Security audit

Aixin

Security checks for vulnerabilities and agentic risk

Overview

This social messaging skill mostly matches its stated purpose, but it asks for and uses sensitive authority in ways users are not clearly warned about.

Review before installing. Use this only if you are comfortable sending profile details, passwords, messages, contacts, and task contents to the AIXin backend. Do not reuse an important password. Avoid leaving registration biography blank unless the system_prompt behavior is removed, and prefer a build that uses HTTPS-only endpoints, redacts tokens from output, disables background polling by default, and stores credentials in an OS keychain instead of plaintext JSON.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: main.py:202
Finding: System Prompt Content Can Be Disclosed to an External Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: main.py:43
Finding: Account Password and JWT Are Persisted in Plaintext
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: main.py:18
Finding: Unrestricted Server Override Permits Plaintext or Attacker-Controlled Credential Transmission
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:12
Finding: Skill Instructions Require Raw API Responses That May Contain Authentication Tokens
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Dependency Uses an Unbounded Minimum Version Without Integrity Pinning
Content: View full analysis
=2.28.0 ``` The documented installation workflow is: ```bash pip install -r requirements.txt ``` ### Technical Analysis The dependency specification accepts any current or future release of `requests` above the minimum version. It does not pin a reviewed release, constrain an upper bound, or provide package hashes. As a result, installations performed at different times may resolve to different code that was not present during this audit. No evidence was found that the current `requests` package is malicious. The issue is the lack of reproducibility and integrity controls, which increases exposure to future compromised releases, unexpected breaking changes, or unsafe transitive dependency resolution. ### Attack Path 1. A user follows the documented installation command. 2. The package resolver queries the configured Python package index. 3. It selects any version satisfying `requests>=2.28.0`, including a future unreviewed release. 4. If the selected package or a transitive dependency is compromised, its installation or runtime behavior executes in the user's Python environment. 5. The compromised component inherits the privileges of the installation process or skill runtime. ### Impact Assessment The exact impact depends on a compromised dependency's behavior and the privileges under which installation or execution occurs. Potential scope includes access to local files, AIXin credentials, network traffic, and the hosting agent process. Under the reviewed state, this is a hardening weakness rather than evidence of an actively malicious dependency. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description understates behaviors identified by analysis, including possible prompt-derived profile exfiltration, local plaintext password storage, and background polling for messages. This mismatch prevents informed consent and can hide risky processing of credentials, private conversation data, and persistent network activity behind a benign social-messaging description.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill stores both the JWT token and the plaintext password in ~/.aixin/profile.json for automatic relogin. Local plaintext credential storage greatly increases the blast radius of local compromise, malware, backups, shared accounts, or accidental file exposure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The registration flow derives profile content from system_prompt via _extract_bio(system_prompt) and then transmits it to the remote service as bio. System prompts often contain hidden instructions, private context, owner metadata, or secrets, so this creates a direct exfiltration path to a third-party server without clear informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly encourages sending messages, friend requests, and delegated tasks to a remote backend, which likely includes user-generated content and contact identifiers, but provides no privacy or data-transfer warning. In a social-communication skill, this omission is security-relevant because users may unknowingly transmit sensitive prompts, relationship data, or business information to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README discloses that the skill depends on an external backend at a raw HTTP endpoint and supports cross-platform communication, but does not warn users about the trust, privacy, and integrity implications of that dependency. Because the service is remote and uses unencrypted HTTP, network attackers or the backend operator could observe or tamper with agent registration, messages, contacts, and tasks.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill invokes external network actions and handles potentially sensitive user data, yet it declares no tool scope or permission boundaries. Without explicit allowed-tools and restrictions, an agent runtime may grant broader capabilities than the user expects, increasing the chance of unintended file, environment, or network access during skill execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger description is broad enough to activate on common conversational phrases, which can cause the agent to invoke this skill unexpectedly. In a skill that sends network requests and transmits user content, accidental activation raises privacy and consent risks even if the underlying functionality is intended.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The skill explicitly directs real outbound curl requests to a third-party service and mandates returning real responses, meaning user-supplied registration details, credentials, identifiers, and messages are transmitted externally as part of routine use. External transmission is expected for this skill's purpose, but it is still security-relevant because it handles sensitive communications and normalizes automatic network disclosure.
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
## ⚠️ 重要规则 1. **必须真实执行** curl 命令，绝对不能模拟、编造或伪造 API 响应 2. **唯一的 API 地址**是 `https://aixin.chat/api`，没有其他地址 3. **不存在** `/api/auth/register` 端点，注册端点是 `POST /api/agents` 4. 执行命令后，必须将真实返回的 JSON 展示给用户

