T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch-asr-recordings.mjs:11- Finding
Bearer Token Forwarding to Arbitrary Plaintext Endpoints
- Content
View full analysis
- Remediation
View remediation
Security audit
Legion Loan Outreach Insight
Security checks for vulnerabilities and agentic risk
Overview
The skill is meant to analyze ASR call transcripts, but it handles bearer tokens, tenant identifiers, and transcript records with too little scoping or protection.
Review carefully before installing. This should not be used with real customer or employee recordings until endpoint allowlisting, HTTPS, tenant binding, validated time ranges, transcript/field minimization, and bounded/redacted error logging are added. The scripts also currently contain a JavaScript syntax error in parse-time-range.mjs, so the skill does not run as packaged.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/fetch-asr-recordings.mjs:69- Finding
Caller-Controlled Tenant Identifiers Are Not Bound to Authenticated Token Claims
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/resolve-user-intent.mjs:106- Finding
Confirmed Time-Range Override Bypasses Query Scope Limits
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/fetch-asr-recordings.mjs:89- Finding
Entire Backend Recording Objects Are Exposed Instead of an Explicit Field Allowlist
- Content
View full analysis
r?.asrText ?? "").join("\n"); const themeRelated = analysisFocus.explicit ? isThemeRelatedToTranscripts(combinedAsrText, analysisFocus) : true; const payload = { ok: res.ok && apiBody?.code === 0, httpStatus: res.status, apiCode: apiBody?.code, apiMsg: apiBody?.msg, baseUrl: root, httpMethod: method, userMessage: intent.userMessage, outputFormat, query: { userId, orgId, startTime: timeRange.startTime, endTime: timeRange.endTime, timeZone: timeRange.timeZone, timeSource: timeRange.source, timeConfidence: timeRange.confidence, timeLabel: timeRange.label, timeNotice: reportPlan.timeNotice, }, analysisFocus, themeRelated, reportPlan: { ...reportPlan, themeUnrelated: analysisFocus.explicit && !themeRelated, themeUnrelatedMessage: analysisFocus.explicit && !themeRelated ? `在所查时间窗内，转写内容未涉及「${analysisFocus.theme ?? analysisFocus.rawPhrase}」，仅输出：无相关内容。` : null, }, recordCount: records.length, recordsTruncated: records.length > MAX_RECORDS_HINT, recordsHint: records.length > MAX_RECORDS_HINT ? `记录数 ${records.length} 超过建议上限 ${MAX_RECORDS_HINT}，分析时请优先近期样本并抽样摘录。` : null, records, }; console.log(JSON.stringify(payload)); ``` ### Technical Analysis The declared analysis requirement states that conclusions should use only `asrText`, but the implementation passes each complete backend record through to stdou ...[truncated 1448 chars]- Remediation
View remediation
({ recordingId: record.recordingId, recordedAt: record.recordedAt, asrText: String(record.asrText ?? ""), })); ``` - Include only fields demonstrably required for report generation. - Explicitly exclude `aiJiaolianResultJson`, `aiSummaryContent`, credentials, storage URLs, internal metadata, and unknown properties. - Apply actual record-count, transcript-length, and total-output-size limits rather than returning only a warning. - Prefer pagination or bounded sampling before printing data. - Review stdout retention and access controls because transcripts themselves are sensitive. - Add schema tests that fail if unexpected backend fields appear in Skill output. ]]>
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/fetch-asr-recordings.mjs:176- Finding
Raw Non-JSON Backend Responses Are Written to Error Logs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **禁止只跑 `fetch-asr-recordings.mjs` 而不先意图解析**（fetch 内置相同解析，若需反问会直接 `ok:false` 且不拉数）。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ## 时间规则（`parse-time-range.mjs`）
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill explicitly documents use of environment variables and network access (
LEGION_AUTH_TOKEN,LEGION_HARDWARE_BASE_URL, and calls to an internal HTTP service), but it does not declare any tool scope or allowed-tools boundary. This creates an overbroad execution surface where the runtime may grant undeclared capabilities, reducing reviewability and increasing the risk of unintended data access or network exfiltration if the skill or adjacent components are modified.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill processes ASR transcript content and sends data to an internal analysis service, but the user-facing description does not clearly warn that conversation-derived transcript data will be transmitted for backend analysis. This weakens informed consent and can expose sensitive customer or employee conversation content to internal systems without adequate transparency, which is especially concerning given the reporting and summarization workflow over recordings.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code sends userId, orgId, time-range parameters, and a bearer token to a remote HTTP endpoint, but the script provides no confirmation prompt or user-facing disclosure before performing the request. The only visible messages are error responses for missing inputs, not warnings that sensitive identifiers and credentials will be transmitted over the network.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This file defines the skill’s analysis themes, keywords, and documentation entirely in Chinese, including user-interpreted labels such as "股票趋势", "拓客复盘", and "销售话术". Because the skill recognizes and returns Chinese-only themes without offering a language choice or documenting a justified region-specific restriction, it creates a locale policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file’s comments and parsing logic indicate the skill is designed around Chinese phrasing and a fixed Asia/Shanghai locale, and the returned result also hard-codes that timezone. Under the policy, forcing a specific language or locale without offering user choice or documenting a justified region-specific constraint is a natural-language policy violation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The resolver appends process.env.LEGION_USER_MESSAGE to the effective user input, meaning behavior can be influenced by out-of-band data not supplied in the current request. This creates an input-smuggling channel that can alter parsed time range, analysis focus, or output format, undermining trust in intent resolution and potentially causing unauthorized or misleading actions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Clarification can be globally bypassed via process.env.LEGION_SKIP_CLARIFICATION === "1", which contradicts the skill’s described ask-first workflow and allows execution with defaults even when time range or analysis dimensions are missing or ambiguous. In practice this can silently suppress a safety/accuracy control and lead to data retrieval or reporting based on assumptions the user never confirmed.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file-level comment and user-facing error strings are written only in Chinese, indicating an implicit language constraint with no opt-in or alternative locale handling. Under the policy, forcing a specific language without user choice or documented justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This file includes natural-language comments and usage guidance only in Chinese ("仅解析用户意图（不拉数）" and "用法"). Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation, and there is no indication here that the skill offers an alternative language or that the constraint is justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file-level description and all user-facing clarification strings are written exclusively in Chinese, indicating the skill expects or enforces Chinese-language interaction. There is no natural-language indication that users may choose another language or locale, which can violate language/locale policy requirements when no opt-in is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown template contains all user-facing text in Chinese, including headings, labels, and footer content. Under the policy rule for language/locale, forcing a specific language without opt-in or clear justification is a natural-language policy concern.
- Content