Security audit

Solo File Transfer

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its stated document-conversion and IMA-upload purpose, but it handles credentials and remote uploads in ways users should review carefully before installing.

Install only if you trust the publisher and understand that this skill can upload local documents and notes to IMA/Tencent COS using your credentials. Avoid passing secrets on the command line, do not set IMA_BASE_URL or baseUrl unless you fully trust the endpoint, and review each upload before sending sensitive content.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ima_api.cjs:67
Finding: IMA Credentials Can Be Exfiltrated Through an Attacker-Controlled Base URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cos-upload.cjs:78
Finding: COS Temporary Credentials Are Exposed Through Command-Line Arguments
Content: View full analysis
--secret-id --secret-key --token --bucket --region --cos-key [--content-type ] [--start-time ] [--expired-time ] [--timeout ]`, ); ``` ### Technical Analysis The uploader requires the COS secret ID, secret key, and temporary security token to be supplied directly in the process argument vector. Process arguments are not an appropriate secret transport mechanism. Depending on host configuration, command-line arguments may be observable through process inspection facilities, monitoring agents, diagnostic tooling, job runners, audit systems, crash reports, or logs that record executed commands. They can also be retained in shell history when the command is entered interactively. Although these may be temporary COS credentials, temporary credentials remain security-sensitive for their entire validity period. Their exposure breaks credential confidentiality and can permit replay from another process or host. ### Attack Path 1. A legitimate user or ...[truncated 1328 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a combined document-conversion and knowledge-base upload skill. However, the supplied code chunk implements only the docx-to-Markdown portion. It reads a local DOCX, extracts media files, parses paragraphs/tables, generates Markdown, and saves outputs locally. There is no code for IMA authentication, API calls, network requests, file transfer, webpage ingestion, note ingestion, or upload orchestration. Because a major part of the declared primary purpose—uploading to IMA and chaining conversion to upload—is absent from the actual code, the description does not accurately represent the supplied code chunk.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
| COS上传 | `scripts/cos-upload.cjs` | `--file --secret-id --secret-key --token --bucket --region --cos-key` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
| COS上传 | `scripts/cos-upload.cjs` | `--file --secret-id --secret-key --token --bucket --region --cos-key` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill advertises code paths that read environment variables, write files, and perform network transfers, but it does not declare any tool scope or permission boundaries. This creates a confused-deputy risk where an agent may invoke the skill with broader capabilities than the user expects, especially because the skill can both transform local documents and transmit them to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documents uploading files, webpages, and notes to an external knowledge base without any warning that user content will leave the local environment. In context, this is more dangerous because the skill chains document conversion directly into upload, increasing the chance that sensitive internal documents are transmitted without an informed consent checkpoint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script requires --secret-id, --secret-key, and --token, which are sensitive credentials, but there is no comment, docstring, or user-facing warning about supplying secrets on the command line. Passing credentials via CLI arguments can expose them through shell history or process listings, so this sensitive operation should be explicitly disclosed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The postJson function transmits data to a remote HTTPS endpoint and includes clientId and apiKey in request headers, but the file provides no visible warning, prompt, or disclosure to the user about this outbound transmission. Network calls that send user or system data are safety-relevant and should be disclosed when not otherwise clearly communicated.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module performs an additional remote call to openapi/check_skill_update before normal API operations, which is outside the declared file-transfer/format-conversion behavior. Undeclared network behavior increases attack surface, leaks metadata such as skill version and execution timing, and can be abused if the remote endpoint or baseUrl is controlled or compromised.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language instructions, usage description, and examples are presented in Chinese, which can impose a language-specific experience without user opt-in. SQP-3 applies to all file types and flags language-policy issues when a specific language is effectively forced without offering alternatives or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code emits user-facing status and error text in Chinese, which imposes a specific language on all users. The file does not provide any user opt-in, locale selection, or documentation that the tool is intended only for a Chinese-language environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The code persists update-check state in ~/.config/ima/last_update_check, introducing local filesystem writes unrelated to the core file-transfer purpose. While low severity, undeclared persistence can violate least surprise and may create privacy or policy issues in restricted environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code loads sensitive credentials from process environment variables and from files under ~/.config/ima, but there is no confirmation prompt or user-facing notice around that sensitive access. Because this is a code file, credential access without any visible disclosure matches the missing-warning criterion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script emits natural-language messages in Chinese, and similar hard-coded Chinese strings appear elsewhere in the file, without offering any language selection or documenting a justified locale restriction. That can violate language/locale policy because the skill forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Multiple user-facing error messages in this range are hard-coded in Chinese, including invalid input and missing-parameter responses, with no mechanism for the user to choose another language. This is a natural-language locale constraint that is not justified in the file.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/ima_api.cjs:31

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/cos-upload.cjs:96