T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:20- Finding
Hardcoded Shared API Credential Enables Unauthorized Task Management
- Content
View full analysis
- Remediation
View remediation
Security audit
Hope OpenTask
Security checks for vulnerabilities and agentic risk
Overview
This task-management skill is mostly coherent, but it publishes a shared API key and encourages persistent task polling with mutating task actions, so users should review it carefully before installing.
Install only in an environment where the localhost OpenTask service is trusted and isolated. Rotate the published API key, replace it with a runtime secret, require explicit confirmation for write actions, and do not enable HEARTBEAT polling unless task contents are validated and treated as untrusted data.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:52- Finding
Heartbeat Workflow Executes Tasks from an Insufficiently Trusted Control Channel
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:15- Finding
Authentication Credential and Task Data Are Sent over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
bash # 获取待执行任务 TASKS=$(curl -s -H "X-Bot-Key: hope-bot-apikey-2026-0424" \ "http://127.0.0.1:8090/api/tasks/pending?assigned_to=anna") # 解析任务数量
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md echo "有 $COUNT 条待执行任务" # 开始执行第一条任务 TASK_ID=$(echo "$TASKS" | python3 -c "import sys,json; print(json.load(sys.stdin)[0]['id'])") curl -X PUT -H "X-Bot-Key: ..." "http://127.0.0.1:8090/api/tasks/$TASK_ID/start" else echo "HEARTBEAT_OK" fi
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md echo "有 $COUNT 条待执行任务" # 开始执行第一条任务 TASK_ID=$(echo "$TASKS" | python3 -c "import sys,json; print(json.load(sys.stdin)[0]['id'])") curl -X PUT -H "X-Bot-Key: ..." "http://127.0.0.1:8090/api/tasks/$TASK_ID/start" else echo "HEARTBEAT_OK" fi
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation embeds what appears to be a live API credential (
X-Bot-Key: hope-bot-apikey-2026-0424) and pairs it with a reachable local service endpoint. Any actor with access to this skill content can reuse the key to query or mutate tasks, making this a credential exposure issue rather than harmless example text.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include broad everyday expressions such as '创建任务', '完成任务', and '任务管理', which can cause accidental invocation during normal conversation. Because this skill performs state-changing operations, overbroad activation materially increases the chance of unintended task creation or status changes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill documentation directly discloses a hardcoded API key and also exposes internal infrastructure details, including a private database host and port. Anyone with access to the skill can reuse the credential to query or mutate task data, and the internal topology disclosure lowers the barrier for further lateral movement or targeted attacks.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
获取待执行任务
bash curl -H "X-Bot-Key: hope-bot-apikey-2026-0424" \ "http://127.0.0.1:8090/api/tasks/pending?assigned_to=anna"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documents create/start/complete operations without warning that these actions modify shared system state. In this context, silent state mutation is risky because users or agents may invoke examples as if they were harmless lookups, causing unauthorized or accidental workflow changes.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md echo "有 $COUNT 条待执行任务" # 开始执行第一条任务 TASK_ID=$(echo "$TASKS" | python3 -c "import sys,json; print(json.load(sys.stdin)[0]['id'])") curl -X PUT -H "X-Bot-Key: ..." "http://127.0.0.1:8090/api/tasks/$TASK_ID/start" else echo "HEARTBEAT_OK" fi
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md TASK_ID=$(echo "$TASK" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])") # 2. 开始执行 curl -X PUT -H "X-Bot-Key: ..." "http://127.0.0.1:8090/api/tasks/$TASK_ID/start" # 3. 执行任务逻辑...
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The API examples show authentication secrets directly in plaintext and provide no warning against copying, committing, or sharing them. This increases the chance of credential leakage through logs, screenshots, repositories, shell history, or downstream LLM/tool outputs.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
所有 API 请求需要携带
X-Bot-Key请求头：bash curl -H "X-Bot-Key: hope-bot-apikey-2026-0424" "http://127.0.0.1:8090/api/tasks"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The markdown describes retry and cancel endpoints that change task state, including resetting failed tasks to pending and cancelling pending or running tasks, but it provides no warning about operational impact or irreversibility considerations. Under SQP-2 for markdown files, behaviors that can affect user data or system integrity should be accompanied by explicit warnings so users understand the consequences before invoking them.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file's operational instructions and API descriptions are presented in Chinese throughout, while the document does not offer an alternate language, user opt-in, or a documented region-specific justification. SQP-3 applies to all file types and flags forced language or locale constraints when no choice or rationale is provided.
- Content