T09 · Insecure Skill Coding Practices
Error
- Location
integration-test.js:11- Finding
Hardcoded Discord Webhook and GitHub Personal Access Token
- Content
View full analysis
- Remediation
View remediation
Security audit
Utf8 Encoder
Security checks for vulnerabilities and agentic risk
Overview
The skill is broadly consistent with UTF-8 publishing, but it includes live credentialed publishing behavior, embedded real-looking credentials, secret logging, and automatic local backups that users should review before installing.
Do not run the integration test or use this skill with sensitive content until the embedded credentials are removed and rotated. If installed, use only explicit least-privilege Discord/GitHub credentials, treat all published file content as potentially sent to third parties, avoid confidential files, and check for local backup files after failed GitHub publishing.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
utf8-encoder.js:174- Finding
Unrestricted Outbound HTTPS Destination in Discord Publishing Adapter
- Content
View full analysis
{ const https = require('https'); const req = https.request(httpsOptions, (res) => { let data = ''; res.on('data', (chunk) => { data += chunk; }); res.on('end', () => { const result = { success: res.statusCode === 204 || (res.statusCode >= 200 && res.statusCode < 300), statusCode: res.statusCode, platform: 'Discord', messageLength: content.length, byteLength: this.calculateUTF8ByteLength(postData) }; resolve(result); }); }); req.on('error', (error) => { reject(error); }); req.write(postData); req.end(); }); } ``` The same behavior is exposed through the CLI, which accepts a webhook argument and forwards it to this method. ### Technical Analysis Although the method is described as a Discord adapter, it accepts any URL and uses its hostname and path without confirming that the destination belongs to Discord. As a result, the caller controls the HTTPS destination receiving the supplied content. This creates an SSRF-like outbound request primitive when an untrusted party can influence `webhookUrl ...[truncated 2239 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (26)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill describes itself primarily as UTF-8 publishing infrastructure, but its examples and claims include remote publishing, local file access, retries, and automatic backup behavior without clearly declaring those side effects in permissions or warnings. In a skill ecosystem, concealed or under-disclosed data egress and file writes materially increase the chance of unintended disclosure of user content or misuse of tokens.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill describes itself primarily as UTF-8 publishing infrastructure, but its examples and claims include remote publishing, local file access, retries, and automatic backup behavior without clearly declaring those side effects in permissions or warnings. In a skill ecosystem, concealed or under-disclosed data egress and file writes materially increase the chance of unintended disclosure of user content or misuse of tokens.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill describes itself primarily as UTF-8 publishing infrastructure, but its examples and claims include remote publishing, local file access, retries, and automatic backup behavior without clearly declaring those side effects in permissions or warnings. In a skill ecosystem, concealed or under-disclosed data egress and file writes materially increase the chance of unintended disclosure of user content or misuse of tokens.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The CLI reads environment variables containing Discord and GitHub credentials but the capability is not declared in the manifest/permission model. Undeclared secret access weakens user trust and reviewability because operators may not realize the tool can consume credentials and perform network-backed publishing actions.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code comment says the test creates a private Gist, but the call passes false for the privacy/public flag, which likely creates a public Gist instead. That can unintentionally expose test content, timestamps, and potentially sensitive operational details to anyone on the internet, especially dangerous in a publishing/integration skill that encourages use of real credentials and real APIs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Automatic multi-platform publishing and local backup are documented as built-in behavior without a strong warning that user content may be transmitted to external services or written to disk. This is risky because users may supply confidential content under the assumption of local-only processing, leading to accidental disclosure or retention.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The examples encourage use of environment-stored webhook URLs and GitHub tokens for remote publishing, which is a sensitive capability beyond simple UTF-8 conversion. In context, this broadens the blast radius: any misuse, prompt confusion, or accidental invocation could cause unauthorized publication of user content or abuse of privileged credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Automatic local backup of failed publishing attempts creates an undeclared persistence channel for potentially sensitive content. If users are unaware of disk writes, secrets, drafts, or private research could remain on disk and be exposed to other users, backup systems, or later compromise.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation goes beyond encoding handling and teaches users to publish content externally and write local reports, expanding the operational scope without a correspondingly clear trust boundary. This is dangerous because users may provide sensitive material expecting local encoding assistance, while the documented workflow encourages broader dissemination and persistence.