T09 · Insecure Skill Coding Practices
Error
- Location
edge-functions/api/auth/login.js:40- Finding
Plaintext-Compatible Password Verification and Unnecessary Token Exposure
- Content
View full analysis
- Remediation
View remediation
Security audit
建站骨架 (EdgeOne Pages)
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent website-building skill, but its bundled auth, database, payment, and analytics code has security gaps that could put deployed users or transactions at risk.
Treat this as review-required before installing or using for a real site. Do not connect production databases, real payment credentials, or real users until the auth flow, token responses, cookie flags, D1 async handling, payment transaction behavior, and analytics opt-out/feature gating are fixed and tested.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
cloud-functions/utils/db.js:36- Finding
Asynchronous D1 Operations Are Treated as Synchronous, Breaking Validation and Transaction Guarantees
- Content
View full analysis
{ if (!sql.includes('{tenant}')) { throw new Error(`SQL missing {tenant} placeholder: ${sql.substring(0, 80)}`); } const tenantSql = sql.replace(/\{tenant\}/g, '?'); return env.DB.prepare(tenantSql).bind(tenant, ...(params || [])).all(); }, queryOne: (sql, params) => { const results = ctx.query(sql, params); return results[0] || null; }, execute: (sql, params) => { if (!sql.includes('{tenant}')) ...[truncated 4597 chars]- Remediation
View remediation
{ const order = await ctx.queryOne(...); const update = await ctx.execute(...); if (!update.success || update.meta.changes !== 1) { throw new Error('Concurrent update'); } await ctx.execute(...); }); ``` 4. Do not acknowledge a payment callback until the order update and audit write have completed successfully. Check that exactly one pending order was changed. 5. Use database constraints to reinforce application checks, including unique payment transaction identifiers, nonnegative stock constraints, and conditional status updates. 6. Make idempotency acquisition atomic and acquire it before processing. A separate read followed by `put` is vulnerable to concurrent callbacks. 7. Add runtime-level tests using t ...[truncated 500 chars]
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (263)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This variant highlights analytics/event collection and optional external forwarding that are not clearly part of the manifest’s stated purpose. Hidden or insufficiently disclosed telemetry can expose user metadata and browsing behavior, especially dangerous in a skill that may be widely triggered for generic website requests.
- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/migrate.js:168
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- tests/integration/phase4a.test.js:14
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- client/src/pages/login.js:59
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- client/src/pages/register.js:66
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- tests/sharing/validators.test.js:330