T09 · Insecure Skill Coding Practices
Error
- Location
scripts/query_company_information.py:35- Finding
API Key Transmitted over Plaintext HTTP and Repeated in the Request URL
- Content
View full analysis
- Remediation
View remediation
Security audit
CompanyInformation
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent company-news lookup tool, but it handles API credentials unsafely and sends them over unencrypted HTTP.
Review before installing. Do not paste API keys into chat or let the agent read full `.env` files. Prefer a scoped environment variable or secure secret store, avoid `--api-key` command-line usage, and do not use this version unless FEEDAX access can be made HTTPS-only. Treat exported CSV/Markdown reports as retained local records of your queries and results.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:24- Finding
Unsafe Secret Inspection and Solicitation of API-Key Retention
- Content
View full analysis
**GE1003**: API Key is not configured. Go to https://www.feedax.cn to apply for one, then tell me the API Key so I can remember it Add the following to the `.env` file: ```env FEEDAX_API_KEY=your_api_key_here ``` ``` The execution flow repeats the behavior: ```bash cat .env | grep FEEDAX_API_KEY ``` ```text If the result is empty or the file does not exist, ask the user to tell the Agent the API Key so it can remember it. ``` ### Technical Analysis The command `cat .env` prints the entire environment file rather than checking only whether a required variable is configured. Environment files often contain multiple unrelated credentials, database passwords, access tokens, and service configuration values. Printing the file can place all of those values into terminal logs or the Agent’s conversational context. The instruction asking the user to provide an API key so the Agent can “remember” it does not define an approved secret store, retention period, access policy, or deletion mechanism. This encourages disclosure of a credential through a conversational channel that may be logged or retained. The exposure is unnecessary. The executable script reads `FEEDAX_API_KEY` from the process environment or `scripts/config.json`; it does not parse the root `.env` file itself. ### Attack Path 1. The Agent follows the Skill instruction and executes `cat .env`. 2. Every secret in the file is emitted into the command output and Agent context. 3. The output may be retained in conversation records, execution logs, observability systems, or debugging record ...[truncated 704 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/query_company_information.py:431- Finding
Command-Line API-Key Option Exposes Credentials through Process Metadata and Shell History
- Content
View full analysis
environment variable > configuration file) if args.api_key: api_key = args.api_key elif os.environ.get('FEEDAX_API_KEY'): api_key = os.environ.get('FEEDAX_API_KEY') ``` The documentation recommends invocations such as: ```bash python scripts/query_company_information.py \ --api-key "your-api-key" \ --company "Example Company" ``` ### Technical Analysis Command-line arguments are not an appropriate channel for long-lived credentials. Depending on the operating system and execution environment, arguments may be exposed through process listings, process-inspection interfaces, job runners, monitoring agents, support diagnostics, shell history, and CI/CD logs. The implementation gives command-line input the highest priority, and the accompanying documentation describes it as the recommended configuration method. Although using an API key is necessary for the declared API operation, exposing it in process metadata is not necessary. ### Attack Path 1. A user launches the script with `--api-key`. 2. The shell records the complete command in history, or the operating system exposes it through process metadata while the request is running. 3. A local user, monitoring service, CI log reader, or attacker with access to diagnostic records retrieves the command. 4. The attacker extracts the API key and reuses it against FEEDAX. ### Impact Assessment The attacker gains the API permissions associated with the exposed FEEDAX key. This can allow unauthorized queries and quota or balance consumption. The issue does not independen ...[truncated 150 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/query_company_information.py:157- Finding
Spreadsheet Formula Injection in Generated CSV Reports
- Content
View full analysis
.csv`. 4. A user opens the CSV in spreadsheet software. 5. The spreadsheet interprets the cell as a formula. 6. Depending on the spreadsheet and its security configuration, the formula may trigger an external request, disclose data, mislead the user, or abu ...[truncated 455 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
README.md:59- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs reading the .env file, which is a common repository of secrets. Direct local credential access is dangerous because it can expose unrelated secrets and violates least-privilege for a company-news monitoring function.