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill's docstring and CLI help/output strings are presented in Chinese only, which imposes a specific language on users without opt-in or justification. Under the stated policy, forcing a specific language or locale in natural-language content is a violation unless the constraint is documented and justified.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The helper treats any existing path as a file and reads it from disk for multiple commands. While file input can support publishing, the manifest does not describe broad local file-reading capability for validation and length-analysis commands, making this a capability beyond the clearly stated purpose.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill accesses DISCORD_WEBHOOK_URL and GITHUB_TOKEN even though credential handling is not called out in the manifest description. Hidden or insufficiently documented secret consumption is risky because it enables outbound publication using privileged tokens without clear user awareness during installation or review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The CLI prints a prefix of the GitHub token to console during test operations. Even partial secret disclosure can leak into shell history captures, CI logs, terminal recordings, or support screenshots, aiding token identification and correlation with other leaked material.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The infrastructure publish path also exposes the first part of the GitHub token in user-visible output. This repeats the same secret-handling flaw in a higher-value workflow that is likely to run in automation, making leakage into CI/CD logs especially plausible.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file's comments and console output are written in Chinese throughout, which imposes a specific language on users without opt-in. Under the policy, forcing a language or locale without offering a choice or clear justification is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This script performs real outbound API calls to Discord and GitHub and sends generated content externally during testing, but the warning is limited and does not clearly disclose what data will be transmitted before execution. In a skill context, this is risky because users may run tests expecting local validation, while the script uses hardcoded fallback credentials and immediately interacts with third-party services.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The manifest describes UTF-8 publishing infrastructure for handling Chinese encoding issues across platforms such as Discord and GitHub, but this test file exercises creation of a GitHub Gist as a content-hosting artifact rather than a clearly necessary release/publication action. Creating standalone Gists is not an obvious implementation detail of encoding-safe publishing infrastructure and expands the skill's practical capability beyond the stated purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Comments, docstrings, logs, and usage text throughout the file are presented only in Chinese, which effectively forces a specific language for users and maintainers. The file does not provide an opt-in language choice or explain a region-specific reason for this locale constraint.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest frames this skill as publishing infrastructure focused on handling Chinese encoding issues across platforms, which can justify some platform delivery helpers. However, this code goes beyond encoding assistance and implements full GitHub Gist creation with authenticated remote content publication, a capability not inherently required to solve UTF-8 encoding problems.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
On GitHub publication failure, the code silently writes the full user content to a local backup file. This creates an unintended data persistence channel that may store sensitive content on disk outside the user's expectations, increasing exposure through local compromise, backups, shared workspaces, or later discovery.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill writes user-provided content to a local file without any user-facing warning, confirmation, or configuration gate. Even if intended for resilience, silent persistence can leak secrets, unpublished content, tokens, or personal data into the filesystem where other processes or users may access it.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The skill name, description, and examples are centered on Chinese publishing and Chinese-content handling, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy issue unless clearly justified as region-specific.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The overview states '不是手动调用的编码工具' and positions the skill as automatically running infrastructure, yet later sections present direct manual use of encoder methods such as ensureUTF8, sendToDiscord, createGitHubGist, and file reads. This is an active contradiction in stated usage model, not merely omitted detail.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The manifest frames the skill as '发布基础设施' for handling cross-platform Chinese encoding during publishing to platforms like Discord and GitHub. However, the CLI prominently implements general-purpose local text/file utilities such as validate, length, and encode, which are broader UTF-8 tooling capabilities rather than publishing infrastructure behavior.
- Content
Static analysis
No suspicious patterns detected.