China Insurance Advisor

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 3.0.0

Overview

This skill is a disclosed thin proxy to a third-party Chinese insurance chat service, with privacy and session-storage cautions but no artifact-backed malicious behavior.

Install only if you are comfortable sending insurance questions to whylingxi.cn. Avoid including unnecessary identifiers, policy numbers, payment details, medical documents, or other sensitive personal data, and use reset or avoid session mode when you do not need conversation continuity.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: query_insurance_agent.py:27
• Finding: Transmission of Potentially Sensitive Insurance Data Without an Explicit Consent or Redaction Boundary## Vulnerability Details **File Location**: `query_insurance_agent.py`, lines 27–38 **Vulnerability Type**: Sensitive data disclosure across a third-party trust boundary **Risk Level**: Medium ### Vulnerable Code ```python def call_agent(message, upstream_session_id=None, timeout=40): payload = {'message': message} if upstream_session_id: payload['session_id'] = upstream_session_id data = json.dumps(payload).encode('utf-8') req = request.Request( API_URL, data=data, headers={'Content-Type': 'application/json'}, method='POST', ) with request.urlopen(req, timeout=timeout) as resp: ``` ### Technical Analysis The function sends the complete user-supplied message to `https://whylingxi.cn/chat`. Insurance requests may contain sensitive health, medical, financial, age, family, or identity information. The implementation performs no data minimization, identifier redaction, sensitive-content warning, or explicit first-use confirmation before transmitting the message. Network transmission is necessary for the declared thin-proxy functionality and is documented in `SKILL.md`. The behavior is therefore not covert exfiltration. However, it crosses a third-party trust boundary without a technical consent or minimization control. TLS protects the data in transit but does not limit collection, retention, secondary processing, or access by the remote service. ### Attack Path 1. A user submits an insurance question containing detailed medical, financial, family, or identifying information. 2. The Skill passes the complete message to `call_agent`. 3. The function serializes the message without filtering or redaction. 4. The complete content is transmitted to the third-party endpoint. 5. The remote service can process or retain that content, including as part of server-side conversation history associated with a session identifier. This path does not grant ...[truncated 550 chars]
• Remediation: ## Remediation Suggestions - Require explicit informed consent before the first message is sent to the remote service. - Clearly identify `whylingxi.cn` as a third-party destination and explain that the complete message will leave the local environment. - Warn users not to submit names, government identifiers, policy numbers, medical documents, payment information, or other unnecessary identifiers. - Apply data minimization and redact common sensitive identifiers before transmission where doing so does not impair the requested service. - Offer a preview or confirmation step showing the exact text that will be transmitted. - Document the remote provider's retention, deletion, and privacy policies. - Provide a mode that disables multi-turn server-side history when continuity is unnecessary.

