Security audit

通过 JumpOnce 代理服务访问海外被封禁的 API（币安 US、GitHub、Google、OpenAI 等），支持 HTTP 转发和 WebSocket 透传，出口节点位于 Oracle Cloud 美国凤凰城

Security checks for vulnerabilities and agentic risk

Overview

This proxy skill is purpose-aligned, but it sends API keys and proxied request data through a third-party service over plain HTTP and gives unsafe secret-handling guidance.

Review before installing. Use only if you are comfortable sending target URLs, request metadata, and response data through JumpOnce. Do not proxy secrets, cookies, internal systems, or confidential data unless explicitly approved. Avoid the skill until the proxy API is available over HTTPS, do not pass keys on the command line or store them in workspace Markdown, and pin or independently review any SDK package before installing it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/forward_request.py:39
Finding: Bearer Credential and Proxied Request Data Transmitted over Plaintext HTTP
Content: View full analysis
Vulnerability Details

File Location: scripts/forward_request.py:39-58; SKILL.md:51-63; references/api-reference.md:5-9
Vulnerability Type: Plaintext transmission of sensitive information
Risk Level: High

Vulnerable Code

scripts/forward_request.py:39-58:

python
base_url = "http://api.jumptox.top" endpoint = "/api/v1/http/raw" if args.raw else "/api/v1/http/request" payload = { "url": args.url, "method": args.method.upper(), "headers": json.loads(args.headers), "params": json.loads(args.params), "timeout": min(args.timeout, 120), "followRedirects": True, "verifySSL": True, } if args.body is not None: payload["body"] = args.body resp = requests.post( f"{base_url}{endpoint}", json=payload, headers={"Authorization": f"Bearer {api_key}"}, timeout=payload["timeout"] + 10, )

SKILL.md:51-63:

python
import requests resp = requests.post( "http://api.jumptox.top/api/v1/http/request", json={ "url": "https://example.com/api", "method": "GET", "headers": {}, "params": {}, "timeout": 30, }, headers={"Authorization": "Bearer jk_live_xxxxxxxxxxxx"}, )

references/api-reference.md:5-9:

text
http://api.jumptox.top

text
All requests require `Authorization: Bearer jk_live_xxxxxxxxxxxx` header.

Technical Analysis

The proxy client sends its JumpOnce bearer credential to an http:// endpoint without transport-layer encryption. The same request also contains the target URL, forwarded headers, query parameters, and optional request body. Consequently, every network observer between the client and JumpOnce can potentially read or modify both the proxy credential and the proxied request.

The verifySSL payload property does not mitigate this vulnerability. It only instructs the remote proxy to validate TLS when ...[truncated 1592 chars]
Remediation: View remediation
Remediation Suggestions

Replace the base URL with an HTTPS endpoint:
python
base_url = "https://api.jumptox.top"

Fail closed if the configured proxy API URL does not use HTTPS.

Retain normal certificate and hostname validation; do not add an option that disables verification for the client-to-proxy connection.

Update every example and API reference to use the HTTPS endpoint exclusively.

Clearly document that JumpOnce receives the target URL, headers, parameters, and body, and warn users that forwarding target credentials creates a third-party trust boundary.

Advise users to issue narrowly scoped, short-lived target credentials when authenticated requests must pass through the proxy.

Rotate any API key that has already been used over the documented plaintext endpoint.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/forward_request.py:23
Finding: API Key Exposed through Command-Line Arguments and Unsafe Workspace Persistence
Content: View full analysis
Vulnerability Details

File Location: scripts/forward_request.py:23-27; SKILL.md:25-29,68
Vulnerability Type: Insecure secret handling
Risk Level: Medium

Vulnerable Code

scripts/forward_request.py:23-27:

python
parser.add_argument("--timeout", type=int, default=30, help="Timeout in seconds (max 120)") parser.add_argument("--api-key", default=None, help="API key (or set JUMPONCE_API_KEY)") parser.add_argument("--raw", action="store_true", help="Use raw passthrough endpoint") args = parser.parse_args() api_key = args.api_key or os.environ.get("JUMPONCE_API_KEY")

SKILL.md:25-29:

bash
export JUMPONCE_API_KEY="jk_live_xxxxxxxxxxxx"

text
Or save it in workspace TOOLS.md for persistent access.

