T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:22- Finding
Bearer API Key Can Be Transmitted to an Untrusted or Plaintext Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Tianji
Security checks for vulnerabilities and agentic risk
Overview
This read-only Tianji skill is coherent, but it gives an assistant broad access to sensitive workspace data, including possible stored API keys, survey respondent details, audit logs, and worker source code.
Install only if you intend to give the assistant broad read-only access to a Tianji workspace. Use a trusted HTTPS Tianji URL and a narrowly scoped read-only API key, preferably not one that can read AI gateway secrets, worker code, audit logs, member emails, billing data, or raw survey responses unless that is explicitly needed and authorized.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/filter-openapi.cjs:72- Finding
OpenAPI “Redaction” Does Not Remove Sensitive Fields from Runtime Responses
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
AI gateway endpoints expose configuration objects containing fields such as modelApiKey and customModelBaseUrl, and the schema itself acknowledges they may contain sensitive data. Marking fields as '[REDACTED]' in descriptions is not an enforcement control; if the API returns them, the skill may access secrets or sensitive infrastructure details inconsistent with a read-only analytics use case.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Survey result endpoints expose raw respondent payloads along with session IDs, IP addresses, browser/OS data, location fields, and AI-derived categorization/translation. This is sensitive personal and behavioral data whose disclosure goes far beyond high-level survey analytics and could violate privacy expectations or regulatory obligations.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The OpenAPI spec exposes full function-worker source code and revision history through read-only endpoints. Even without write access, disclosure of internal code can reveal business logic, embedded secrets, insecure implementation details, or follow-on attack paths, and this capability materially exceeds the manifest’s stated analytics/monitoring purpose.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill can retrieve individual worker code bodies and historical revisions, enabling broad source disclosure over time. Revision history is especially sensitive because older versions often retain removed secrets, deprecated logic, or vulnerable code paths useful for attackers.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation explicitly instructs use of a bearer API key and enumerates many endpoints that can return potentially sensitive operational and user-derived data, including survey results, telemetry, billing, workspace members, audit logs, and AI gateway logs. In a skill context, this can normalize broad access to sensitive data without warning users about privacy, authorization boundaries, or safe handling of returned data, increasing the risk of inadvertent over-collection or disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The spec contains multiple endpoints with sensitive response fields, but the skill framing emphasizes 'safe read-only access' without corresponding user-facing safeguards or handling restrictions. This can mislead operators into treating the integration as low-risk despite exposure to secrets, PII, and internal code.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The members endpoint exposes workspace user identifiers and profile data including usernames, nicknames, and email addresses. This is unnecessary for most analytics queries and increases privacy, phishing, and user-enumeration risk if surfaced through a broad-purpose assistant skill.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Audit-log access exposes internal operational history that may reveal administrator activity, monitor changes, related object IDs, and other sensitive context useful for reconnaissance. While read-only, this materially broadens the assistant’s visibility beyond the declared analytics/reporting scope and can aid chaining attacks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This manifest file defines natural-language triggers, so vague-trigger review applies. The standalone keyword "telemetry" is broad and not clearly limited to Tianji or website analytics context, which could cause unintended invocation for unrelated telemetry discussions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The single-word trigger "uptime" does not clearly distinguish Tianji platform data from other monitoring tools or generic conversations about availability. Without narrower scope or negative examples, the skill may activate when the user is not referring to this specific skill domain.
- Content