T09 · Insecure Skill Coding Practices

Warning

• Location: query_insurance_agent.py:22
• Finding: Session Identifiers Stored Without Enforced Restrictive File Permissions## Vulnerability Details **File Location**: `query_insurance_agent.py`, lines 22–24; session mapping is populated at lines 69–71 **Vulnerability Type**: Insecure storage of conversation-linked session identifiers **Risk Level**: Medium ### Vulnerable Code ```python def save_session_map(path, mapping): path.parent.mkdir(parents=True, exist_ok=True) path.write_text(json.dumps(mapping, ensure_ascii=False, indent=2), encoding='utf-8') ``` The stored mapping is populated using the upstream session identifier: ```python if args.session_id and result.get('session_id'): session_map[args.session_id] = result['session_id'] save_session_map(map_file, session_map) ``` ### Technical Analysis The session map is created using process-default permissions. The implementation does not explicitly require mode `0600` for the file or mode `0700` for its parent directory. Effective access therefore depends on the runtime environment, existing directory permissions, and process umask. The stored values associate local conversation names with upstream session identifiers. Because the remote service uses a session identifier to retrieve prior conversation context, these values are security-sensitive. If the upstream service treats possession of a session identifier as sufficient authorization, disclosure could permit conversation-context access or session interference. The file is also written directly rather than through secure atomic replacement. No checks reject symbolic links or unexpected non-regular files, increasing risk in environments where another local principal can influence the configured session directory. ### Attack Path 1. A user invokes the Skill with `--session-id`. 2. The remote service returns an upstream session identifier. 3. The script stores the local-to-upstream mapping in `session_map.json`. 4. On a shared or permissively configured system, another local principal reads the file or manipu ...[truncated 998 chars]
• Remediation: ## Remediation Suggestions - Create the session directory with mode `0700`. - Create and retain `session_map.json` with mode `0600`, independent of the process umask. - Write updates to a securely created temporary file and atomically replace the destination. - Reject symbolic links and verify that the destination is a regular file owned by the expected user. - Validate `CHINA_INSURANCE_ADVISOR_SESSION_DIR` before using an environment-provided path. - Add file locking to prevent concurrent updates from corrupting or unexpectedly replacing mappings. - Encrypt session identifiers at rest where the execution environment provides an appropriate key store. - Document retention and deletion behavior, and ensure `--reset-session` removes obsolete mappings rather than merely omitting them from the current in-memory load. - Prefer upstream session identifiers that are high-entropy, short-lived, revocable, and independently authorized by the remote service.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

Use `--reset-session` to start a fresh upstream conversation.

## Output rules

- Prefer direct passthrough
- Do not summarize unless the user asks

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

body)
    session_id = parsed.get('session_id') or upstream_session_id
    content = parsed.get('reply') or parsed.get('message') or parsed.get('content')
    if not content:
        raise ValueError('Empty reply returned from insurance agent')
    return {
        'session_id': session_id,
        'content': content,
        'raw': parsed,
    }


def main():
    parser = argparse.ArgumentParser(description='Proxy to remote insurance advisor web chat')
    parser.add_argument('--message', required=True, help='User request to send to insurance agent')
    parser.add_argument('--timeout', type=int, default=40, help='HTTP timeout in seconds')
    parser.add_argument('--session-id', help='Local conversation session id for multi-turn continuity')
    parser.add_argument('--reset-session', action='store_true', help='Reset stored upstream session mapping for the given local session id before sending')
    parser.add_argument('--print-history-path', action='store_true', help='Print the local

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill is explicitly a thin proxy to a remote web service and references executable scripts, yet it declares no allowed-tools or permission boundaries. That means network, file, and environment access are effectively implicit rather than constrained, which increases the attack surface and makes review, sandboxing, and policy enforcement harder.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The skill is hard-wired to a Chinese-language remote advisor without documenting user language preference, consent, or fallback behavior. This can lead to accidental disclosure to an unexpected foreign-language service, misunderstanding of financial/insurance advice, and reduced user ability to validate what is being sent or returned.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill forwards user insurance questions to a third-party remote service without an explicit user-facing privacy warning or consent flow. Insurance discussions commonly contain sensitive personal, health, financial, and family information, so silent transmission to an external party can cause serious privacy and compliance risks.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The notes explicitly describe forwarding user messages to a third-party remote chat service and persisting session linkage, but they do not specify any user-facing disclosure, consent, or data-handling constraints. In a skill that appears conversational and local from the user's perspective, this can cause unintentional exfiltration of potentially sensitive insurance, financial, and health-related information to an external service.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This code sends arbitrary user messages directly to a third-party endpoint at whylingxi.cn and returns the response with minimal transformation, but provides no consent flow, warning, or data minimization. In a chat skill context, users may unknowingly disclose sensitive financial, health, or personal insurance information, creating privacy, compliance, and confidentiality risk.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The only user-facing message examples are in Chinese, which suggests the skill may be constrained to a specific language or locale. Because the notes do not say the skill is China-specific by design or that users may choose another language, this can be read as a language policy violation.

Static analysis

No suspicious patterns detected.