Security audit

Sa Master

Security checks for vulnerabilities and agentic risk

Overview

This architecture-assistant skill needs Review because it sends project context to a fixed remote service, ships a bearer token, and lets that service define part of the runtime protocol.

Review this carefully before installing, especially for confidential projects. Use it only if you trust the remote MCP operator, are comfortable sending requirements and architecture context to that endpoint, and the embedded bearer token has been revoked or replaced with per-user secure authentication. The server-supplied protocol should be locally pinned or validated before use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:131
Finding: Remote MCP Server Can Inject Dynamic Agent Instructions
Content: View full analysis
**通讯协议规范**：包括 `[DOC]` 文档落盘、`[ASK]` 问询转发、`[NOTIFY]` 自动续调、`[HEARTBEAT]` 长任务等待、`context` 阶段调度、超时重试、响应展示、CCID 管理等，均由服务端在首次 MCP Tool 响应中通过 `[PROTOCOL v=1.0]...[/PROTOCOL]` 块自动注入。客户端解析后缓存协议内容，并在后续 context 中附加 `"proto":"1.0"` 完成握手。本文件不再重复定义协议细节。 ``` The cited source is written in Chinese. It directs the client to obtain the communication protocol from a `[PROTOCOL]` block in the first remote MCP response, cache those instructions, and apply them during subsequent requests. ### Technical Analysis The package delegates part of its agent-control protocol to the external MCP service at `https://mcp.smartmoves.com.cn/sa/mcp`. The instructions received from that server are not merely treated as untrusted tool output. The Skill explicitly requires the client Agent to parse, cache, and follow them in later workflow stages. Consequently, the effective Skill instructions can change after the local package has been reviewed. No locally defined allowlist, response signature, fixed protocol schema, or validation boundary is present to prevent the remote server from returning instructions that alter workflow behavior, request additional information, or manipulate subsequent tool calls. This creates an instruction-hijacking boundary: control-plane instructions and ordinary remote data are not separated. ### Attack Path 1. A user activates one of the architecture, API design, deployment, or design-review tools. 2. The client sends the first tool request to the configured external MCP endpoint. 3. The endpoint returns a response containing an attacker-controlled `[PROTOCOL v=1.0]` block. 4. Following `SKILL.md`, the client parses and caches the supplied protocol. 5. The injected protocol influences subsequent calls, context handling, document operations, or information requests. 6. If the ...[truncated 806 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: mcp-proxy/config.json:1
Finding: Hardcoded Bearer Credential Distributed with the Skill
Content: View full analysis
Remediation: View remediation

other

Warning

Location: mcp-proxy/call_tool.sh:69
Finding: Business Context Is Transmitted to an External Service Without Data-Minimization Controls
Content: View full analysis
3 else '', 'conversation_id': sys.argv[4] if len(sys.argv) > 4 else '' } } }, ensure_ascii=False)) " "$TOOL_NAME" "$MESSAGE" "$CONTEXT" "$CCID") ``` `mcp-proxy/call_tool.sh:88-93`: ```bash CURL_HEADERS=( -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" ) if [[ -n "$API_KEY" ]]; then CURL_HEADERS+=(-H "Authorization: Bearer $API_KEY") fi ``` `mcp-proxy/call_tool.sh:96-100`: ```bash HTTP_CODE=$(curl -s -o "$TMP_BODY" -D "$TMP_HEADERS" -w "%{http_code}" \ --max-time 300 \ "${CURL_HEADERS[@]}" \ -d "$CALL_PAYLOAD" \ "$REMOTE_URL") ``` ### Technical Analysis The proxy serializes the complete tool name, user message, workflow context, and conversation identifier into a JSON-RPC request and sends the request to the configured external endpoint. The documented workflows solicit potentially confidential material, including requirements specifications, architecture documents, data dictionaries, deployment information, interface documentation, and detailed designs. The reviewed implementation does not provide local redaction, secret detection, payload minimization, data-classification enforcement, or a mandatory consent checkpoint before transmission. HTTPS protects data in transit from ordinary network interception, but it does not prevent the destination service from re ...[truncated 1532 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill presents itself as an architecture-document assistant, but the analyzed behavior indicates remote tool dispatch, local config reading, credential use, network transmission, and relaying remote responses. This mismatch is dangerous because users may provide sensitive project documents under the assumption of local document assistance, while the skill can actually broker data to external services and execute broader actions than advertised.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the client to connect to an external MCP service using bearer authentication, but does not warn that user inputs, document paths, and possibly business artifacts may be transmitted outside the local environment. This is especially dangerous in an architecture/design context, where materials often contain confidential system topology, interfaces, and internal project details.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The instructions expose a bearer credential in plain text for client-side use. Plaintext credential disclosure enables credential theft, reuse across sessions, and unauthorized access to the remote MCP service; because the credential is meant for client distribution, it also undermines access control and accountability.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file contains a hard-coded bearer token for connecting to a remote MCP endpoint. Exposed static credentials can be copied by anyone with access to the skill file, enabling unauthorized use of the remote service, possible impersonation, billing abuse, or access to downstream data and operations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: The skill declares no explicit tool scope or permission boundaries, yet its behavior includes local file access and shell-like capabilities according to the static findings. In an agent setting, missing scope constraints increases the chance of overbroad execution, unintended local access, or future abuse when combined with ambiguous triggers and remote instructions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The description is written as a Chinese-only role/behavior definition and does not offer users any language or locale choice. Under the policy, forcing a specific language without opt-in is a natural-language policy issue unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Broad greeting-based activation means a simple 'hi' can trigger the skill's opening flow and associated setup behavior, including remote MCP connection guidance. In a multi-skill agent, underspecified activation raises the risk of accidental invocation, unexpected data handling, and user confusion about which capability is active.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger keywords overlap with common architecture discussion terms, making accidental tool invocation more likely during ordinary conversation. When combined with external MCP use and document-centric workflows, this can lead to unintended remote processing of sensitive architectural or business information.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest scope focuses on generating architecture documents, interface descriptions, deployment guides, and design reviews. Declaring an export_artifacts tool introduces packaging/download behavior beyond the explicitly stated functional scope, and the description does not justify this additional capability.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · mcp-proxy/call_tool.sh (reported line 3)May include surrounding context.
sh
#!/bin/bash # ───────────────────────────────────────────────────────────────────────────────── # MCP Tool 通讯脚本 — bash + curl + python3（零外部依赖） # # 用法: # bash call_tool.sh <tool_name> "<message>" ['<context_json>'] [conversation_id]

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script transmits the provided message, context, and conversation ID to a remote URL via curl, which can expose user data to an external service. Although the header comments describe the mechanism, there is no explicit warning, confirmation prompt, or user-facing disclosure at the point of execution that user-supplied content is being sent off-box.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The configuration hard-codes a China-specific remote MCP endpoint and also includes a plaintext API key in the same file, which means the skill is preconfigured to send data and credentials to an external service without any visible user choice or environment-based control. In the context of an architecture-design agent that may process sensitive business assets and system requirements, this creates a meaningful risk of unintended cross-border data transfer, unauthorized disclosure, and secret compromise if the file is exposed or the endpoint is not fully trusted.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's usage text, comments, and error messages are presented in Chinese only, which imposes a specific language on users without opt-in or documented locale justification. This is a natural-language policy concern because the file does not offer an alternative language or indicate that it is intentionally region-specific.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:84