SKILL.md:68:

bash
python scripts/forward_request.py --url "https://example.com" --api-key "jk_live_xxx"

Technical Analysis

The script permits a live API key to be supplied through --api-key, and the documentation actively demonstrates that usage. Command-line arguments may be visible in shell history, process inspection tools, terminal logs, CI logs, and monitoring systems.

The documentation also recommends saving the key in a workspace Markdown file. Such files may be committed to version control, copied into diagnostic bundles, exposed to other workspace users, or loaded into agent context. A general-purpose documentation file does not provide appropriate secret access controls.

These mechanisms are unnecessary because the script already supports an environment variable. A dedicated secret manager or protected credential file would further reduce exposure.

Attack Path

A user follows the documented example and supplies the API key using --api-key, or saves it in TOOLS.md.

The key is retained in shell history, exposed in process arguments, included in logs, read through workspace access, or accidentally committed to a repository.

...[truncated 860 chars]
Remediation: View remediation
Remediation Suggestions

Remove the --api-key argument so secrets cannot be supplied through process arguments.

Remove the recommendation to store live credentials in TOOLS.md or any other general workspace document.

Retrieve the credential from a dedicated secret manager where available.

If environment variables must be supported, document their exposure limitations and avoid printing inherited environment data.

Alternatively, use a credential file with restrictive permissions and ensure it is excluded from version control.

Add relevant secret-file patterns to .gitignore and configure secret scanning in version control and CI.

Ensure errors, debug output, telemetry, and request logs redact authorization values.

Revoke and rotate keys previously passed through command-line arguments or stored in shared workspace files.

T08 · Insecure Dependencies

Warning

Location: SKILL.md:32
Finding: Unpinned Third-Party Package Installation Creates Supply-Chain Risk
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:32-38
Vulnerability Type: Unpinned and integrity-unverified dependency installation
Risk Level: Medium

Vulnerable Code

SKILL.md:32-38:

text
### Option A: Python SDK ```bash pip install jump-once

python
from jump import Client

Technical Analysis

The installation instruction retrieves the latest available jump-once package without pinning a reviewed version or validating an integrity hash. The package implementation is not included in the audited project, so its installation-time and runtime behavior cannot be verified from the reviewed files.

An unpinned dependency can change after the Skill has been audited. If the upstream account, release process, or package distribution channel is compromised, users following this instruction may install attacker-controlled code. Python packages may execute code during installation or when imported into the user's process.

The audit found no evidence that the current package is malicious. The vulnerability is the mutable, unaudited supply-chain trust introduced by the installation instruction.

Attack Path

An attacker compromises the package publisher, distribution account, or upstream release pipeline and publishes a malicious version of jump-once.

A user follows the Skill documentation and executes pip install jump-once.

Because no version or hash is specified, the package manager retrieves the malicious release.

Attacker-controlled package code executes during installation or when from jump import Client is evaluated.

The code runs with the operating-system privileges of the user or automation account performing the installation.

Impact Assessment

A compromised dependency could access files, environment variables, API keys, network credentials, and other resources available to the installing user. It could also execute commands, alter project fil ...[truncated 249 chars]
Remediation: View remediation
Remediation Suggestions

Pin the package to a specific version that has been reviewed:
bash
pip install "jump-once==<reviewed-version>"

Provide a hash-locked requirements file and install it with:
bash
pip install --require-hashes -r requirements.txt

Record the verified publisher, source repository, package index, and expected release provenance.

Review the package's source and installation metadata before recommending it.

Use a virtual environment with minimal filesystem and network privileges.

Prefer the bundled, auditable forwarding script when the external SDK is not required.