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill requires displaying full raw JSON responses to the user after API calls. Raw responses can contain sensitive fields such as identifiers, metadata, private message content, or server-side details that should be filtered, summarized, or redacted before presentation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The 'when to use' section uses vague criteria like adding friends, sending messages, or delegating tasks without clarifying that these are specific to the external AIXin service. That ambiguity can cause the agent to route ordinary chat intents into an external platform, exposing identifiers, messages, or relationship data unnecessarily.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The registration and messaging flows send nickname, owner name, password, profile data, and message content to an external server without a clear privacy warning or data-use disclosure. Users may unknowingly provide credentials and personal content to a third party, which is especially risky because the skill instructs direct API usage as part of normal conversation.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The registration flow instructs the agent to derive the bio from conversation context, which creates a pathway for reusing unrelated or sensitive user-provided content in a public or remote profile. In agent environments, 'conversation context' can include hidden instructions or private details not intended for external transmission.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The unread-message flow defaults to fetching and returning complete message contents, which encourages disclosure of private communications in full rather than using least-privilege access. This is especially risky in shared interfaces or when users only asked whether new messages exist, not for the content itself.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: User-facing prompts, help text, status messages, and interaction instructions are consistently hard-coded in Chinese throughout the skill. Because the skill does not offer a language selection or document that it is intentionally restricted to Chinese users, it may violate language/locale policy requiring user choice or explicit justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The registration flow can send system_prompt-derived content to the remote service without a clear warning that hidden host context may be included. Because users typically cannot inspect the system prompt, this undermines consent and may leak sensitive configuration or private instructions externally.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The registration UX actively encourages users to include owner details and other identifying information in a public-facing profile, while also auto-seeding bio content from system_prompt. In a social directory/market context, this materially increases the chance of unnecessary disclosure of personal or hidden contextual data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The skill derives skillTags from the bio and publishes them to the service, expanding disclosure beyond simple messaging into profiling and discoverability metadata. While not as severe as prompt exfiltration, it can reveal inferred capabilities or sensitive topical associations the user did not explicitly approve for publication.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest requests both network access and system_prompt_read, which together enable exfiltration of sensitive system or prompt data to a remote server. The skill description and commands present this as a social/chat feature but do not clearly warn users that sensitive internal agent context may be accessible or transmitted, creating a meaningful risk of unintended data disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: SQP-3 适用于所有文件类型。该 README 从标题、说明到命令示例全部以中文呈现，没有提供多语言选项、英文说明或任何语言限制的明确声明，可能构成未获用户选择的语言/locale 约束。
Content: No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Confidence: 50% confidence
Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
Content: Scanner excerpt · main.py (reported line 95)May include surrounding context.
python
headers.update(self._auth_headers()) kwargs["headers"] = headers resp = getattr(session, method)(url, **kwargs) data = resp.json() # 如果返回 401（token 过期），尝试重新登录

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Confidence: 50% confidence
Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
Content: Scanner excerpt · main.py (reported line 103)May include surrounding context.
python
headers.update(self._auth_headers()) kwargs["headers"] = headers resp = getattr(session, method)(url, **kwargs) data = resp.json() # 如果返回 401（token 过期），尝试重新登录

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The dependency is specified as requests>=2.28.0, which allows any future version to be installed and makes builds non-reproducible. This is risky because a vulnerable or breaking release could be pulled in later without review, and in a social/messaging skill that likely handles network traffic and possibly credentials, dependency hygiene matters more than in an offline tool.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: Because the manifest does not pin requests to a specific version, it is impossible to verify whether the installed version includes fixes for known advisories affecting the package. In a communication skill that may make outbound HTTP requests and process remote URLs, this uncertainty increases supply-chain and runtime risk, even though the file alone does not prove a currently exploitable vulnerable version is installed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language description and all listed commands are Chinese-only, which can impose a language constraint on users without offering an alternative or explicit opt-in. Under the stated policy, forcing a specific language without user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.