T09 · Insecure Skill Coding Practices
Error
- Location
quark-save.mjs:118- Finding
Quark login cookie can be redirected to an arbitrary network endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Resource 2 NAS
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but its scripts can send full cloud-session cookies or OpenList tokens to unsafe caller-controlled endpoints.
Review carefully before installing. Use only official HTTPS Quark/Baidu endpoints, use HTTPS or loopback-only OpenList, avoid endpoint/token override flags unless you fully trust the destination, and keep the preview-confirm-then---yes flow for every save, copy, or cancellation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
baidu-save.mjs:126- Finding
Baidu login cookie can be sent to an attacker-selected API server
- Content
View full analysis
controller.abort(), options.timeoutMs || DEFAULT_TIMEOUT_MS); try { const headers = { Accept: options.accept || "application/json, text/plain, */*", "User-Agent": USER_AGENT }; if (options.body instanceof URLSearchParams) { headers["Content-Type"] = "application/x-www-form-urlencoded"; } if (options.cookie) headers.Cookie = options.cookie; if (options.referer) headers.Referer = options.referer; const response = await fetch(requestUrl, { method: options.method || "GET", headers, body: options.body, signal: controller.signal }); return { response, url: requestUrl }; } finally { clearTimeout(timeout); } } function resolveCookie(args) { return (args.env?.[args.cookieEnv] || process.env[args.cookieEnv] || "").trim(); } function normalizeApiBase(value) { return String(value || DEFAULT_API_BASE).replace(/\/+$/g, ""); } ``` Credential-bearing functions construct URLs from that unvalidated API base, for example: ```javascript async function getBaiduBdstoken({ apiBase, timeoutMs, cookie }) { const url = new URL("/api/gettemplatevariable", normalizeApiBase(apiBa ...[truncated 1923 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
check-cookies.mjs:99- Finding
Cookie validation command forwards full provider credentials to arbitrary base URLs
- Content
View full analysis
controller.abort(), options.timeoutMs || DEFAULT_TIMEOUT_MS); try { const response = await options.fetchImpl(url, { method: "GET", headers: { Accept: "application/json, text/plain, */*", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36", Cookie: options.cookie }, signal: controller.signal }); // ... } finally { ...[truncated 1687 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
openlist-copy.mjs:319- Finding
OpenList bearer token may be transmitted over cleartext HTTP and can be redirected by endpoint overrides
- Content
View full analysis
controller.abort(), timeoutMs || DEFAULT_TIMEOUT_MS); try { const response = await fetchImpl(`${normalizeBaseUrl(baseUrl)}${apiPath}`, { method, headers: { Accept: "application/json", "Content-Type": "application/json", Authorization: token }, body, signal: controller.signal }); // ... } finally { clearTimeout(timeout); } } ``` The readiness checker has equivalent behavior: ```javascript const url = `${normalizeBaseUrl(baseUrl)}/api/fs/list`; const response = await fetchJsonWithTimeout(url, { fetchImpl, timeoutMs, method: "POST", headers: { "Content-Type": "application/json", Authorization: token }, body: JSON.stringify({ path: targetPath, password: "", page: 1, per_page: 20, refresh: true }) }); ``` ### Technical Analysis OpenList is self-hosted, so a configurable service address is necessary ...[truncated 2272 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (25)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Copy the example environment file and fill in real values:
bash cp .env.example .env npm run check-ready
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js import path from "node:path"; import { fileURLToPath } from "node:url"; const DEFAULT_ENV_FILE = ".env"; const PROVIDER_CONFIG = [ {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js import path from "node:path"; import { fileURLToPath } from "node:url"; const DEFAULT_ENV_FILE = ".env"; const PROVIDER_CONFIG = [ {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js import path from "node:path"; import { fileURLToPath } from "node:url"; const DEFAULT_ENV_FILE = ".env"; const PROVIDER_CONFIG = [ {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js import path from "node:path"; import { fileURLToPath } from "node:url"; const DEFAULT_ENV_FILE = ".env"; const PROVIDER_CONFIG = [ {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js import path from "node:path"; import { fileURLToPath } from "node:url"; const DEFAULT_ENV_FILE = ".env"; const PROVIDER_CONFIG = [ {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js import path from "node:path"; import { fileURLToPath } from "node:url"; const DEFAULT_ENV_FILE = ".env"; const PROVIDER_CONFIG = [ {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js import path from "node:path"; import { fileURLToPath } from "node:url"; const DEFAULT_ENV_FILE = ".env"; const PROVIDER_CONFIG = [ {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js import path from "node:path"; import { fileURLToPath } from "node:url"; const DEFAULT_ENV_FILE = ".env"; const PROVIDER_CONFIG = [ {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js import path from "node:path"; import { fileURLToPath } from "node:url"; const DEFAULT_ENV_FILE = ".env"; const PROVIDER_CONFIG = [ {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js console.error(" --context-name \"资源名\" 用上下文资源名修正保存后的文件名"); console.error(" --resource-type auto|series|movie|collection"); console.error(" --rename-plan-json '[{\"rank\":1,\"name\":\"修正名\",\"reason\":\"Agent 判断\"}]'"); console.error(" --env-file .env 从 ENV 文件读取默认保存目录和 Cookie"); console.error(" --cookie-env QUARK_COOKIE 从指定环境变量读取夸克 Cookie"); console.error(" --select all|1,3|2-5 默认选择，交互确认时可覆盖"); console.error(" --yes 跳过确认，直接使用 --select");
