T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/server.py:690- Finding
Unauthenticated Arbitrary Local File Disclosure Through the Widget Route
- Content
View full analysis
- Remediation
View remediation
Security audit
Zero to One Startup
Security checks for vulnerabilities and agentic risk
Overview
This skill is related to startup assistance, but its package has serious review-worthy server, widget, credential, and packaging risks before installation.
Treat this as requiring review before installation. Do not expose the server to a network or embed the widget on a real site until the path traversal, default binding, feedback authentication, XSS, plaintext/query API key handling, request-size limits, and missing packaged scripts are fixed. External LLM and Supabase credentials are purpose-aligned, but should only be configured for trusted endpoints and accounts intended for this skill.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
widget/raon-chat.js:116- Finding
DOM-Based Cross-Site Scripting in the Embeddable Chat Widget
- Content
View full analysis
').replace(/\*\*(.*?)\*\*/g,'$1'); addMsg((d.score ? '📊 '+d.score+'점' : '') + res, 'bot'); } else addMsg('⚠️ ' + (d.error||'오류'), 'bot'); } ``` ### Technical Analysis The `addMsg` function treats its argument as trusted HTML and assigns it directly to `innerHTML`. However, it receives two untrusted data sources: 1. Raw text entered by the browser user through `displayText`. 2. LLM or remote API output through `d.result` or `d.response`. The newline and bold-text replacements are formatting transformations, not HTML sanitization. They do not remove event handlers, dangerous elements, `javascript:` URLs, SVG payloads, or other active markup. Because the widget is designed to be embedded in third-party websites, injected JavaScript executes in the embedding page's origin rather than in an isolated Raon OS origin. ### Attack Path A direct user-input exploitation path is: 1. A victim opens a website containin ...[truncated 1297 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/server.py:1069- Finding
Local HTTP Service Exposed on All Network Interfaces by Default
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/server.py:839- Finding
Authentication Bypass on the Feedback Endpoint
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/server.py:124- Finding
Reusable API Keys Stored in Plaintext and Accepted in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/server.py:375- Finding
Unbounded HTTP Bodies and PDF Processing Permit Resource-Exhaustion Attacks
- Content
View full analysis
str: """Base64 PDF → text using pypdf (fallback: PyPDF2, pdfplumber).""" raw = base64.b64decode(b64data) with tempfile.NamedTemporaryFile(suffix=".pdf", delete=False) as f: f.write(raw) tmp = f.name try: try: from pypdf import PdfReader reader = PdfReader(tmp) return "\n".join(p.extract_text() or "" for p in reader.pages).strip() except ImportError: pass try: from PyPDF2 import PdfReader as PdfReader2 reader = PdfReader2(tmp) return "\n".join(p.extract_text() or "" for p in reader.pages).strip() except ImportError: pass import pdfplumber with pdfplumber.open(tmp) as pdf: return "\n".join(p.extract_text() or "" for p in pdf.pages).strip() finally: os.unlink(tmp) ``` ```python # Read body content_length = int(self.headers.get("Content-Length", 0)) if content_length == 0: self._send_error(400, "empty_body") return try: body = json.loads(self.rfile.read(content_length)) except json.JSONDecodeError: self._send_error(400, "invalid_json") return text = body.get("text", "").strip() pdf_b64 = body.get("pdf_base64", "").strip() if pdf_b64 and not text: try: text = extract_text_from_pdf(pdf_b64) except Exception as e: self._send_error(400, f"pdf_parse_error: {e}") return ``` ### Technical Analysis The server trusts the request's `Content-Length` and reads the complete body into memory without enforcing an upper bound. It then parses the complete JSON d ...[truncated 1645 chars]- Remediation
View remediation
MAX_BODY_BYTES: self._send_error(413, "payload_too_large") return ``` Also implement the following controls: - Stream large bodies rather than reading them into one allocation. - Use strict Base64 validation and estimate decoded size before decoding. - Set a lower decoded-PDF size limit. - Limit PDF page count, object count, and extracted-text length. - Parse PDFs in a separate, sandboxed worker process with CPU, memory, file-size, and wall-clock limits. - Terminate the worker on timeout. - Use per-key and per-source request-rate limits. - Configure reverse-proxy body-size and timeout limits. - Move from the single-threaded development server to a production server with bounded worker concurrency. - Keep temporary files in a restricted directory and verify cleanup. - Add malformed, oversized, and decompression-heavy PDF tests. - Apply equivalent protections to the duplicated server. ]]>
Vulnerability Patterns
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (188)
Tainted flow: 'OLLAMA_URL' from os.environ.get (line 69, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 91% confidence
- Finding
The code uses OLLAMA_URL directly from the environment to make outbound HTTP requests without validating the scheme, host, or destination. In a hostile or multi-tenant environment, an attacker who can influence environment variables can redirect requests to arbitrary internal or external endpoints, creating an SSRF-style primitive and potentially leaking prompts or probing internal services.
