T09 · Insecure Skill Coding Practices
Error
- Location
main.py:27- Finding
User-Controlled Session ID Enables Credential Path Traversal
- Content
View full analysis
- Remediation
View remediation
Security audit
rcs-message
Security checks for vulnerabilities and agentic risk
Overview
This RCS/SMS skill is mostly aligned with sending messages, but it needs review because it can mass-send external messages while storing API secrets locally with weak disclosure and controls.
Install only if you are comfortable giving this skill authority to send real SMS/RCS messages through the configured provider. Review recipients and content carefully before use, avoid bulk sends unless intentional, do not use shared credentials, and remove or harden local plaintext credential storage before using it in a sensitive environment.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
main.py:47- Finding
Reusable API Secrets Are Automatically Persisted in Plaintext
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
send.py:29- Finding
Predictable Shared Temporary File Enables Rate-Limit Manipulation and Unsafe File Overwrite
- Content
View full analysis
float: """Get the last send time.""" try: with open(RATE_LIMIT_FILE, 'r') as f: return float(f.read().strip()) except (FileNotFoundError, ValueError): return 0 def update_last_send_time(): """Update the last send time.""" with open(RATE_LIMIT_FILE, 'w') as f: f.write(str(time.time())) ``` ```python # Update the send timestamp update_last_send_time() ``` ### Technical Analysis The Skill stores rate-limit state in a fixed, globally predictable path under `/tmp`. The normal `open(..., 'w')` operation follows symbolic links and truncates the destination. The implementation does not verify ownership, reject symlinks, use no-follow flags, or isolate state per user. On systems without effective protected-symlink controls, another local user may pre-create the predictable path as a symbolic link. A same-user process can generally perform the same manipulation. The shared file also allows local actors to replace its contents and influence rate-limit decisions. The rate limit itself is not authoritative because it is neither locked nor protected against concurrent or external modification. ### Attack Path 1. A local attacker predicts the path `/tmp/5g_messaging_last_send.txt`. 2. The attacker creates that path as a symbolic link to another file writable by the victim process, or directly writes a manipulated timestamp into it. 3. The victim successfully sends a message. 4. `update_last_send_time()` opens the predictable path with write-and-truncate behavior. 5. Where symlink following is permitted, the linked target is truncated and replaced with a timestamp. 6. Alternatively, a future timestamp can caus ...[truncated 733 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (30)
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
| Rate Limit Error | Wait 60 seconds before retry. Adjust MIN_INTERVAL_SECONDS in config. | | Format Error | Use international format (+8613700000001) or domestic format (13700000001). |
Enable debug mode for detailed output:
bash python3 send.py -n "+8613700000001" -m "Test" --debug
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
| Rate Limit Error | Wait 60 seconds before retry. Adjust MIN_INTERVAL_SECONDS in config. | | Format Error | Use international format (+8613700000001) or domestic format (13700000001). |
Enable debug mode for detailed output:
bash python3 send.py -n "+8613700000001" -m "Test" --debug
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the code persists credentials or accesses user config directories while presenting itself as a messaging workflow, it creates a hidden secret-management surface that is not obvious from the description. In agent ecosystems, this kind of undisclosed filesystem and secret handling increases the risk of credential leakage, unsafe storage, and over-privileged execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the code persists credentials or accesses user config directories while presenting itself as a messaging workflow, it creates a hidden secret-management surface that is not obvious from the description. In agent ecosystems, this kind of undisclosed filesystem and secret handling increases the risk of credential leakage, unsafe storage, and over-privileged execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the code persists credentials or accesses user config directories while presenting itself as a messaging workflow, it creates a hidden secret-management surface that is not obvious from the description. In agent ecosystems, this kind of undisclosed filesystem and secret handling increases the risk of credential leakage, unsafe storage, and over-privileged execution.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python session_dir = Path.home() / ".5g_messaging" session_dir.mkdir(exist_ok=True) cred_file = session_dir / "credentials.json" if cred_file.exists(): print("✅ 会话凭证已配置")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python session_dir = Path.home() / ".5g_messaging" session_dir.mkdir(exist_ok=True) cred_file = session_dir / "credentials.json" if cred_file.exists(): print("✅ 会话凭证已配置")
