Security audit

Utf8 Encoder

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly consistent with UTF-8 publishing, but it includes live credentialed publishing behavior, embedded real-looking credentials, secret logging, and automatic local backups that users should review before installing.

Do not run the integration test or use this skill with sensitive content until the embedded credentials are removed and rotated. If installed, use only explicit least-privilege Discord/GitHub credentials, treat all published file content as potentially sent to third parties, avoid confidential files, and check for local backup files after failed GitHub publishing.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: integration-test.js:11
Finding: Hardcoded Discord Webhook and GitHub Personal Access Token<![CDATA[ ## Vulnerability Details **File Location**: `integration-test.js:11-12` **Vulnerability Type**: Hardcoded credentials and automatic use of embedded secrets **Risk Level**: High ### Vulnerable Code ```javascript // Configuration - obtain from environment variables const DISCORD_WEBHOOK = process.env.DISCORD_WEBHOOK_URL || 'https://discord.com/api/webhooks/[REDACTED_EMBEDDED_WEBHOOK_CREDENTIAL]'; const GITHUB_TOKEN = process.env.GITHUB_TOKEN || 'ghp_[REDACTED_EMBEDDED_PERSONAL_ACCESS_TOKEN]'; ``` The credential values are redacted from this report to prevent further disclosure. The audited source contains complete credential strings. These fallback credentials are subsequently used in real external requests: ```javascript const discordResult = await encoder.sendToDiscord( DISCORD_WEBHOOK, `Discord integration test:\n${testText}\n\nTest time: ${new Date().toISOString()}`, { username: 'UTF8-Encoder-Test', avatar_url: '' } ); ``` ```javascript const gistResult = await encoder.createGitHubGist( GITHUB_TOKEN, gistContent, 'utf8-integration-test.md', 'UTF-8 encoding integration test - ' + new Date().toISOString(), false ); ``` ### Technical Analysis The integration test embeds a complete Discord webhook credential and a GitHub personal access token as fallback configuration. When the corresponding environment variables are absent, the program silently selects these embedded values. Running `npm run integration-test` therefore initiates real network requests with the embedded credentials. The Discord credential is used to post a message, while the GitHub token is placed in an authorization header and used to create a private Gist. Secrets committed to source code must be considered compromised because they may be recovered from package archives, repository clones, caches, forks, logs, or version history. The fallback behavior also exceeds least privilege: an encoding integration test does not need package-wide sha ...[truncated 1750 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate both embedded credentials: - Delete or regenerate the Discord webhook. - Revoke the GitHub personal access token and issue a narrowly scoped replacement only if necessary. 2. Remove all hardcoded fallback credentials: ```javascript const DISCORD_WEBHOOK = process.env.DISCORD_WEBHOOK_URL; const GITHUB_TOKEN = process.env.GITHUB_TOKEN; ``` 3. Refuse to run real integration tests unless credentials are supplied explicitly: ```javascript if (!DISCORD_WEBHOOK || !GITHUB_TOKEN) { throw new Error('Explicit integration-test credentials are required'); } ``` 4. Separate offline encoding tests from opt-in live API tests. 5. Require an explicit confirmation flag such as `RUN_LIVE_INTEGRATION_TESTS=true`. 6. Use dedicated test accounts and credentials with the minimum possible permissions. 7. Add automated secret scanning to local hooks and CI, such as Gitleaks, TruffleHog, or GitHub secret scanning. 8. Purge the credentials from repository history, release archives, package registries, caches, and forks where feasible. 9. Review Discord and GitHub audit records for prior unauthorized use. 10. Never print any part of a token or webhook credential to logs. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: utf8-encoder.js:174
