T09 · Insecure Skill Coding Practices
Error
- Location
scripts/gitea_api.py:15- Finding
Payload-Controlled Gitea Endpoint Can Exfiltrate the Bot Token
- Content
View full analysis
- Remediation
View remediation
Security audit
Kb Query
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for a Gitea-backed knowledge-base assistant, but it handles powerful credentials and filesystem paths without enough containment.
Install only in an environment where backend payloads are trusted and where the bot token is tightly scoped. Before production use, require an allowlisted HTTPS Gitea host, constrain attachment and result paths to trusted directories, reject symlinks/traversal, and keep the bot account limited to the intended KB repository.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/query_context.py:252- Finding
Unvalidated Attachment Storage Paths Permit Arbitrary Local-File Reads
- Content
View full analysis
MAX_TOTAL_ATTACHMENT_CHARS: preview = preview[: max(0, len(preview) - (total - MAX_TOTAL_ATTACHMENT_CHARS))] prepared.append({ "attachmentId": item.get("attachmentId"), "fileName": item.get("fileName") or "", "mimeType": item.get("mimeType") or "", "sha256": item.get("sha256") or "", "size": item.get("size") or 0, "temporary": True, "textPreview": preview, "previewAvailable": bool(preview.strip()), "note": "This attachment is a temporary query reference and must not be ingested or cited as a stable KB source.", }) return prepared ``` ```python def read_text_preview(path, max_chars=12000): if not path: return "" file_path = Path(path) if not file_path.exists() or not file_path.is_file(): return "" if file_path.stat().st_size > 50 * 1024 * 1024: return "" suffix = file_path.suffix.lower() try: if suffix == ".docx": return read_docx_text(file_path, max_chars) if suffix == ".pptx": return read_pptx_text(file_path, max_chars) if suffix in TEXT_SUFFIXES: return clip(file_path.read_text(encoding="utf-8", errors="replace"), max_chars) return "" except Exception: return "" ``` ### Technical Analysis The task-provided `attachments[].storagePath` is pa ...[truncated 1972 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/task_io.py:149- Finding
Unconstrained Output Paths Permit Arbitrary File Overwrite
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the skill advertised as read-oriented KB answering can also write or update repository contents, that is a meaningful privilege/behavior mismatch. Operators may invoke it assuming low-risk query semantics, while the workflow includes persistent modification of KB files (
qa/,catalog.json,index.md), increasing the chance of unauthorized or unintended content changes.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
If the skill advertised as read-oriented KB answering can also write or update repository contents, that is a meaningful privilege/behavior mismatch. Operators may invoke it assuming low-risk query semantics, while the workflow includes persistent modification of KB files (
qa/,catalog.json,index.md), increasing the chance of unauthorized or unintended content changes.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the skill advertised as read-oriented KB answering can also write or update repository contents, that is a meaningful privilege/behavior mismatch. Operators may invoke it assuming low-risk query semantics, while the workflow includes persistent modification of KB files (
qa/,catalog.json,index.md), increasing the chance of unauthorized or unintended content changes.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the skill advertised as read-oriented KB answering can also write or update repository contents, that is a meaningful privilege/behavior mismatch. Operators may invoke it assuming low-risk query semantics, while the workflow includes persistent modification of KB files (
qa/,catalog.json,index.md), increasing the chance of unauthorized or unintended content changes.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill describes access to environment variables, local file reads/writes, and likely network-backed repository operations, but it declares no explicit tool scope or permissions boundary. That creates an avoidable overreach risk: a caller or runtime may grant broader capabilities than intended, enabling filesystem or token exposure if the skill or its downstream scripts are abused.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The markdown explicitly states that answers must be primarily in Chinese unless the user clearly asks for another language. This imposes a default language choice without user opt-in, which matches the locale/language policy violation criteria.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest description says the skill will "Answer Research KB questions" without defining specific trigger phrases, boundaries, or exclusion conditions. In a manifest file, this broad phrasing can overlap with many ordinary research/help requests and may cause unintended invocation because the scope is not narrowly constrained.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The client can write arbitrary content back into the Gitea repository via upsert_text, which exceeds a narrowly read-only KB query role. In this skill context, that is meaningful because an answering workflow with persistence can be coerced into modifying trusted knowledge-base content, creating integrity risks such as unauthorized Q&A insertion, poisoning future answers, or overwriting files if upstream path/message/content inputs are not tightly controlled.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The upsert_text method performs a remote file create/update operation against the Gitea repository, which can change persisted user or team data. The code does not include a confirmation prompt, user-facing log/print, or inline comment/docstring warning that this method writes repository contents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The _request method sends HTTP requests to the configured Gitea server and includes an authorization token; when used by read and write paths, it transmits repository paths and potentially file contents over the network. There is no user-facing warning, logging, or explanatory comment/docstring disclosing this external network interaction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The constants for the reference heading, source trace label, and fallback source text are fixed in Chinese, which forces generated content into a specific language. This is a natural-language locale policy concern because the file does not provide any user opt-in, configuration, or justification for restricting output language.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest says the skill answers knowledge-base questions with optional high-value Q&A persistence, but this code goes beyond producing an answer by performing multiple repository write operations: creating/updating a QA page and modifying catalog.json and index.md. Those content-management side effects materially extend behavior beyond simple question answering and are only partially hinted at by the brief 'optional persistence' wording.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
After persisting a QA page, the code reads and rewrites catalog.json and index.md, effectively maintaining site-wide repository metadata. While saving a high-value answer page may fit the manifest, rebuilding shared catalog and index artifacts is a broader content-administration capability than answering KB questions with citations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The string requires answers to end with a section titled '## 参考来源', which imposes Chinese output regardless of the user's preferred language. This is a natural-language locale policy issue because the file does not offer any language choice or document a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code returns a natural-language answer in Chinese when answer recovery fails, regardless of the user's preferred language or locale. That enforces a specific language without opt-in, which matches the policy-violation category for locale/language constraints.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The input field describes a "Research KB backend query payload JSON" but does not clarify what kinds of questions, systems, or contexts are in scope. For a manifest file, this leaves activation boundaries ambiguous and provides no negative examples or constraints to prevent overbroad matching.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This client loads Gitea URL, bot token, owner, and repo selection from environment variables, meaning the skill participates in credentialed repository access and target selection. For a skill framed as answering KB questions, direct credential and repo-resolution logic is not clearly justified unless explicitly declared as part of its operational scope.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The code creates parent directories and writes JSON content to an arbitrary path, which is a file-modifying operation covered by the warning requirement for code files. There is no confirmation prompt, visible logging/print, or inline documentation explaining this write behavior in this file.
- Content
Static analysis
No suspicious patterns detected.