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill handles APP_ID and APP_SECRET as sensitive values and persists them without any explicit warning, consent, or protective controls visible in this module. In the context of a telecom messaging skill, compromise of these credentials could permit unauthorized message sending, abuse of carrier-backed messaging features, billing impact, or access to downstream APIs.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The invocation text is overly broad: phrases like 'send a text message', 'check text messages', 'use SMS', and especially 'needs to forward or mass send received text messages' can match ordinary user conversations and cause the skill to activate in sensitive messaging contexts. Because this skill can send or forward messages to external phone numbers, ambiguous triggering increases the risk of unintended message transmission, privacy violations, and abuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README advertises mass sending and forwarding but does not prominently warn that these actions can disclose user data to external recipients, incur carrier/API costs, or propagate sensitive message contents. In a messaging skill, lack of a user-facing warning materially increases the chance of accidental privacy-impacting actions, especially when combined with natural language triggering.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill advertises capabilities that imply access to environment variables, filesystem, and network, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, missing scope declarations can allow the skill to be invoked with broader-than-expected access, making credential reads, local file access, or outbound requests less transparent to reviewers and users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill promotes sending and mass forwarding of messages without clearly warning that transmission may be irreversible, may expose personal data, and may impact third-party recipients. In a messaging context, absent consent and privacy warnings are especially risky because a mistaken send can immediately leak sensitive information to real phone numbers at scale.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation text is broad enough to match many ordinary messaging-related requests, which can cause the skill to trigger outside the user's intended scope. Because this skill can send or forward messages, overbroad activation increases the chance of accidental transmission, privacy violations, or unexpected use of credentials and external APIs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The examples instruct users to export application credentials and enable a debug mode that reveals detailed request information, but they provide no warning about secret leakage in shell history, logs, screenshots, or console output. In a messaging skill that handles authentication and potentially recipient/message data, debug output can expose sensitive tokens, phone numbers, and message contents, increasing the risk of credential compromise or privacy violations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file’s title, docstrings, and user-facing output are presented in Chinese only, which imposes a specific language on users without indicating any option to select another language. This matches the policy concern for language or locale constraints that are not user-selectable or explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file’s natural-language descriptions and parsing logic are entirely Chinese-specific, including the title, comments, trigger keywords, and a hardcoded China phone-number format. There is no indication that the user can choose another language/locale or that this restriction is explicitly documented as a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The docstring and user-facing examples indicate the skill processes natural-language input in Chinese and presents prompts entirely in Chinese, with no opt-in or alternative locale mentioned. This can be a natural-language policy issue when a skill effectively forces a specific language without giving the user a choice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code persists APP ID and APP SECRET to a predictable local file under the user's home directory without explicit consent, secure file permissions, encryption, or lifecycle controls. On multi-user systems, shared environments, backups, or compromised local accounts, these API credentials could be recovered and abused to send messages or access the provider account.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s user-facing description and prompts are written entirely in Chinese, including the module docstring and later CLI messages, with no indication that another language is supported. This creates a language/locale policy issue when users are not given an explicit opt-in or alternative language choice.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python } try: response = requests.post(url, json=payload, headers=headers, timeout=30) response.raise_for_status() # 更新发送时间戳
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This module persists APP_ID and APP_SECRET to local disk in plaintext under the user's home directory, creating a recoverable secret store that can be accessed by other local processes, backups, or users depending on filesystem permissions. For a messaging skill, retaining long-lived API credentials is sensitive and expands the blast radius of host compromise or accidental disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code writes and deletes credential files silently, with no user-facing disclosure or consent mechanism, so users may not realize sensitive API credentials are being retained locally. This undermines informed consent and can leave secrets resident on disk longer than expected, increasing exposure during endpoint compromise or troubleshooting.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python "app_id": app_id, "app_secret": app_secret, "session_id": session_id, "saved_at": __import__('time').time() } with open(cred_file, 'w') as f:
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The description frames the skill as 'the upgraded 5G intelligent SMS' with carrier real-name security, and examples throughout use China-specific numbers (+86 / 137...). This suggests a locale-specific messaging workflow, but the documentation does not clearly state that the skill is restricted to a specific region or offer any language/locale opt-in or choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file title, headings, and usage instructions are entirely in Chinese, which effectively forces a specific language for users without any opt-in or alternative locale guidance. Under the stated policy, a language-specific constraint should either be optional for users or clearly documented as a justified region-specific limitation.
- Content