China Insurance Advisor

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 3.0.0

Overview

This skill is a disclosed thin proxy to a third-party Chinese insurance chat service, with privacy and session-storage cautions but no artifact-backed malicious behavior.

Install only if you are comfortable sending insurance questions to whylingxi.cn. Avoid including unnecessary identifiers, policy numbers, payment details, medical documents, or other sensitive personal data, and use reset or avoid session mode when you do not need conversation continuity.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: query_insurance_agent.py:27

Finding

Transmission of Potentially Sensitive Insurance Data Without an Explicit Consent or Redaction Boundary

Content

View full analysis

Vulnerability Details

File Location: query_insurance_agent.py, lines 27–38
Vulnerability Type: Sensitive data disclosure across a third-party trust boundary
Risk Level: Medium

Vulnerable Code

python

def call_agent(message, upstream_session_id=None, timeout=40):
    payload = {'message': message}
    if upstream_session_id:
        payload['session_id'] = upstream_session_id
    data = json.dumps(payload).encode('utf-8')
    req = request.Request(
        API_URL,
        data=data,
        headers={'Content-Type': 'application/json'},
        method='POST',
    )
    with request.urlopen(req, timeout=timeout) as resp:

Technical Analysis

The function sends the complete user-supplied message to https://whylingxi.cn/chat. Insurance requests may contain sensitive health, medical, financial, age, family, or identity information. The implementation performs no data minimization, identifier redaction, sensitive-content warning, or explicit first-use confirmation before transmitting the message.

Network transmission is necessary for the declared thin-proxy functionality and is documented in SKILL.md. The behavior is therefore not covert exfiltration. However, it crosses a third-party trust boundary without a technical consent or minimization control. TLS protects the data in transit but does not limit collection, retention, secondary processing, or access by the remote service.

Attack Path

1. A user submits an insurance question containing detailed medical, financial, family, or identifying information.
2. The Skill passes the complete message to call_agent.
3. The function serializes the message without filtering or redaction.
4. The complete content is transmitted to the third-party endpoint.
5. The remote service can process or retain that content, including as part of server-side conversation history associated with a session identifier.

This path does not grant ...[truncated 550 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit informed consent before the first message is sent to the remote service.
• Clearly identify whylingxi.cn as a third-party destination and explain that the complete message will leave the local environment.
• Warn users not to submit names, government identifiers, policy numbers, medical documents, payment information, or other unnecessary identifiers.
• Apply data minimization and redact common sensitive identifiers before transmission where doing so does not impair the requested service.
• Offer a preview or confirmation step showing the exact text that will be transmitted.
• Document the remote provider's retention, deletion, and privacy policies.
• Provide a mode that disables multi-turn server-side history when continuity is unnecessary.

T09 · Insecure Skill Coding Practices

Warning

• Location: query_insurance_agent.py:22

Finding

Session Identifiers Stored Without Enforced Restrictive File Permissions

Content

View full analysis

Vulnerability Details

File Location: query_insurance_agent.py, lines 22–24; session mapping is populated at lines 69–71
Vulnerability Type: Insecure storage of conversation-linked session identifiers
Risk Level: Medium

Vulnerable Code

python

def save_session_map(path, mapping):
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text(json.dumps(mapping, ensure_ascii=False, indent=2), encoding='utf-8')

The stored mapping is populated using the upstream session identifier:

python

if args.session_id and result.get('session_id'):
    session_map[args.session_id] = result['session_id']
    save_session_map(map_file, session_map)

Technical Analysis

The session map is created using process-default permissions. The implementation does not explicitly require mode 0600 for the file or mode 0700 for its parent directory. Effective access therefore depends on the runtime environment, existing directory permissions, and process umask.

The stored values associate local conversation names with upstream session identifiers. Because the remote service uses a session identifier to retrieve prior conversation context, these values are security-sensitive. If the upstream service treats possession of a session identifier as sufficient authorization, disclosure could permit conversation-context access or session interference.

