reported line 1)May include surrounding context.
html
<!DOCTYPE html> <html lang="zh-CN"> <head> <meta charset="utf-8" />

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · test-output/template_verify.html (reported line 1)May include surrounding context.
html
<!DOCTYPE html> <html lang="zh-CN"> <head> <meta charset="utf-8" />

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document presents all user-facing instructions, examples, and labels exclusively in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill exercises sensitive capabilities—reading session metadata, writing files, and making network requests—without declaring an explicit tool scope or permissions boundary. That makes the skill harder to audit and can allow broader-than-expected access if the runtime grants default tool availability.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill does not clearly warn users that it will fetch backend call/transcript data and publish a generated report via a public download link. Missing user-facing disclosure undermines informed consent and increases the risk that sensitive communications are analyzed and redistributed unexpectedly.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs the agent to publish generated HTML reports through a public internet download link. Because the source data consists of call recordings and ASR transcripts, publishing report outputs to a publicly reachable URL creates a real risk of exposing sensitive business or personal conversation content beyond the intended audience.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The skill sends identifiers and time-bounded recording queries to an external backend service over HTTP to retrieve ASR-completed recordings. Even if this is part of intended functionality, it is still a real data-transmission risk because sensitive transcript data is pulled from a remote service and later processed for sharing, and the use of plain HTTP further weakens transport confidentiality.
Content: Scanner excerpt · SKILL.md (reported line 340)May include surrounding context.
md
START_TIME=$(date -v-30d +%Y-%m-%d) # Linux 默认: date -d '30 days ago' +%Y-%m-%d # 示例：用户说近三天 → START_TIME=$(date -v-3d +%Y-%m-%d) # Linux: date -d '3 days ago' +%Y-%m-%d curl -sS -X POST "http://192.168.96.17:8900/api/recordings/asr-completed" \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ -d "{\"userId\":\"${AGENTID}\",\"startTime\":\"${START_TIME}\",\"endTime\":\"${END_TIME}\"}" \

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module docstring states the skill generates an HTML insight report in Chinese, and the rest of the script consistently emits Chinese titles, labels, summaries, and error messages. There is no user opt-in, language selection, or documented justification that this skill is restricted to a Chinese-only locale, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This JSON file contains multiple natural-language summaries, labels, and coaching outputs written exclusively in Chinese, including fields such as "会议纪要", "综合评分", and Chinese classification labels. There is no indication in the file that the language choice is user-selectable or justified as a region-specific constraint, which matches the policy category for forced language/locale behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The page displays transcript excerpts and a user identifier but provides no visible privacy, sensitivity, retention, or sharing warning. Because the content includes ASR-derived conversation snippets that may contain financial, personal, or customer information, presenting it without clear sensitivity cues makes accidental disclosure, oversharing, and mishandling more likely.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The report footer exposes a persistent-looking userId alongside transcript-derived business content, even though the skill's purpose is batch analysis and summary generation rather than identity display. This unnecessarily links sensitive conversation analytics to an identifier, increasing privacy risk, correlation risk across reports, and the blast radius if the HTML is shared or accessed by unintended parties.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The report includes a persistent user identifier in the footer and embeds verbatim transcript excerpts that can contain sensitive personal, financial, or conversational data. For a skill described as batch analysis and summary reporting, exposing raw excerpts and identifiers exceeds data minimization expectations and increases privacy leakage risk if the HTML is shared, cached, or accessed by unauthorized parties.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The generated HTML imports Chart.js from third-party CDNs at runtime, which creates an unnecessary outbound dependency for a local analysis report. If the CDN, network path, or injected script is compromised, anyone opening the report could execute attacker-controlled JavaScript in the viewing context, and the page contents include sensitive transcript-derived data worth exfiltrating.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The report page fetches Chart.js from public CDNs at view time, creating an unnecessary third-party dependency and outbound network request for a locally generated analysis report. This can leak access metadata such as IP address, user agent, referrer/context, and introduces supply-chain or availability risk if the CDN is compromised or blocked.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Opening the HTML report silently triggers requests to third-party CDNs without informing the user. In a skill handling recording-transcription analysis, that behavior is more sensitive because merely viewing a report can disclose that a user is accessing potentially sensitive business communication analytics.
Content: No source excerpt is available for this finding.

Ae2

Medium

Category: analysis-evasion
Confidence: 90% confidence
Finding: Artifact content does not match its filename extension
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The report loads Chart.js from public CDNs at render time, creating an unnecessary third-party dependency for a transcript-analysis report. This exposes viewers' IPs, user agents, referrers, and access timing to external services, and it also introduces supply-chain risk if the CDN resource is tampered with or unavailable.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest description and trigger/confirmation phrases are entirely specified in Chinese, and the skill prescribes fixed Chinese confirmation wording and response patterns. There is no indication that the user may choose another language or that the Chinese-only behavior is a justified regional constraint.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest frames the skill as batch analysis of recording transcripts, but the documented implementation requires querying host session state via session_status and parsing session keys to obtain an agent ID. While this may support data retrieval, it is a separate capability involving access to conversation/session metadata that is not mentioned in the manifest.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document root sets lang="zh-CN", which hard-codes a specific language/locale for the rendered skill output. Under the policy, forcing a language without offering user choice or documenting a justified regional constraint is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document declares lang="zh-CN", and the visible content is entirely Chinese, which indicates a fixed language/locale experience. Under the policy rule, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.