T08 · Insecure Dependencies
Error
- Location
scripts/account-rotator.js:31- Finding
Unpinned External Dependency Executes with API Credentials and the Full Process Environment
- Content
View full analysis
- Remediation
View remediation
Security audit
Yixiaoer Rotator Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill appears purpose-built for account rotation, but it runs an external dependency with API credentials and the full process environment, which deserves manual review before installation.
Install only if you trust both this skill and the separately installed yixiaoer-skill package. Use a limited shell environment without unrelated secrets, review or pin the dependency where possible, and treat the local state file as account metadata that may need manual cleanup after access changes.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/account-rotator.js:144- Finding
Synchronization Retains Accounts from Platforms No Longer Present in the Authorized API Response
- Content
View full analysis
{ const newAccounts = platformGroups[platform]; const existing = state.platforms[platform] || { accounts: [], currentIndex: 0 }; // 构建现有账号的 ID 映射 const existingIdMap = {}; existing.accounts.forEach((acc, idx) => { existingIdMap[acc.id] = { ...acc, oldIndex: idx }; }); // 构建新账号列表的 ID 映射 const newIdMap = {}; newAccounts.forEach(acc => { newIdMap[acc.id] = acc; }); // 找出新账号（在新列表但不在旧列表） const addedIds = newAccounts.filter(acc => !existingIdMap[acc.id]); newAccountsCount += addedIds.length; // 找出已删除的账号（在旧列表但不在新列表） const removedIds = existing.accounts.filter(acc => !newIdMap[acc.id]); removedAccountsCount += removedIds.length; // 合并账号列表：保留原有顺序，追加新账号 const mergedAccounts = []; // 先保留原有的账号（按旧顺序） existing.accounts.forEach(acc => { if (newIdMap[acc.id]) { // 账号还在，使用最新数据 mergedAccounts.push(newIdMap[acc.id]); } // 账号已删除，跳过 }); // 追加新账号到末尾 addedIds.forEach(acc => { mergedAccounts.push(acc); }); // 调整索引：如果当前索引超出范围，重置到 0 let newIndex = existing.currentIndex; if (mergedAccounts.length === 0) { newIndex = 0; } else if (newIndex >= mergedAccounts.length) { newIndex = 0; } state.platforms[platform] = { accounts: mergedAccounts, totalAccounts: mergedAccounts.length, currentIndex: newIndex, accountCount: mergedAccounts.length }; }); writeState(state); ``` ### Technical Analysis The synchronization loop iterates only over platforms present in the latest `platformGroups` object. It correctly removes individual accounts when a platform remains in the response, but it never examines or deletes an existing `state.platforms` entry when the entire platform is absent from the new authorize ...[truncated 1768 chars]- Remediation
View remediation
{ const existing = state.platforms[platform] || { accounts: [], currentIndex: 0 }; // Reconcile accounts and preserve a valid index. updatedPlatforms[platform] = reconcilePlatform( existing, platformGroups[platform] ); }); state.platforms = updatedPlatforms; writeState(state); ``` Alternatively, explicitly remove platforms absent from the authoritative response: ```js for (const platform of Object.keys(state.platforms)) { if (!Object.prototype.hasOwnProperty.call(platformGroups, platform)) { delete state.platforms[platform]; } } ``` Additional hardening should include: 1. Treat every successful synchronization response as the authoritative set of currently permitted accounts. 2. Fail closed when the response is incomplete or malformed; do not overwrite or silently retain authorization state without clearly distinguishing an API failure from an authoritative empty result. 3. Add tests covering removal of one account, removal of all accounts on a platform, and removal of every platform. 4. Revalidate account authorization immediately before downstream publication rather than relying exclusively on cached state. 5. Record removals in an audit log without retaining unnecessary account metadata. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/account-rotator.js sync
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/account-rotator.js sync
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/account-rotator.js sync
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/account-rotator.js sync
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/account-rotator.js sync
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/account-rotator.js sync
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/account-rotator.js sync
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The natural-language content and usage guidance are presented only in Chinese, which effectively imposes a language requirement on users without opt-in or explanation. The policy specifically calls for flagging skills that force a specific language or locale without user choice or a documented justification.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill instructs users to provide sensitive credentials via environment variables and includes executable command examples, but it declares no explicit tool scope or permissions metadata. In an agent ecosystem, this can cause the skill to access environment-sourced secrets without clear sandboxing or least-privilege constraints, increasing the chance of unintended secret exposure or misuse.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill invokes an external script from a hard-coded path using child_process, which expands trust to code outside this skill and creates a supply-chain boundary. If that external api.ts is modified, replaced, or more privileged than expected, this rotator silently inherits its behavior and can perform unintended actions with the provided API key.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The manifest describes an account rotation manager that maintains per-platform indices and persistent state for publishing rotation. In addition to local rotation logic, the code directly consumes sensitive environment variables for API authentication and member scoping, which is a credential-handling capability not stated in the manifest and not inherent to a pure rotator utility.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill is described as a local account rotation manager, but it also orchestrates live synchronization through another skill's API client. This hidden capability broadens the operational scope and trust model, making review and deployment decisions harder and increasing the chance that users grant broader access than they intended.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file advertises state persistence and integration into a publishing flow, which can affect user data and operational behavior. The description does not include any warning that the skill stores rotation state or may influence which account is used for automated publishing.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation tells users to export an API key and member ID, but it does not warn that these values are sensitive credentials that should be stored securely and not committed or shared. For markdown files, omission of privacy or system-integrity warnings around sensitive data handling is in scope.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest description is entirely in Chinese and presents the skill in a single language without indicating that users may choose another language or locale. This can violate language/locale policy expectations when a skill is distributed broadly without documented opt-in or region-specific justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The file content, headings, and instructions are all presented in Chinese, and there is no indication that the skill is region-specific or that users may choose another language. Under the policy criteria, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The call to toLocaleString('zh-CN') forces Chinese locale formatting in a user-visible status message. Under the policy, locale-specific behavior should either be user-selectable or clearly justified as region-specific; this file does not provide either.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/account-rotator.js:51