The file is also written directly rather than through secure atomic replacement. No checks reject symbolic links or unexpected non-regular files, increasing risk in environments where another local principal can influence the configured session directory.

Attack Path

1. A user invokes the Skill with --session-id.
2. The remote service returns an upstream session identifier.
3. The script stores the local-to-upstream mapping in session_map.json.
4. On a shared or permissively configured system, another local principal reads the file or manipu ...[truncated 998 chars]

Remediation

View remediation

Remediation Suggestions

• Create the session directory with mode 0700.
• Create and retain session_map.json with mode 0600, independent of the process umask.
• Write updates to a securely created temporary file and atomically replace the destination.
• Reject symbolic links and verify that the destination is a regular file owned by the expected user.
• Validate CHINA_INSURANCE_ADVISOR_SESSION_DIR before using an environment-provided path.
• Add file locking to prevent concurrent updates from corrupting or unexpectedly replacing mappings.
• Encrypt session identifiers at rest where the execution environment provides an appropriate key store.
• Document retention and deletion behavior, and ensure --reset-session removes obsolete mappings rather than merely omitting them from the current in-memory load.
• Prefer upstream session identifiers that are high-entropy, short-lived, revocable, and independently authorized by the remote service.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

Use `--reset-session` to start a fresh upstream conversation.

## Output rules

- Prefer direct passthrough
- Do not summarize unless the user asks

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · query_insurance_agent.py (reported line 53)May include surrounding context.

python

body)
    session_id = parsed.get('session_id') or upstream_session_id
    content = parsed.get('reply') or parsed.get('message') or parsed.get('content')
    if not content:
        raise ValueError('Empty reply returned from insurance agent')
    return {
        'session_id': session_id,
        'content': content,
        'raw': parsed,
    }


def main():
    parser = argparse.ArgumentParser(description='Proxy to remote insurance advisor web chat')
    parser.add_argument('--message', required=True, help='User request to send to insurance agent')
    parser.add_argument('--timeout', type=int, default=40, help='HTTP timeout in seconds')
    parser.add_argument('--session-id', help='Local conversation session id for multi-turn continuity')
    parser.add_argument('--reset-session', action='store_true', help='Reset stored upstream session mapping for the given local session id before sending')
    parser.add_argument('--print-history-path', action='store_true', help='Print the local

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill is explicitly a thin proxy to a remote web service and references executable scripts, yet it declares no allowed-tools or permission boundaries. That means network, file, and environment access are effectively implicit rather than constrained, which increases the attack surface and makes review, sandboxing, and policy enforcement harder.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill is hard-wired to a Chinese-language remote advisor without documenting user language preference, consent, or fallback behavior. This can lead to accidental disclosure to an unexpected foreign-language service, misunderstanding of financial/insurance advice, and reduced user ability to validate what is being sent or returned.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill forwards user insurance questions to a third-party remote service without an explicit user-facing privacy warning or consent flow. Insurance discussions commonly contain sensitive personal, health, financial, and family information, so silent transmission to an external party can cause serious privacy and compliance risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The notes explicitly describe forwarding user messages to a third-party remote chat service and persisting session linkage, but they do not specify any user-facing disclosure, consent, or data-handling constraints. In a skill that appears conversational and local from the user's perspective, this can cause unintentional exfiltration of potentially sensitive insurance, financial, and health-related information to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code sends arbitrary user messages directly to a third-party endpoint at whylingxi.cn and returns the response with minimal transformation, but provides no consent flow, warning, or data minimization. In a chat skill context, users may unknowingly disclose sensitive financial, health, or personal insurance information, creating privacy, compliance, and confidentiality risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The only user-facing message examples are in Chinese, which suggests the skill may be constrained to a specific language or locale. Because the notes do not say the skill is China-specific by design or that users may choose another language, this can be read as a language policy violation.

Content

No source excerpt is available for this finding.