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js console.error(" --context-name \"资源名\" 用上下文资源名修正保存后的文件名"); console.error(" --resource-type auto|series|movie|collection"); console.error(" --rename-plan-json '[{\"rank\":1,\"name\":\"修正名\",\"reason\":\"Agent 判断\"}]'"); console.error(" --env-file .env 从 ENV 文件读取默认保存目录和 Cookie"); console.error(" --cookie-env QUARK_COOKIE 从指定环境变量读取夸克 Cookie"); console.error(" --select all|1,3|2-5 默认选择，交互确认时可覆盖"); console.error(" --yes 跳过确认，直接使用 --select");
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The link-check function posts resource URLs plus optional view_token and proxy_url values to an external API, which can expose authentication-related data, infrastructure details, or delegated access secrets. In this skill, those parameters are especially sensitive because they may grant access to storage views or reveal internal proxy endpoints used to reach protected resources.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill clearly instructs the agent to use network access and environment-backed credentials (
OPENLIST_TOKEN,QUARK_COOKIE,BAIDU_COOKIE) but declares no explicit tool scope or permission boundaries. That creates an overprivileged/underspecified execution model where a caller or runtime may permit broader env and network access than necessary, increasing the risk of credential misuse or unintended outbound requests.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md For focused checks, use `npm run check-env -- --json` or `npm run check-cookies`. For a human-readable view, run `npm run check-ready -- --format text`. These scripts mask Cookie/Token values and never print raw secrets. If `.env` is missing, tell the user to copy `.env.example` to `.env` and fill in the required values. Never ask the user to paste secrets into docs or commit them. Required `.env` values:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The skill directs the agent to transmit a bearer-style OpenList API token in an Authorization header to a configurable URL from environment variables. Even though this is part of intended functionality, it is still a real secret-bearing external transmission path: if
OPENLIST_URL/OPENLIST_BASE_URLis misconfigured, attacker-controlled, or downgraded to insecure transport, the token could be exposed and reused for API access.- Content
OpenList list request:
bash curl "$OPENLIST_URL/api/fs/list" \ -H "Authorization: $OPENLIST_TOKEN" \ -H "Content-Type: application/json" \ --data '{"path":"/pan/quark/备份资源","password":"","page":1,"per_page":100,"refresh":true}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script loads a Baidu authentication cookie from an environment variable or .env file and automatically includes it in outbound HTTP requests to perform privileged actions on the user's Baidu account. In this skill context, that cookie is a bearer credential for cloud-drive access, so using it without explicit user-facing disclosure/confirmation at the point of transfer increases the risk of unauthorized saves, account abuse, or accidental credential use in higher-trust automation flows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code sends raw Cookie headers to remote provider endpoints to validate account access, but the file itself provides no user-facing consent, warning, or trust-boundary check before transmitting those session credentials. Because the base URLs are CLI-configurable, a user or upstream component could direct the request to an unintended host and exfiltrate highly sensitive session cookies.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code sends the OpenList token as an Authorization header and later sends cloud-drive cookies in HTTP requests, but the file provides no confirmation prompt or explicit user-facing warning that stored credentials will be used for live network connectivity checks. Because the script's purpose is a readiness check rather than an obviously interactive login flow, users may not realize it will contact external services using these secrets.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The default_prompt defines very broad triggers such as any user asking to search for media, providing a share link, checking saved resources, or wanting NAS/SMB copy operations, while implicit invocation is enabled. This can cause the skill to activate in situations the user did not clearly intend, leading to unintended file-transfer, cloud-save, or storage-management actions in a capability set that touches external shares and NAS destinations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The provider labels and rendered CLI output strings are written in Chinese, and the program does not offer a language or locale selection mechanism. This can violate language/locale policy when a skill imposes a specific language on all users without opt-in or documented justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script sends the user's search title to a third-party API endpoint by default, and the skill context is specifically about locating media resources, which may reveal user interests or copyrighted-content queries to an external service. There is no consent prompt, disclosure, or trust boundary warning in the code, so users may unknowingly transmit potentially sensitive queries off-platform.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Multiple labels, errors, and status messages are presented only in Chinese, such as provider labels and all CLI output strings. This forces a specific language/locale without user opt-in, which matches the language-policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This file contains natural-language strings in Chinese within test names and expected messages, such as the test description on L16 and later assertions. Under the policy, forcing a specific language without user opt-in can be a locale-policy issue, and no justification or language choice is present in this file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script emits user-facing error messages in Chinese only, such as the missing credential and unsupported fetch messages. This imposes a specific language on all users without opt-in or locale selection, which matches the natural-language policy violation criteria.
- Content