- Content
python def _ollama_available() -> bool: """Ollama 서버 응답 여부 확인 (3초 타임아웃).""" try: urllib.request.urlopen(f"{OLLAMA_URL}/api/tags", timeout=3) return True except Exception: return False
Tainted flow: 'req' from os.environ.get (line 93, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python body = json.dumps(data, ensure_ascii=False).encode("utf-8") if data is not None else None req = urllib.request.Request(url, data=body, headers=headers, method=method) try: with urllib.request.urlopen(req, timeout=5) as resp: resp_body = resp.read() if resp_body: return json.loads(resp_body.decode("utf-8"))
Tainted flow: 'OLLAMA_URL' from os.environ.get (line 69, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 92% confidence
- Finding
The module trusts OLLAMA_URL from the environment and uses it directly in urllib.request.urlopen, allowing requests to be redirected to an arbitrary host instead of the expected local Ollama service. In an agent setting, a manipulated environment could turn local-only model traffic and availability checks into outbound SSRF-style requests or cause prompts and embeddings to be sent to an attacker-controlled endpoint.
- Content
python def _ollama_available() -> bool: """Ollama 서버 응답 여부 확인 (3초 타임아웃).""" try: urllib.request.urlopen(f"{OLLAMA_URL}/api/tags", timeout=3) # nosec B310 return True except Exception: return False
Tainted flow: 'req' from os.environ.get (line 93, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python body = json.dumps(data, ensure_ascii=False).encode("utf-8") if data is not None else None req = urllib.request.Request(url, data=body, headers=headers, method=method) try: with urllib.request.urlopen(req, timeout=5) as resp: # nosec B310 resp_body = resp.read() if resp_body: return json.loads(resp_body.decode("utf-8"))
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a feature-rich AI platform for startup support, including analysis, matching, integrations, and retrieval-based AI capabilities. The supplied code chunk does not implement or expose any of those domain-specific behaviors. Instead, it merely acts as a launcher that synchronously executes a bash script with forwarded arguments. While this could be a small wrapper around a larger implementation, based on the provided code alone the observable behavior is materially different from the declared purpose and includes an undeclared CLI delegation mechanism.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a feature-rich AI assistant for startup support, but the supplied code chunk does not implement or expose any of those behaviors. It simply delegates execution to a bash script via spawnSync. While this may be a thin wrapper around a larger implementation, based on the provided chunk alone the actual behavior is a command-line launcher for a shell script, which is materially different from the declared end-user functionality and introduces execution of a local script not mentioned in the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The supplied code substantially supports the declared 'Agentic RAG' portion and some government program matching/eligibility behavior. It includes HyDE, Multi-Query RAG Fusion, CRAG-like critique, recursive retrieval, structured filtering over local evaluation data, and realtime fetching from approved government-related domains. However, several prominent declared capabilities are not represented in this code chunk: there is no implementation for connecting with a database/network of 3,972+ TIPS-selected startups, no investor recommendation logic, no Kakao i OpenBuilder integration, and no clear business-plan evaluation module. 'Track B financial matching' is also not specifically implemented; only generic budget/deadline filtering appears. Therefore the description overstates the skill's behavior relative to this code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The code’s actual scope is much narrower than the declared description. It implements a static financial-product matcher focused on Korean financing/support products, with simple scoring by track, keywords, and loan preference, plus optional LLM-generated explanatory text. This partially aligns with the description’s mention of Track B financial matching and startup funding support, but it does not implement most of the headline capabilities: no business plan analysis, no startup-network connection feature, no investor matching, no OpenBuilder integration, and no evidence of Agentic RAG or structured extraction pipelines. The primary behavior is therefore a simple financial recommendation utility rather than the broader AI startup companion described.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The supplied code does not implement business-plan evaluation, funding-program matching, investor recommendations, RAG, structured extraction, startup-network connection, or Kakao integration. Instead, it is a gamification subsystem that tracks actions like evaluate/match/draft by awarding XP, levels, badges, and streaks, and saves this state to a local JSON profile. While some action names loosely relate to the declared product domain, the code chunk’s actual primary purpose is unrelated support functionality and includes undeclared capabilities such as local profile persistence and CLI reset/view operations. Therefore the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description promises a broad AI-powered startup support system focused on Korean founders, including business plan assessment, policy funding matching, startup network connections, investor recommendations, Kakao integration, and advanced retrieval/extraction features. The supplied code does none of those things. It reads a local markdown reference file, parses sections into categories, exposes CLI commands to list/detail categories, and recommends ideas using straightforward keyword and synonym