Security audit

Wenqisheng Ear Care

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it directs automatic installation and daily updating of mutable remote code, while also containing unrelated bot-server behavior and unsafe symptom guidance.

Do not install this as-is in an agent or public bot environment. Only consider it after removing auto-install/auto-update persistence, replacing pipe-to-shell installation with a pinned and verified release, deleting or separating the unrelated development-bot roles, adding real webhook authentication and rate limits, and changing urgent symptom guidance to direct users to qualified medical care first.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (7)

T03 · Remote Payload Retrieval and Execution

Error

Location: README_EN.md:16
Finding: Mutable Remote Scripts Are Executed Directly During Installation
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: install.sh:47
Finding: Installers Establish an Unattended Persistent Update and Code-Execution Channel
Content: View full analysis
/dev/null | grep -q "auto_update.sh"; then (crontab -l 2>/dev/null; echo "7 3 * * * $UPDATE_CMD") | crontab - echo "Automatic update configured" fi ``` ```powershell $TaskName = "WenqishengSkillUpdate" $Existing = Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue if (-not $Existing) { $Action = New-ScheduledTaskAction -Execute "bash" -Argument "scripts/auto_update.sh" -WorkingDirectory $SkillPath $Trigger = New-ScheduledTaskTrigger -Daily -At 03:07 Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Description "Wenqisheng Skill automatic update" | Out-Null } ``` The updater subsequently performs: ```bash git fetch origin --quiet 2>&1 | tee -a "$LOG_FILE" LOCAL=$(git rev-parse HEAD) REMOTE_HASH=$(git rev-parse origin/master 2>/dev/null || git rev-parse origin/main 2>/dev/null) git pull --ff-only origin master 2>&1 | tee -a "$LOG_FILE" || \ git pull --ff-only origin main 2>&1 | tee -a "$LOG_FILE" if [ -f "scripts/test_skill.py" ]; then python3 scripts/test_skill.py 2>&1 | tee -a "$LOG_FILE" || true fi ``` ### Technical Analysis Installation automatically creates a cross-session cron entry or Windows scheduled task that runs every day. This persistence is not necessary for the Skill's core function of answering questions from local reference files. The updater trusts whichever Git remote is configured, pulls an unpinned branch, and then executes `scripts/test_skill.py` from the newly fetched revision. The current test script is a benign validation script, but its contents can change after installation. Consequently, ...[truncated 1312 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: README_EN.md:27
Finding: Documentation Encourages Persistent Agent Auto-Installation Rules
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: bot-server/main.py:52
Finding: Public AI and Webhook Endpoints Lack Effective Authentication
Content: View full analysis
bool: timestamp = request.headers.get("X-Lark-Request-Timestamp", "") nonce = request.headers.get("X-Lark-Request-Nonce", "") signature = request.headers.get("X-Lark-Signature", "") app_secret = _get_credentials(role)["app_secret"] if not app_secret: return True body = await request.body() body_str = body.decode("utf-8") sign_str = f"{timestamp}{nonce}{app_secret}{body_str}" return signature == hashlib.sha256(sign_str.encode()).hexdigest() ``` DingTalk's verifier is an unconditional stub: ```python async def verify_dingtalk_signature(request: Request) -> bool: """DingTalk signature verification, simplified.""" # Full implementation requires appSecret and timestamp return True ``` WeCom omits signature validation and decryption: ```python def _decrypt_wecom(encrypted: str) -> str: return encrypted # placeholder if not token or not encoding_aes_key: return int(echostr) if echostr.isdigit() else echostr ``` ### Technical Analysis The server binds to `0.0.0.0` by default and exposes routes that invoke paid AI-provider APIs. `/test` ...[truncated 1618 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: bot-server/ai_client.py:137
Finding: Undeclared Software-Development Agent Roles Override the Skill's Customer-Service Purpose
Content: View full analysis
Remediation: View remediation

other

Error

Location: SKILL.md:103
Finding: Emergency Ear Symptoms Are Inappropriately Redirected to Retail Technicians Before Medical Care
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: bot-server/platforms/wecom.py:79
Finding: AI Output Is Inserted into XML Unsafely and Internal Exceptions Are Returned to Callers
Content: View full analysis