- Content
查看
.env文件是否存在且包含有效的 API Key：bash cat .env如果未配置
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
These instructions tell the agent to obtain API keys from local secret stores and, if missing, ask the user to disclose the key 'so I can remember it.' That creates a direct credential-handling risk by encouraging secrets to be read from disk and copied into the conversation or model memory, which is unnecessary and unsafe for a news-query skill.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instruction to have the user provide an API key 'so I can remember it' is improper credential collection guidance. It encourages users to disclose secrets in natural-language chat and implies persistent storage by the assistant, which can lead to credential theft or misuse.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The workflow prescribes 'cat .env | grep FEEDAX_API_KEY' as an operational step, explicitly directing secret discovery from local files. This is a clear credential-access pattern and is unjustified by the skill's stated purpose, making secret leakage more likely.
- Content
Step 1: 检查 API Key 配置
bash cat .env | grep FEEDAX_API_KEY- 如果返回空或文件不存在，提示用户："未配置 API Key，请前往 https://www.feedax.cn 申请，完成后请告诉我 API Key 以便我记住"
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script hardcodes an HTTP base URL and sends the API key in both the query string and headers to that endpoint. Because HTTP is unencrypted, any on-path observer can capture the credential and the queried company/intelligence data, enabling credential theft, replay, and surveillance of user activity.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documentation forces a single language presentation and does not indicate that Chinese is optional, user-selected, or required for a justified region-specific use case. This matches the language/locale policy violation criterion for natural-language policy issues.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill uses capabilities that imply access to environment secrets, local files, file output, and network requests, but it declares no explicit tool scope or permission boundaries. That mismatch increases the chance an agent will perform sensitive actions implicitly, such as reading credentials or writing persistent files, without clear authorization.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest description, triggers, and operational instructions are all presented in Chinese, which effectively imposes a language constraint on users. Under the stated policy, locale or language restrictions should either be optional for the user or clearly justified as region-specific.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill makes shell-based local inspection a normal operating step by directing the agent to run commands like 'cat .env'. This is broader than needed for company-news lookup and expands the attack surface to local system and secret exposure.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Requesting the user's API key and saying the assistant should 'remember' it normalizes unsafe credential handling. In the context of an agent skill, this is especially risky because secrets can be logged, retained, or reused outside the user's expectations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill mandates automatic creation of local CSV and Markdown files containing all returned data, even when the user only asked for conversational lookup. Unnecessary persistence increases data exposure risk and can leave sensitive or regulated content on disk without user intent or retention controls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Automatically saving all returned data to local files without clear up-front warning or consent is a privacy and data-handling issue. Even if the content is mostly public news, the generated files may contain query history, derived analysis, and persistent records the user did not expect.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow repeats the request that the user provide the API key for the assistant to remember, reinforcing unsafe secret-sharing behavior. Repetition in the execution flow makes accidental credential disclosure more likely during normal use.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language interface, usage text, help content, and user-facing messages are written in Chinese only, which effectively imposes a specific language on users. There is no opt-in, alternative locale, or justification that this tool is intentionally restricted to a Chinese-language environment.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
External transmission is expected for an API client, so the mere use of requests.post is not inherently vulnerable. However, in this skill context it becomes security-relevant because the POST sends potentially sensitive company-monitoring queries and API credentials to an external host, and the configured transport is plain HTTP, increasing exposure risk.
- Content
python } try: response = requests.post(url, params=params, headers=headers, json=payload, timeout=60) response.raise_for_status() return response.json() except requests.exceptions.RequestException as e:
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file explains that the skill generates CSV and Markdown output files and lists fields including news正文、摘要、URL等, but it does not provide a clear user-facing warning about local data persistence or sensitivity considerations. Under SQP-2 for markdown files, behaviours affecting user data or system state should be disclosed clearly.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Section 7.1 explicitly requires 11 core fields in the dialogue output, including event tags, while the later execution flow says the dialogue should show '10 个必须展示字段'. This is an active contradiction in the skill's own instructions about intended output behavior.
- Content
Static analysis
No suspicious patterns detected.