matching. This is a materially different primary purpose and omits nearly all advertised capabilities. No suspicious undeclared sensitive behavior is present, but the description substantially misrepresents the code's actual functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The code chunk does not implement an AI startup companion or any user-facing advisory, matching, recommendation, networking, or chatbot integration features described in the declaration. Its actual purpose is much narrower and different: offline ingestion/parsing of a specific government PDF into JSONL. While this could be a supporting data-preparation component for a larger funding-matching system, the declared description presents broad product capabilities that are not represented in this code. Therefore the description does not accurately reflect what this supplied code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The supplied code is a retrieval infrastructure component, not a full startup companion product. It supports ingesting JSONL documents, embedding them, performing hybrid search, and optional LLM reranking. While this could support a broader startup-advice system, the chunk shown does not implement several major capabilities emphasized in the description: business plan evaluation, funding-program matching as a dedicated decision engine, startup network connection, investor recommendations, Kakao integration, structured extraction, Track B financial matching, or specific Agentic RAG methods like HyDE/Multi-Query/CRAG. The actual primary purpose is a command-line RAG/search pipeline over local evaluation data, which is materially narrower than the declared end-user functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a domain-specific startup advisory product with funding-program matching, startup/investor discovery, Kakao integration, and advanced RAG/extraction features. The supplied code does not implement any of those product behaviors. Instead, it is an infrastructure/helper module for generic LLM chat and embedding access across several providers, with provider detection, environment loading, cosine similarity, and a test CLI. While such a module could support a larger AI application, this code chunk by itself materially differs from the declared purpose and lacks the claimed domain-specific capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The code broadly supports part of the declared purpose: it is clearly a startup-focused API with business-plan evaluation, improvement, government-program matching, investor-related mode names, Kakao webhook support, and optional Agentic RAG. However, the description does not accurately represent the full behavior of this chunk. The server includes significant undeclared operational capabilities: admin endpoints for API key lifecycle management, authentication/rate limiting, usage accounting, feedback ingestion, local history logging, and optional Supabase storage. It also exposes additional product features not mentioned in the description, including valuation, idea suggestion, gamification, and profile handling. In the other direction, some strongly advertised claims are not substantiated by this code chunk, especially the specific 'connect with 3,972+ TIPS-selected startups' functionality and explicit structured extraction / Track B financial matching logic. So the description is directionally related but materially incomplete and partially overstated versus the supplied code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The supplied code does not implement business-plan evaluation, funding-program matching, startup/investor connection, Kakao integration, Agentic RAG, structured extraction, or financial matching. Instead, it is a utility module for local persistence/telemetry: it reads Supabase credentials from environment files, validates the configured Supabase domain, and inserts records into raon_evaluations and raon_feedback tables over HTTP. This is a materially different function from the declared end-user startup companion capabilities, and the external resource access to Supabase is not reflected in the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description presents a broad startup-assistant platform with funding-program matching, startup network connections, investor recommendations, Kakao integration, and advanced RAG-based retrieval features. The supplied code chunk does something much narrower: it classifies input text into startup evaluation tracks (A/B/AB) and selects a corresponding system prompt. While this may be a supporting component for a larger founder-support product, its actual behavior is materially different from the declared primary purpose and does not implement the listed flagship capabilities. The track-based evaluation behavior is only loosely related to the description's mention of 'Track B financial matching,' but the code itself performs text classification rather than funding matching or financial analysis. Therefore this chunk does not accurately match the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a broad AI startup companion with funding-program matching, networking, investor recommendations, document understanding, and platform integration. The supplied code does none of those things. It only performs valuation calculations and report generation based on manual numeric inputs, with a placeholder CLI argument for a business-plan PDF marked for future LLM integration. While TIPS and government R&D are referenced, they are used merely as valuation adjustment factors, not as actual funding-program matching or eligibility analysis. This is a materially different primary purpose, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 87% confidence
- Finding