{int(import('time').time())} """

return xml_response

text
Several routes expose raw exception strings: ```python try: return await handle_feishu(request) except Exception as e: return {"code": -1, "msg": str(e)}

python
try: return await handle_dingtalk(request) except Exception as e: return {"msgtype": "text", "text": {"content": f"系统异常: {e}"}}

Technical Analysis

The WeCom response is assembled through string interpolation. CDATA does not safely contain the sequence ]]>. Because reply is model-generated from attacker-influenced input and from_user is taken from an unauthenticated request, either value may terminate its CDATA section and alter or invalidate the surrounding XML.

Separately, raw exception strings are returned to remote clients. Provider errors, parser failures, file paths, dependency details, or configuration-related messages may therefore be disclosed. Such information can help attackers profile the deployment and refine subsequent attacks.

Attack Path

An attacker submits crafted text designed to induce a model response containing ]]> or places that sequence in a forged sender field.

The server interpolates the value into the XML response without serialization or validation.

The CDATA block terminates early, producing malformed or attacker-influenced XML.

Alternatively, the attacker submits malformed requests that trigger exceptions.

The route returns str(e), disclosing internal error details.

...[truncated 298 chars]
Remediation: View remediation
` terminator.

Return the correct XML media type and validate generated responses against the platform protocol.

Log detailed exceptions only on the server.

Return fixed, generic client-facing errors with correlation IDs.

Ensure logs redact API keys, tokens, message contents, and other sensitive information. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (104)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The installation instructions tell users to pipe remote shell and PowerShell scripts directly into interpreters without any warning about the security consequences. Omitting warnings and verification guidance increases the likelihood that users execute unreviewed code, enabling arbitrary code execution if the source is tampered with.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The README explicitly instructs users or agents to fetch and immediately execute remote shell/PowerShell installer code, then enable automatic updates. This creates a direct remote code execution and supply-chain risk: compromise of the repository, account, branch, or transport target would execute arbitrary code on customer systems without meaningful review.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The use of a pipe into bash chains network retrieval directly into command execution, eliminating any inspection boundary. Combined with the documented auto-install behavior, this creates a high-likelihood remote code execution path that could be abused through repository compromise, malicious updates, or prompt-induced triggering in agent environments.
Content: Scanner excerpt · README.md (reported line 18)May include surrounding context.
Agent 会自动执行：

bash
curl -sSL https://raw.githubusercontent.com/Liubuq-sys/wenqisheng-ear-care-skill/main/install.sh | bash

Windows 用户：

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger terms include generic everyday phrases such as '采耳' and '耳部护理', and the documented behavior is to auto-install on mention. Broad triggers increase accidental activation and can be abused by untrusted users in ordinary conversation to cause the agent to fetch code, update repositories, or change local state without clear intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README documents background auto-install and git-based auto-update behavior triggered from conversation keywords, but does not warn that this may execute commands and modify the host system. Silent command execution in response to user text is especially dangerous in an agent environment because untrusted prompts can induce state changes and code retrieval.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README normalizes unattended execution of downloaded scripts and states that auto-update is configured without clearly warning users that arbitrary code from the remote repository may later run or change. Users are not informed of the trust boundary, persistence, or the security implications of ongoing background updates.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The pipe to bash is a classic command-chaining pattern that turns network data directly into executable shell input, bypassing inspection and increasing exploitability. In this skill's context, the danger is amplified because the README encourages customer-side execution for a low-trust, non-essential business service rather than a tightly controlled administrative workflow.
Content: Scanner excerpt · README_EN.md (reported line 16)May include surrounding context.
Or runs directly:

bash
curl -sSL https://raw.githubusercontent.com/Liubuq-sys/wenqisheng-ear-care-skill/main/install.sh | bash