Finding: Unrestricted Outbound HTTPS Destination in Discord Publishing Adapter<![CDATA[ ## Vulnerability Details **File Location**: `utf8-encoder.js:174-224` **Vulnerability Type**: Unvalidated user-controlled network destination and SSRF-like outbound request primitive **Risk Level**: Medium ### Vulnerable Code ```javascript async sendToDiscord(webhookUrl, content, options = {}) { console.log(`📨 Sending to Discord...`); const payload = { content: this.ensureUTF8(content), username: options.username || 'UTF8-Encoder', avatar_url: options.avatar_url || '' }; const postData = this.createUTF8JSONPayload(payload); const headers = this.createUTF8Headers(postData); const url = new URL(webhookUrl); const httpsOptions = { hostname: url.hostname, path: url.pathname + url.search, method: 'POST', headers: headers }; return new Promise((resolve, reject) => { const https = require('https'); const req = https.request(httpsOptions, (res) => { let data = ''; res.on('data', (chunk) => { data += chunk; }); res.on('end', () => { const result = { success: res.statusCode === 204 || (res.statusCode >= 200 && res.statusCode < 300), statusCode: res.statusCode, platform: 'Discord', messageLength: content.length, byteLength: this.calculateUTF8ByteLength(postData) }; resolve(result); }); }); req.on('error', (error) => { reject(error); }); req.write(postData); req.end(); }); } ``` The same behavior is exposed through the CLI, which accepts a webhook argument and forwards it to this method. ### Technical Analysis Although the method is described as a Discord adapter, it accepts any URL and uses its hostname and path without confirming that the destination belongs to Discord. As a result, the caller controls the HTTPS destination receiving the supplied content. This creates an SSRF-like outbound request primitive when an untrusted party can influence `webhookUrl ...[truncated 2239 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate the protocol and permit only HTTPS: ```javascript if (url.protocol !== 'https:') { throw new Error('Only HTTPS Discord webhook URLs are permitted'); } ``` 2. Enforce an exact hostname allowlist: ```javascript const allowedHosts = new Set([ 'discord.com', 'www.discord.com' ]); if (!allowedHosts.has(url.hostname.toLowerCase())) { throw new Error('Unapproved Discord webhook host'); } ``` 3. Validate that the path matches the expected Discord webhook structure: ```javascript if (!/^\/api\/webhooks\/[^/]+\/[^/]+$/.test(url.pathname)) { throw new Error('Invalid Discord webhook path'); } ``` 4. Reject URLs containing embedded usernames, passwords, fragments, or unexpected ports. 5. Apply outbound firewall or proxy rules so the process cannot reach loopback, link-local, private, metadata-service, or unrelated external destinations. 6. Resolve and verify destination addresses where the threat model includes DNS rebinding. 7. Keep generic webhook publishing separate from the Discord-specific API. A generic interface should be explicitly named and documented as sending content to a caller-selected host. 8. Treat webhook URLs as secrets and avoid printing even partial values to logs. 9. Require explicit user confirmation before transmitting file-derived content to any remote destination. 10. Add tests confirming that non-Discord hosts, malformed paths, internal IP addresses, and non-HTTPS schemes are rejected. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (26)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill describes itself primarily as UTF-8 publishing infrastructure, but its examples and claims include remote publishing, local file access, retries, and automatic backup behavior without clearly declaring those side effects in permissions or warnings. In a skill ecosystem, concealed or under-disclosed data egress and file writes materially increase the chance of unintended disclosure of user content or misuse of tokens.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill describes itself primarily as UTF-8 publishing infrastructure, but its examples and claims include remote publishing, local file access, retries, and automatic backup behavior without clearly declaring those side effects in permissions or warnings. In a skill ecosystem, concealed or under-disclosed data egress and file writes materially increase the chance of unintended disclosure of user content or misuse of tokens.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill describes itself primarily as UTF-8 publishing infrastructure, but its examples and claims include remote publishing, local file access, retries, and automatic backup behavior without clearly declaring those side effects in permissions or warnings. In a skill ecosystem, concealed or under-disclosed data egress and file writes materially increase the chance of unintended disclosure of user content or misuse of tokens.