Use automated dependency monitoring and repeat the review before updating the pinned version.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tainted flow: 'api_key' from os.environ.get (line 28, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/forward_request.py (reported line 54)May include surrounding context.
python
if args.body is not None: payload["body"] = args.body resp = requests.post( f"{base_url}{endpoint}", json=payload, headers={"Authorization": f"Bearer {api_key}"},

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explains how to use the proxy but does not prominently warn that request contents, headers, bodies, and possibly credentials are transmitted through a third-party overseas service. In this context, that omission is especially dangerous because the core function of the skill is exfiltrating traffic off-network to an external proxy provider.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-reference.md (reported line 87)May include surrounding context.
md
### Manage - `GET /api/v1/ws/channels` — list active channels - `DELETE /api/v1/ws/channel/{channelId}` — close channel ## Error Codes

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly requires environment access for an API key and network access to a third-party proxy, but it declares no explicit tool scope or permissions. That omission weakens reviewability and policy enforcement, making it easier for the skill to be invoked with broader capabilities than users or operators expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are broad and include generic terms like overseas, proxy, and blocked/unreachable resources, which can cause accidental invocation in unrelated contexts. In a proxying skill, unintended activation is risky because it may route user requests and data through an external service without clear deliberate consent.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
# HTTP POST result = client.http.forward( url="https://api.example.com/data", method="POST", body='{"key": "value"}', headers={"Content-Type": "application/json"},

External Transmission

Medium

Category: Data Exfiltration
Confidence: 99% confidence
Finding: The direct API example performs external transmission to a third-party proxy endpoint and includes an Authorization bearer token, increasing the sensitivity of the outbound request. Since the endpoint is shown as plain HTTP, both authentication material and target request details could be exposed in transit.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
python
import requests resp = requests.post( "http://api.jumptox.top/api/v1/http/request", json={ "url": "https://example.com/api",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 99% confidence
Finding: The direct API example performs external transmission to a third-party proxy endpoint and includes an Authorization bearer token, increasing the sensitivity of the outbound request. Since the endpoint is shown as plain HTTP, both authentication material and target request details could be exposed in transit.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
python
import requests resp = requests.post( "http://api.jumptox.top/api/v1/http/request", json={ "url": "https://example.com/api",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 99% confidence
Finding: The documented proxy endpoint uses plain HTTP, which permits man-in-the-middle interception of request contents, bearer credentials, and possibly response tampering. Given this skill’s purpose of relaying arbitrary HTTP requests, insecure transport substantially amplifies confidentiality and integrity risks.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
import requests resp = requests.post( "http://api.jumptox.top/api/v1/http/request", json={ "url": "https://example.com/api", "method": "GET",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file documents use of an authorization bearer token and distinguishes live API key and JWT token types, but provides no user-facing warning about protecting secrets or avoiding accidental exposure. Because the file describes handling sensitive credentials, it should disclose the privacy/security implications to users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill is explicitly designed to proxy HTTP and WebSocket traffic to external destinations, yet the documentation does not warn that prompts, retrieved content, headers, and possibly sensitive user/system data may be transmitted to third-party targets. In an agent setting, that omission increases the risk of unintended data exfiltration through this proxy capability.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The code transmits user-supplied request material to an external service, and the configured base URL is http://api.jumptox.top rather than HTTPS. In this skill's context, external transmission is the core function, but using plaintext HTTP for a proxy that carries arbitrary request data and a bearer token creates substantial interception, tampering, and credential exposure risk.
Content: Scanner excerpt · scripts/forward_request.py (reported line 54)May include surrounding context.
python
if args.body is not None: payload["body"] = args.body resp = requests.post( f"{base_url}{endpoint}", json=payload, headers={"Authorization": f"Bearer {api_key}"},

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This script forwards arbitrary URLs, headers, params, and optional body content to an external third-party proxy service without any confirmation, warning, or guardrails. In the context of a proxy skill, that means sensitive request contents, tokens, cookies, internal URLs, or user data may be transmitted off-network to an overseas service, materially increasing data exfiltration and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The script accesses the sensitive JUMPONCE_API_KEY credential from the environment and uses it for authenticated outbound requests. While the docstring notes that the variable is required, there is no explicit warning or disclosure about handling sensitive credentials or that the credential will be sent in an Authorization header to the remote service.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/api-reference.md:11

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:27

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Tainted flow: 'api_key' from os.environ.get (line 28, credential/environment) → requests.post (network output)

Missing User Warnings

Tool Parameter Abuse

Undeclared Tool Scope

Vague Triggers

External Transmission

External Transmission

External Transmission

External Transmission

Missing User Warnings

Missing User Warnings

External Transmission

Missing User Warnings

Missing User Warnings

Static analysis

File appears to expose a hardcoded API secret or token.

File appears to expose a hardcoded API secret or token.