T09 · Insecure Skill Coding Practices
Error
- Location
scripts/vehicle-query.sh:113- Finding
Remote API timestamp is evaluated as a Bash arithmetic expression
- Content
View full analysis
- Remediation
View remediation
Security audit
Control your vehicle from AI agent
Security checks for vulnerabilities and agentic risk
Overview
This vehicle lookup skill appears purpose-aligned, but it stores sensitive vehicle tokens and location history locally without enough protection or user control.
Review before installing. Use this only if you trust the publisher and the vehicle API, avoid running it with elevated privileges, and assume the local cache/history files may contain sensitive tokens and precise vehicle locations. On shared or managed machines, do not use it unless storage permissions, deletion controls, and timestamp/input validation are hardened.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/vehicle-query.sh:404- Finding
Predictable shared temporary file enables symlink and race attacks
- Content
View full analysis
"${TMP_DIR}/history_tmp.json" jq -n --slurpfile queries "${TMP_DIR}/history_tmp.json" '{queries: $queries[0]}' > "$HISTORY_FILE" rm -f "${TMP_DIR}/history_tmp.json" ``` On Linux and macOS, the temporary directory is configured as follows: ```bash TMP_DIR="/tmp" ``` ### Technical Analysis Every invocation uses the fixed path `/tmp/history_tmp.json`. Shared temporary directories are normally writable by all local users. The script does not securely create the file, verify its ownership or type, use exclusive creation, or protect the sequence from replacement between operations. The first shell redirection follows symbolic links. A local attacker may pre-create the predictable path as a symbolic link to another file writable by the victim. The subsequent read and deletion also operate on the shared name, allowing another process to replace or alter the file between commands. Concurrent legitimate invocations can likewise overwrite one another's temporary data, causing integrity failures even without a malicious attacker. ### Attack Path 1. A local attacker predicts that the Skill will use `/tmp/history_tmp.json`. 2. Before the victim runs the Skill, the attacker creates that path as a symbolic link to a file writable by the victim, or continuously replaces the path during execution. 3. The victim invokes `vehicle-query.sh`. 4. The redirection on line 404 opens the attacker-selected path and truncates or overwrites its target with JSON data. 5. Alternatively, the attacker replaces the temporary file before line 405, causing attacker-controlled content to be processed or corrupting the generated history. 6. The script removes the shared pathname, but this occurs only after the vulnera ...[truncated 730 chars]- Remediation
View remediation
"$tmp_file" jq -n --slurpfile queries "$tmp_file" \ '{queries: $queries[0]}' > "$HISTORY_FILE" ``` Further hardening should include: 1. Set `umask 077` before creating files containing location information. 2. Keep temporary files in a user-owned runtime directory where available. 3. Write the final history to a secure temporary file in the same directory as the destination, then use `mv` for atomic replacement. 4. Validate that destination files are regular files owned by the invoking user before overwriting them. 5. Add locking if concurrent invocations must be supported. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/vehicle-query.sh:183- Finding
Sensitive credentials and vehicle history are written without enforced restrictive permissions
- Content
View full analysis
"$CACHE_FILE" << EOF { "accessToken": "$accessToken", "vehicleToken": "$vehicleToken", "last_updated": "$(date -Iseconds 2>/dev/null || date '+%Y-%m-%dT%H:%M:%S')" } EOF log_success "认证信息已保存" } ``` Vehicle query history is also written without setting permissions: ```bash local history="[]" if [ -f "$HISTORY_FILE" ]; then history=$(jq '.queries // []' "$HISTORY_FILE" 2>/dev/null || echo "[]") fi local new_record=$(cat << EOF { "timestamp": $timestamp, "type": "$query_type", "address": "$address", "sn": "$(echo "$response" | jq -r '.data.sn // "未知"')" } EOF ) echo "$history" | jq --argjson new "$new_record" '. + [$new] | .[-10:]' > "${TMP_DIR}/history_tmp.json" jq -n --slurpfile queries "${TMP_DIR}/history_tmp.json" '{queries: $queries[0]}' > "$HISTORY_FILE" ``` ### Technical Analysis The code does not set a restrictive `umask`, create files with mode `0600`, verify ownership, or reject symbolic links and non-regular destination files. Actual permissions therefore depend on the caller's environment and any existing destination file. The cache contains an access bearer token and vehicle token. The history contains recent vehicle addresses, query timestamps, and the vehicle serial number. These are security- and privacy-sensitive values. The current `main` function does not call `save_tokens`; it expects the cache to exist already. Therefore, the credential-write exposure is presently latent in the included script, while the insecure history write is active after every successful query. If `save_tokens` is later connected as the documentation suggests, or ...[truncated 1784 chars]- Remediation
View remediation
"$tmp_cache" mv -f -- "$tmp_cache" "$CACHE_FILE" chmod 600 "$CACHE_FILE" ``` Additional controls should include: 1. Store tokens in the operating system's credential manager rather than a plaintext JSON file where practical. 2. Apply mode `0600` to the history file and its temporary files. 3. Verify with `lstat`-equivalent logic that cache and history destinations are regular files owned by the current user and are not symbolic links. 4. Place temporary files in the destination directory and atomically rename them. 5. Minimize stored history, redact precise addresses where they are unnecessary, and provide a documented retention or deletion mechanism. 6. Use `jq --arg` to serialize tokens safely rather than embedding token text directly into JSON. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh echo "$history" | jq --argjson new "$new_record" '. + [$new] | .[-10:]' > "${TMP_DIR}/history_tmp.json" jq -n --slurpfile queries "${TMP_DIR}/history_tmp.json" '{queries: $queries[0]}' > "$HISTORY_FILE" rm -f "${TMP_DIR}/history_tmp.json" } # ==================== 主函数 ====================