Lp1

High

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The CLI reads environment variables containing Discord and GitHub credentials but the capability is not declared in the manifest/permission model. Undeclared secret access weakens user trust and reviewability because operators may not realize the tool can consume credentials and perform network-backed publishing actions.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The code comment says the test creates a private Gist, but the call passes false for the privacy/public flag, which likely creates a public Gist instead. That can unintentionally expose test content, timestamps, and potentially sensitive operational details to anyone on the internet, especially dangerous in a publishing/integration skill that encourages use of real credentials and real APIs.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Automatic multi-platform publishing and local backup are documented as built-in behavior without a strong warning that user content may be transmitted to external services or written to disk. This is risky because users may supply confidential content under the assumption of local-only processing, leading to accidental disclosure or retention.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The examples encourage use of environment-stored webhook URLs and GitHub tokens for remote publishing, which is a sensitive capability beyond simple UTF-8 conversion. In context, this broadens the blast radius: any misuse, prompt confusion, or accidental invocation could cause unauthorized publication of user content or abuse of privileged credentials.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Automatic local backup of failed publishing attempts creates an undeclared persistence channel for potentially sensitive content. If users are unaware of disk writes, secrets, drafts, or private research could remain on disk and be exposed to other users, backup systems, or later compromise.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The documentation goes beyond encoding handling and teaches users to publish content externally and write local reports, expanding the operational scope without a correspondingly clear trust boundary. This is dangerous because users may provide sensitive material expecting local encoding assistance, while the documented workflow encourages broader dissemination and persistence.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The skill's docstring and CLI help/output strings are presented in Chinese only, which imposes a specific language on users without opt-in or justification. Under the stated policy, forcing a specific language or locale in natural-language content is a violation unless the constraint is documented and justified.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The helper treats any existing path as a file and reads it from disk for multiple commands. While file input can support publishing, the manifest does not describe broad local file-reading capability for validation and length-analysis commands, making this a capability beyond the clearly stated purpose.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill accesses DISCORD_WEBHOOK_URL and GITHUB_TOKEN even though credential handling is not called out in the manifest description. Hidden or insufficiently documented secret consumption is risky because it enables outbound publication using privileged tokens without clear user awareness during installation or review.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The CLI prints a prefix of the GitHub token to console during test operations. Even partial secret disclosure can leak into shell history captures, CI logs, terminal recordings, or support screenshots, aiding token identification and correlation with other leaked material.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The infrastructure publish path also exposes the first part of the GitHub token in user-visible output. This repeats the same secret-handling flaw in a higher-value workflow that is likely to run in automation, making leakage into CI/CD logs especially plausible.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The file's comments and console output are written in Chinese throughout, which imposes a specific language on users without opt-in. Under the policy, forcing a language or locale without offering a choice or clear justification is a natural-language policy violation.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This script performs real outbound API calls to Discord and GitHub and sends generated content externally during testing, but the warning is limited and does not clearly disclose what data will be transmitted before execution. In a skill context, this is risky because users may run tests expecting local validation, while the script uses hardcoded fallback credentials and immediately interacts with third-party services.

Context-Inappropriate Capability

Medium

Confidence: 76% confidence
Finding: The manifest describes UTF-8 publishing infrastructure for handling Chinese encoding issues across platforms such as Discord and GitHub, but this test file exercises creation of a GitHub Gist as a content-hosting artifact rather than a clearly necessary release/publication action. Creating standalone Gists is not an obvious implementation detail of encoding-safe publishing infrastructure and expands the skill's practical capability beyond the stated purpose.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: Comments, docstrings, logs, and usage text throughout the file are presented only in Chinese, which effectively forces a specific language for users and maintainers. The file does not provide an opt-in language choice or explain a region-specific reason for this locale constraint.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The manifest frames this skill as publishing infrastructure focused on handling Chinese encoding issues across platforms, which can justify some platform delivery helpers. However, this code goes beyond encoding assistance and implements full GitHub Gist creation with authenticated remote content publication, a capability not inherently required to solve UTF-8 encoding problems.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: On GitHub publication failure, the code silently writes the full user content to a local backup file. This creates an unintended data persistence channel that may store sensitive content on disk outside the user's expectations, increasing exposure through local compromise, backups, shared workspaces, or later discovery.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill writes user-provided content to a local file without any user-facing warning, confirmation, or configuration gate. Even if intended for resilience, silent persistence can leak secrets, unpublished content, tokens, or personal data into the filesystem where other processes or users may access it.

Natural-Language Policy Violations

Low

Confidence: 72% confidence
Finding: The skill name, description, and examples are centered on Chinese publishing and Chinese-content handling, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy issue unless clearly justified as region-specific.

Intent-Code Divergence

Low

Confidence: 95% confidence
Finding: The overview states '不是手动调用的编码工具' and positions the skill as automatically running infrastructure, yet later sections present direct manual use of encoder methods such as ensureUTF8, sendToDiscord, createGitHubGist, and file reads. This is an active contradiction in stated usage model, not merely omitted detail.

Description-Behavior Mismatch

Low

Confidence: 81% confidence
Finding: The manifest frames the skill as '发布基础设施' for handling cross-platform Chinese encoding during publishing to platforms like Discord and GitHub. However, the CLI prominently implements general-purpose local text/file utilities such as validate, length, and encode, which are broader UTF-8 tooling capabilities rather than publishing infrastructure behavior.

Static analysis

No suspicious patterns detected.