Windows:

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The auto-discovery instructions direct the agent to install the skill and update it automatically whenever matching keywords appear, without any user warning or approval for code execution. This is especially dangerous in a customer-service skill context because the trigger terms are common and the install path fetches remote shell code, combining prompt-triggering with unattended code execution.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes generic terms such as 'ear cleaning' and 'ear care', so ordinary conversation can invoke installation logic even when the user did not intend to install software. In an agent environment, overly broad auto-trigger phrases increase the risk of prompt-triggered capability activation and make the attack surface much wider.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says this skill is a store-specific intelligent customer-service assistant for a visible ear-cleaning shop, focused on answering business and service questions in a beauty/ear-care context. However, the supplied code does not contain any store knowledge, business rules, address/hours data, structured query logic, trigger handling for the named shop, or domain-specific ear/eye care FAQ behavior. Instead, it is infrastructure code for a general-purpose LLM chat client with support for multiple AI providers and an additional, materially different capability: role prompts for a collaborative software-development bot system (reviewer/frontend/backend). That software-development orchestration purpose is unrelated to the declared customer-service use case. While using an LLM backend could be a supporting implementation detail, the prominent embedded role-prompt system and generic provider-switching/chat-memory framework indicate behavior substantially broader and different from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description says this skill is a store-specific intelligent customer-service skill for answering questions about 闻其声耳轻松可视采耳. However, the provided code chunk primarily implements generic bot server infrastructure: HTTP endpoints, platform routing for Feishu/DingTalk/WeCom, health checks, and a generic /test chat endpoint. Its exposed metadata and comments repeatedly describe the system as '协同开发 Bot Server · 多角色任务编排' with reviewer/frontend/backend roles, which is materially different from a beauty-store customer service skill. While such infrastructure could potentially host the declared skill, this code chunk itself does not demonstrate store-specific knowledge handling, reservation rules, service catalog lookup, or the declared trigger behavior. The primary purpose represented by the code is therefore mismatched with the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description is narrowly scoped to a specific store’s AI customer service use case and specific information categories. The supplied code does not implement store knowledge, structured store information lookup, guided scripts, keyword-based triggering, or any domain restrictions. Instead, it is a general-purpose DingTalk bot transport layer that forwards any incoming message to a generic AI chat backend and stores conversation history. This is a materially different primary behavior from the declared store-specific skill, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a domain-specific smart customer service skill for a beauty/ear-care storefront, focused on answering structured store information and care knowledge. The supplied code does not contain any store data, reservation rules, service catalog, promotional logic, Wi‑Fi information, or ear/eye care knowledge handling. Instead, it is infrastructure code for a Feishu multi-bot system with reviewer, frontend, and backend roles, signature verification, event handling, conversation logging, and outbound messaging. Its primary purpose and triggers are materially different from the declared description, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description is narrowly about a store-specific intelligent customer-service skill for 闻其声耳轻松可视采耳, with defined topics and trigger keywords. The supplied code does not implement store-specific knowledge retrieval, business info lookup, guided scripts, structured query handling, or trigger filtering. Instead, it provides a generic Enterprise WeChat webhook handler that accepts incoming text messages, passes them to a general chat function, stores conversation history, and returns the result. While this infrastructure could be used to host the described skill, the code chunk itself primarily implements a platform integration layer with broader behavior than the declared purpose, so the description does not accurately represent what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个面向终端用户的门店咨询客服能力，但实际代码块仅是部署/安装器，而非客服功能实现本身。