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README instructs users to provide authentication material and states that it is automatically cached for later use, but it does not warn that sensitive tokens will be stored locally or describe any protections such as restricted file permissions, encryption, or token expiration. If the host is shared, compromised, or backed up insecurely, cached tokens could be recovered and used to access vehicle location and status data.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux (Ubuntu/Debian)
bash sudo apt-get install curl jqLinux (CentOS/RHEL)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux (Ubuntu/Debian)
bash sudo apt-get install curl jqLinux (CentOS/RHEL)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux (Ubuntu/Debian)
bash sudo apt-get install curl jqLinux (CentOS/RHEL)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documentation instructs the agent or user to execute shell scripts, but the manifest shown in this file does not declare any tool restrictions or allowed shell capability scope. This creates a governance gap: an agent may invoke shell unexpectedly without explicit permission boundaries, making misuse or overbroad execution harder to control or audit.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill tells users that authentication tokens will be automatically cached locally, but it does not warn that these are sensitive credentials or describe the security properties of the cache file. Storing vehicle-related access tokens in a predictable plaintext local file can expose account access and vehicle telemetry to other local users, malware, backups, or logs if file permissions are weak.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | 系统 | 依赖安装 | |------|----------| | Linux (Ubuntu/Debian) | `sudo apt-get install curl jq` | | Linux (CentOS/RHEL) | `sudo yum install curl jq` | | macOS | `brew install curl jq` | | Windows (Git Bash) | 已包含 |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | 系统 | 依赖安装 | |------|----------| | Linux (Ubuntu/Debian) | `sudo apt-get install curl jq` | | Linux (CentOS/RHEL) | `sudo yum install curl jq` | | macOS | `brew install curl jq` | | Windows (Git Bash) | 已包含 |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | 系统 | 依赖安装 | |------|----------| | Linux (Ubuntu/Debian) | `sudo apt-get install curl jq` | | Linux (CentOS/RHEL) | `sudo yum install curl jq` | | macOS | `brew install curl jq` | | Windows (Git Bash) | 已包含 |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh | 系统 | 依赖安装 | |------|----------| | Linux (Ubuntu/Debian) | `sudo apt-get install curl jq` | | Linux (CentOS/RHEL) | `sudo yum install curl jq` | | macOS | `brew install curl jq` | | Windows (Git Bash) | 已包含 |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh | 系统 | 依赖安装 | |------|----------| | Linux (Ubuntu/Debian) | `sudo apt-get install curl jq` | | Linux (CentOS/RHEL) | `sudo yum install curl jq` | | macOS | `brew install curl jq` | | Windows (Git Bash) | 已包含 |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh | 系统 | 依赖安装 | |------|----------| | Linux (Ubuntu/Debian) | `sudo apt-get install curl jq` | | Linux (CentOS/RHEL) | `sudo yum install curl jq` | | macOS | `brew install curl jq` | | Windows (Git Bash) | 已包含 |
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script persists sensitive authentication material (accessToken and vehicleToken) to a local cache file in the user's home directory. For a vehicle lookup skill, storing long-lived tokens expands exposure beyond the immediate query and creates a local secret-at-rest risk if the workstation is shared, backed up, or compromised.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Authentication tokens are cached locally without any warning, consent flow, or protection measures visible in the script. Users may unknowingly leave valid vehicle-access credentials on disk, allowing later misuse by other local users, malware, or forensic recovery.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh local response while [ $retry -lt $MAX_RETRIES ]; do response=$(curl -s -X POST "${API_BASE_URL}/iot/v1/condition" \ -H "Authorization: Bearer ${accessToken}" \ -H "Content-Type: application/json" \ -d "{\"vehicleToken\": \"${vehicleToken}\"}" \
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script writes historical query data including vehicle address and timestamp to a local history file, which creates a location-tracking record over time. In the context of a car-location skill, retaining past addresses materially increases privacy and stalking risk compared with a one-time read-only lookup.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script stores vehicle location history locally without notifying the user that precise address data is being retained. Because the skill's purpose is to reveal where the user's car is, silent retention of historical locations increases the sensitivity of the data and the harm from local compromise.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The README instructions and examples are entirely in Chinese, which can amount to a language policy issue when the skill implicitly forces one language without user opt-in or explanation. There is no indication that the skill is region-specific or that alternative language support is intentionally limited.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
All user-facing comments, prompts, status messages, and output are in Chinese, with no indication that the user can choose another language or locale. This can violate a language/locale policy when a skill is not explicitly documented as region-specific.
- Content