T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/check.sh:12- Finding
Unescaped User Input in Manually Constructed JSON Payload
- Content
View full analysis
- Remediation
View remediation
Security audit
chinese-ad-copywriter
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Chinese ad-copy and compliance-checking helper, but users should understand that its scripts contact a hardcoded external API with ad text.
Install only if you are comfortable sending ad text, titles, keywords, and platform choices to the listed external Tencent Cloud API. Do not use it with confidential client material unless you have reviewed the endpoint and data-handling expectations; the scripts would also benefit from proper JSON/URL encoding before production use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/generate.sh:7- Finding
Unencoded User Input in API Query Parameter
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 ;; esac ``` The script should additionally validate the response schema before displaying template data and report non-successful HTTP responses explicitly. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill advertises executable shell scripts (
check.sh,generate.sh) and an API backend, but it does not declare any tool scope or permissions boundaries. This can cause an agent or user to invoke shell-capable behavior without an explicit trust and consent model, increasing the risk of unintended command execution or hidden external interactions.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list contains broad phrases such as general ad-copy and compliance terms that may cause the skill to activate in contexts beyond the user's intent. Overbroad activation is dangerous here because the skill can lead to external API use and shell-script suggestions, causing unintended data exposure or workflow changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states that it performs real API-backed compliance checks and includes executable scripts, but it does not clearly disclose that user-provided copy may be transmitted to a third-party service or that local shell commands may be run. This creates a meaningful privacy and safety risk because sensitive draft content, campaign data, or client materials could be sent off-platform or processed through command execution without informed consent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
This line performs the actual external transmission of user-supplied content to a hardcoded remote service. In this skill's context, the transmission is core functionality, but it is still security-relevant because the endpoint is external, hardcoded, and receives potentially sensitive business text without trust controls, transparency, or endpoint configurability.
- Content
sh done [[ -z "$TEXT" ]] && echo "❌ 请提供文案内容" && exit 1 PAYLOAD=$(printf '{"text":"%s","platform":"%s","keywords":"%s","title":"%s"}' "$TEXT" "$PLATFORM" "$KEYWORDS" "$TITLE") RESPONSE=$(curl -s -X POST "${API_BASE}/check" -H "Content-Type: application/json" -d "$PAYLOAD" --connect-timeout 10 --max-time 15) TOTAL=$(echo "$RESPONSE" | jq -r '.data.totalIssues // 0') HIGH=$(echo "$RESPONSE" | jq -r '.data.stats["高"] // 0') MID=$(echo "$RESPONSE" | jq -r '.data.stats["中"] // 0')
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script sends user-provided ad copy, title, platform, and keywords to a third-party remote API endpoint, but it gives no explicit notice, consent prompt, or documentation at runtime that the content will leave the local environment. Because marketing copy may contain unpublished campaign content, customer data, or sensitive business information, this creates a real confidentiality and compliance risk rather than a purely informational issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The usage and result strings are presented only in Chinese, which imposes a specific language on all users with no opt-in or alternative. Under the stated policy, forcing a language or locale without user choice is a natural-language policy violation unless clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Usage and status messages are presented in Chinese, and the example input also assumes Chinese content, but the script does not indicate that it is intentionally limited to a Chinese-speaking or China-specific workflow. This can violate language/locale policy where user-facing tools should not force a language without opt-in or justification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script performs an HTTP request to a remote API endpoint to fetch platform templates, but there is no explicit warning or disclosure at the point of execution that user input will be sent to an external service. Although the script prints usage text when no argument is provided, it does not clearly inform users that running it with a platform value triggers network access.
- Content