其主要行为是访问远程仓库、写入本地目录、并设置自动更新定时任务，这些都是未在声明中体现的能力。虽然安装脚本可能是该 Skill 的配套组件，但就所提供代码块而言，其实际用途与声明的业务功能明显不一致，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是门店咨询型客服能力，但给出的代码块并未实现任何客服问答、门店信息检索、触发词处理或对话逻辑。相反，这段代码的主要功能是对 skill 代码库进行自动更新与版本记录，属于运维/部署辅助脚本。虽然自动更新脚本可能是技能包的配套实现细节，但就该代码块本身而言，其实际行为与所宣称的业务功能明显不一致，并且包含未在描述中体现的代码拉取、日志写入和执行测试等能力。因此应判定为描述与代码行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个门店智能客服技能，应当体现对用户咨询内容的处理、门店信息查询或客服话术逻辑。但实际代码仅执行开发测试辅助任务：定位并读取 test-report.json，然后打印测试报告摘要。这与门店营业信息、预约规则、服务项目、护理知识问答等核心用途完全不一致。代码访问的资源也是本地测试报告，而非任何门店知识库或客服数据，因此属于明显的描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 描述强调的是面向终端用户的门店 AI 客服能力，但代码并未实现任何用户问答、意图触发、信息查询接口或对话逻辑。相反，它是一个开发/质检用途的审计脚本，用于检查技能文档和参考资料是否满足安全、完整性、一致性及更新机制要求。其主要目的与声明的客服场景明显不同，且还访问和校验 Git、工作流、更新脚本等工程资源，属于未声明且不相关的能力，因此应判定为明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this is an end-user intelligent customer-service skill for a store, triggered by store/ear-care queries. The supplied code does not implement customer interactions, structured store information lookup, booking guidance, or ear/eye care Q&A. Instead, it is an internal maintenance/verification script for the skill repository, checking documentation content, reference files, safety text, version metadata, git initialization, and workflow files. This is a materially different primary purpose and includes undeclared capabilities related to project validation and filesystem auditing, so the description does not accurately represent the code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个用户侧智能客服技能，核心能力应是根据用户提问进行信息检索与回答；但提供的代码并未实现问答、意图识别、触发词处理或客服对话逻辑。相反，它是一个后台运维/内容编辑脚本，负责更新 markdown 参考资料、版本信息和备份文件。虽然这些数据可能支撑客服技能运行，但该代码块本身的主要行为与声明的主要用途明显不一致，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger scope includes generic terms like '采耳', '耳部护理', and '眼部护理', which can activate the skill on broad health-related conversations unrelated to the specific store. In a health-adjacent skill that contains problematic triage guidance, over-broad activation increases the chance of inappropriate or unsafe responses outside intended context.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The urgent-symptom guidance lacks a clear instruction to seek immediate medical care first and instead prioritizes coming to the store for visual inspection and cleaning. For potentially serious ear conditions, this could materially delay diagnosis and treatment, worsening injury or hearing outcomes.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · bot-server/README.md (reported line 14)May include surrounding context.
md
pip install -r requirements.txt # 2. 配置 cp .env.example .env # 编辑 .env，填入 ANTHROPIC_API_KEY # 3. 启动

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · bot-server/ai_client.py (reported line 2)May include surrounding context.
python
""" AI 客户端 —— 支持多模型供应商，通过 .env 切换。支持的供应商: - deepseek : DeepSeek API (国内直连，便宜，推荐)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · bot-server/ai_client.py (reported line 9)May include surrounding context.
python
""" AI 客户端 —— 支持多模型供应商，通过 .env 切换。支持的供应商: - deepseek : DeepSeek API (国内直连，便宜，推荐)

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T06 · System Persistence

T02 · Agent Memory Poisoning

T09 · Insecure Skill Coding Practices

T01 · Skill Instruction Hijacking

other

T09 · Insecure Skill Coding Practices

Technical Analysis

Attack Path

SkillSpector

Missing User Warnings

Description-Behavior Mismatch

Chaining Abuse

Vague Triggers

Missing User Warnings

Missing User Warnings

Chaining Abuse

Missing User Warnings

Vague Triggers

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Vague Triggers

Missing User Warnings

Credential Access

Credential Access

Credential Access