T09 · Insecure Skill Coding Practices
Error
- Location
references/add-os-monitor.md:45- Finding
Platform Credentials and Bearer Tokens Exposed Through Plaintext HTTP and Process Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Zhihu Aiops
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate Zhihu AIOps reference skill, but it handles admin/API and SSH credentials in risky ways and can guide state-changing platform actions without strong safeguards.
Install only if you trust the Zhihu AIOps environment and will use least-privilege accounts over HTTPS. Do not paste real platform or SSH passwords into chat or generated scripts, avoid the admin/default examples, require explicit confirmation before create/delete/restart/export actions, and verify how the platform stores any SSH credentials used for monitoring.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (27)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - VictoriaMetrics APIs: `references/api_victoriametrics.md`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Categraf SNMP metrics: `references/api_snmp_metrics.md`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Categraf SNMP metrics: `references/api_snmp_metrics.md`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Add OS monitoring workflow: `references/add-os-monitor.md`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Add OS monitoring workflow: `references/add-os-monitor.md`
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
bash API_URL="${ZHIHU_API_URL:-http://localhost:1024}" TOKEN=$(curl -s -X POST "${API_URL}/admin-api/system/auth/login" \ -H "Content-Type: application/json" \ -d "{ \"username\": \"${ZHIHU_USER:-admin}\",
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
2a. 通过模型列表查询 modelId
bash MODEL_INFO=$(curl -s --connect-timeout 10 -X POST "${API_URL}/admin-api/cqt/asset-model/page" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${TOKEN}" \ -d '{"pageNo":1,"pageSize":50}' | python3 -c "
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
2b. 通过 modelId 获取完整模型信息（含 items）
bash curl -s --connect-timeout 10 -X POST "${API_URL}/admin-api/cqt/asset-model/get" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${TOKEN}" \ -d "{\"id\": ${MODEL_INFO}}" | python3 -c "
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly states that adding OS monitoring requires a target IP, username, and password, but it does not provide any user-facing guidance on secure handling, masking, storage, or transmission of those secrets. In a documentation-first skill that guides API workflows, this omission can lead downstream agents or users to place credentials in prompts, logs, scripts, or insecure HTTP requests, increasing the chance of credential exposure.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill metadata says the release is documentation/reference-only, but the body directs automatic monitor creation after a successful connectivity check. This mismatch can mislead reviewers or operators into granting trust or permissions under the assumption that the skill is non-executing when it actually describes privileged mutations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions rely on environment-provided admin credentials and a bearer token workflow, exposing a privileged authentication path inside a nominal reference document. Embedding default admin usage and encouraging automated login broadens the blast radius if the skill is misused, especially where environment variables are already populated in agent runtimes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill asks the user for an SSH password and later transmits it to a remote API without an explicit warning about sensitive credential handling, storage, or forwarding. Users may reasonably believe the password is used locally when it is actually being sent across the platform boundary, creating confidentiality and trust risks.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file is presented as a reference-guided workflow, but it contains concrete, authenticated steps to log in, query model metadata, test connectivity, and create assets. That turns documentation into operational runbook content that can directly drive privileged state-changing actions, increasing the chance of unintended or unauthorized execution.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
This step sends credentials to an external HTTP API endpoint to obtain an access token, which is a real data transmission outside the agent boundary. The risk is heightened by the insecure default base URL using plain HTTP and by default admin credentials, which could expose secrets in transit or enable privileged misuse.
- Content
bash API_URL="${ZHIHU_API_URL:-http://localhost:1024}" TOKEN=$(curl -s -X POST "${API_URL}/admin-api/system/auth/login" \ -H "Content-Type: application/json" \ -d "{ \"username\": \"${ZHIHU_USER:-admin}\",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
2a. 通过模型列表查询 modelId
bash MODEL_INFO=$(curl -s --connect-timeout 10 -X POST "${API_URL}/admin-api/cqt/asset-model/page" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${TOKEN}" \ -d '{"pageNo":1,"pageSize":50}' | python3 -c "
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
2b. 通过 modelId 获取完整模型信息（含 items）
bash curl -s --connect-timeout 10 -X POST "${API_URL}/admin-api/cqt/asset-model/get" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${TOKEN}" \ -d "{\"id\": ${MODEL_INFO}}" | python3 -c "
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill collects host credentials and instructs testing SSH reachability against user-supplied targets, which goes beyond passive asset-management guidance. This enables credential use against external hosts and can facilitate unauthorized probing or mishandling of privileged access data if triggered in the wrong context.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This step transmits the user's SSH username and password to the platform API to perform a connectivity test against a target host. That is highly sensitive because it exports reusable infrastructure credentials and enables the platform to attempt authentication to external systems, which can lead to credential compromise, unauthorized probing, or liability if used on unapproved hosts.
- Content
使用用户提供的 IP、端口、用户名、密码测试 SSH 连通性：
bash curl -s -X POST "${API_URL}/admin-api/zhihu/snmp/testConnect" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${TOKEN}" \ -d "{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file describes a delete operation for asset types but provides no warning about the destructive nature of the action, potential permanence, or need for confirmation. Under the markdown-specific warning rule, descriptions of behaviors that can affect user data or system integrity should disclose such risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file includes an endpoint for deleting assets but does not warn users that invoking it may remove user data and could be irreversible. For markdown files, omitting warnings around destructive operations is a quality and safety issue.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file documents endpoints for deleting and restarting scan tasks, which can affect system operations, but it does not include any warning, caution, or note about the operational impact of invoking them. Under the markdown-specific SQP-2 criteria, descriptions of behaviors that can affect system integrity should disclose such risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file documents an export endpoint for scanned asset data and only states that it exports discovered assets, with no warning that the output may contain sensitive infrastructure or inventory information. For markdown files, SQP-2 requires warnings when described behavior could affect user data or privacy.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file documents a delete endpoint for dialing test tasks, but it does not include any warning that invoking it will remove a task or may be irreversible. Under the markdown-file criteria for missing user warnings, descriptions of behavior that can affect user data or system integrity should disclose that impact.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document instructs operators to obtain and use a Bearer Token for API access but gives no guidance on secure handling, storage, redaction, or rotation of that credential. In an agent skill context, this increases the chance that tokens are exposed in logs, prompts, transcripts, screenshots, or reused insecurely, which could enable unauthorized access to the Zhihu AIOps platform APIs.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The workflow creates a persistent monitoring asset once connectivity succeeds, but the instructions do not prominently warn the user that this changes platform state and stores monitoring configuration. Lack of explicit notice can lead to accidental provisioning, especially in environments where users expect reference-only guidance.
- Content