The declared description presents a broad AI startup assistant with specific domain capabilities and integrations. The supplied code chunk, however, only implements a front-end chat widget: it injects UI elements into a webpage, supports text input and PDF upload, and posts requests to generic backend endpoints for four modes. While 'business plan evaluation' and possibly 'matching' are loosely consistent with the mode names, the code does not itself implement or demonstrate the more specific declared capabilities such as government funding program matching details, investor recommendations, TIPS startup connections, Kakao i OpenBuilder integration, advanced RAG techniques, or financial matching. Because the actual code's primary purpose is an embeddable chat interface rather than the richer startup-companion behavior described, this is a description-to-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a broad founder-facing assistant with retrieval, recommendation, matching, and platform integration features. The supplied code instead implements a command-line evaluation/benchmarking utility. It stores actual review outcomes in JSONL files, invokes another script to score a plan, compares LLM outputs with ground truth, and reports accuracy metrics such as confusion matrices, precision, recall, and F1. While this loosely relates to 'evaluate business plans,' the primary behavior is offline model evaluation and performance tracking, not delivering the described startup companion capabilities. This is a material description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The declared description presents a broad AI-powered startup platform with business-plan evaluation, startup/investor discovery, Kakao integration, and advanced RAG/extraction capabilities. The supplied code chunk is much narrower: it is a standalone financial mapping utility that matches predefined Korean financing products using simple scoring based on track, keywords, and loan preference, then formats recommendations. While this partially overlaps with the declared 'Track B financial matching' and funding-program recommendation theme, the main advertised capabilities are absent from this code. There are no undeclared risky behaviors, but the description materially overstates what this code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The code chunk’s primary purpose is gamification and profile management, not an AI-powered startup advisory or matching system. It reads and writes a local JSON profile, awards XP for actions, computes levels, tracks streaks, grants badges, and exposes CLI commands for viewing/resetting the profile. None of the core declared capabilities—business plan evaluation, government funding matching, TIPS startup connection, investor recommendations, Agentic RAG, structured extraction, Track B financial matching, or Kakao i OpenBuilder integration—are implemented in this code. While some action names like 'evaluate', 'match', and 'draft' suggest integration points with a larger startup tool, this chunk itself is materially different in purpose and performs undeclared gamification and profile persistence functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a broad AI startup assistant focused on Korean founders, including business plan evaluation, government grant/program matching, startup network connections, investor recommendations, Kakao integration, and advanced retrieval features. The provided code does none of those things. It only loads a local reference markdown file (yc-rfs.md), parses idea categories with regex, exposes CLI commands to list/detail categories, and recommends top idea categories using lightweight keyword and synonym matching. This is a materially different primary purpose and lacks the core declared capabilities. There is no evidence of external integrations, RAG pipelines, financial matching, networking, or investor/program databases.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a broad AI assistant product with founder-facing analysis, recommendation, matching, networking, and integration capabilities. The supplied code chunk does not implement any of those user-facing functions. Instead, it performs a narrow data-ingestion/preprocessing task: reading a specific PDF, extracting program information via tables/regex, and saving JSONL output. While this could support a later funding-matching system, the code itself is only a parser for government announcement data. That is a materially different primary purpose from the declared startup companion functionality, so this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The description presents a broad end-user startup assistant with multiple specialized product capabilities and integrations. The supplied code chunk only provides a backend retrieval/indexing component for document search: chunking JSONL records, embedding them, hybrid BM25/vector search, optional LLM reranking, and evaluation. While this could support part of a larger RAG-based assistant related to government programs and startup information, it does not itself implement most of the specifically claimed functions. The primary purpose of the code is narrower and infrastructural than the declared description, so the description materially overstates what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description claims a domain-specific startup-assistant product with funding-program matching, startup/investor discovery, Kakao integration, and advanced RAG/extraction features. The supplied code does not implement any of those product behaviors. Instead, it is an infrastructure/helper library for generic LLM chat and embedding operations, with provider auto-detection and a small CLI test harness. This is a materially different primary purpose. Additionally, the code accesses external AI provider APIs and local Ollama, which are not reflected in the declared purpose. Therefore the description does not accurately represent the code chunk.
- Content