Security audit

my_acceptance_rate_analysis2

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the promised analytics, but it handles browser access tokens in ways that can persist or expose them, so it needs careful review before use.

Install only after reviewing token handling. Prefer a version that removes endpoint overrides or allowlists the DataWorks host, keeps tokens in memory or a secure credential store, disables raw query logging by default, and avoids passing tokens on the command line. Users who already ran this should remove persisted BIGDATA_ACCESS_TOKEN values and consider rotating the browser-derived token.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/dataworks_client.py:197
Finding: Authentication Cookie Can Be Forwarded to an Arbitrary Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/acceptance_rate_analysis.py:152
Finding: Browser Authentication Token Is Automatically Persisted in Plaintext
Content: View full analysis
None: import winreg with winreg.OpenKey(winreg.HKEY_CURRENT_USER, "Environment", 0, winreg.KEY_SET_VALUE) as registry_key: winreg.SetValueEx(registry_key, "BIGDATA_ACCESS_TOKEN", 0, winreg.REG_SZ, token) _broadcast_windows_environment_change() ``` On Unix-like systems, the credential is inserted into a shell startup file: ```python def _persist_access_token_unix(token: str) -> None: profile_path = _unix_profile_path() profile_path.parent.mkdir(parents=True, exist_ok=True) if profile_path.exists(): existing_text = profile_path.read_text(encoding="utf-8") lines = existing_text.splitlines() else: existing_text = "" lines = [] export_line = f"export BIGDATA_ACCESS_TOKEN={shlex.quote(token)}" updated_lines: list[str] = [] replaced = False for line in lines: stripped = line.strip() if stripped.startswith("export BIGDATA_ACCESS_TOKEN="): updated_lines.append(export_line) replaced = True else: updated_lines.append(line) if not replaced: if updated_lines and updated_lines[-1].strip(): updated_lines.append("") updated_lines.append(export_line) new_text = "\n".join(updated_lines) if new_text and not new_text.endswith("\n"): new_text += "\n" if new_text != existing_text: profile_path.write_text(new_text, encoding="utf-8") ``` Persistence is automatically invoked whenever an explicit token is provided: ```python def persist_access_token(token: str) -> str: n ...[truncated 2945 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/dataworks_client.py:188
Finding: Raw Business Query Results and Generated SQL Are Logged by Default
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (41)

Tainted flow: 'DEFAULT_ENDPOINT' from os.getenv (line 12, credential/environment) → httpx.post (network output)

Critical

Category: Data Flow
Confidence: 91% confidence
Finding: The request target can be overridden from an environment variable or function argument, while the code always attaches the bigdata access token in the Cookie header. If an attacker can influence deployment environment, runtime configuration, or upstream caller input, they can redirect requests to an attacker-controlled endpoint and exfiltrate the token and query payload. In this analytics skill context, the function is specifically designed to access sensitive internal data, which increases the danger of SSRF-style redirection and credential leakage.
Content: Scanner excerpt · scripts/dataworks_client.py (reported line 197)May include surrounding context.
python
json.dumps(payload, ensure_ascii=False, indent=2), ) response = httpx.post( endpoint or DEFAULT_ENDPOINT, headers={ "Cookie": f"bigdata_access_token={access_token or DEFAULT_ACCESS_TOKEN}",

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose is narrow acceptance-rate analysis, but the instructions effectively grant a general remote querying workflow using browser-derived cookies and external data APIs, with possible logging of query inputs and returned data. This broader capability increases the risk of sensitive data exfiltration and misuse under the guise of a benign analytics skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented purpose is narrow acceptance-rate analysis, but the instructions effectively grant a general remote querying workflow using browser-derived cookies and external data APIs, with possible logging of query inputs and returned data. This broader capability increases the risk of sensitive data exfiltration and misuse under the guise of a benign analytics skill.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.
md
**计算口径的唯一事实来源是代码**：阈值、门禁公式、命中与候选范围逻辑以 `scripts/acceptance_rate_constants.py` 与 `scripts/acceptance_rate_support.py` / `scripts/acceptance_rate_analysis.py` 为准。*

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.
md
scripts/acceptance_rate_constants.py` 与 `scripts/acceptance_rate_support.py` / `scripts/acceptance_rate_analysis.py` 为准。**禁止**凭本文件背诵具体百分比、门槛数值或分支细节；若叙述中需要提及规则，只

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
scripts/acceptance_rate_constants.py` 与 `scripts/acceptance_rate_support.py` / `scripts/acceptance_rate_analysis.py` 为准。**禁止**凭本文件背诵具体百分比、门槛数值或分支细节；若叙述中需要提及规则，只

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
scripts/acceptance_rate_constants.py` 与 `scripts/acceptance_rate_support.py` / `scripts/acceptance_rate_analysis.py` 为准。**禁止**凭本文件背诵具体百分比、门槛数值或分支细节；若叙述中需要提及规则，只

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
scripts/acceptance_rate_constants.py` 与 `scripts/acceptance_rate_support.py` / `scripts/acceptance_rate_analysis.py` 为准。**禁止**凭本文件背诵具体百分比、门槛数值或分支细节；若叙述中需要提及规则，只

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
md
scripts/acceptance_rate_constants.py` 与 `scripts/acceptance_rate_support.py` / `scripts/acceptance_rate_analysis.py` 为准。**禁止**凭本文件背诵具体百分比、门槛数值或分支细节；若叙述中需要提及规则，只

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.
md
scripts/acceptance_rate_constants.py` 与 `scripts/acceptance_rate_support.py` / `scripts/acceptance_rate_analysis.py` 为准。**禁止**凭本文件背诵具体百分比、门槛数值或分支细节；若叙述中需要提及规则，只

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.
md
scripts/acceptance_rate_constants.py` 与 `scripts/acceptance_rate_support.py` / `scripts/acceptance_rate_analysis.py` 为准。**禁止**凭本文件背诵具体百分比、门槛数值或分支细节；若叙述中需要提及规则，只

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.
md
scripts/acceptance_rate_constants.py` 与 `scripts/acceptance_rate_support.py` / `scripts/acceptance_rate_analysis.py` 为准。**禁止**凭本文件背诵具体百分比、门槛数值或分支细节；若叙述中需要提及规则，只

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.
md
scripts/acceptance_rate_constants.py` 与 `scripts/acceptance_rate_support.py` / `scripts/acceptance_rate_analysis.py` 为准。**禁止**凭本文件背诵具体百分比、门槛数值或分支细节；若叙述中需要提及规则，只

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.
md
scripts/acceptance_rate_constants.py` 与 `scripts/acceptance_rate_support.py` / `scripts/acceptance_rate_analysis.py` 为准。**禁止**凭本文件背诵具体百分比、门槛数值或分支细节；若叙述中需要提及规则，只

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.
md
scripts/acceptance_rate_constants.py` 与 `scripts/acceptance_rate_support.py` / `scripts/acceptance_rate_analysis.py` 为准。**禁止**凭本文件背诵具体百分比、门槛数值或分支细节；若叙述中需要提及规则，只

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.
md
scripts/acceptance_rate_constants.py` 与 `scripts/acceptance_rate_support.py` / `scripts/acceptance_rate_analysis.py` 为准。**禁止**凭本文件背诵具体百分比、门槛数值或分支细节；若叙述中需要提及规则，只

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.
md
scripts/acceptance_rate_constants.py` 与 `scripts/acceptance_rate_support.py` / `scripts/acceptance_rate_analysis.py` 为准。**禁止**凭本文件背诵具体百分比、门槛数值或分支细节；若叙述中需要提及规则，只

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.
md
scripts/acceptance_rate_constants.py` 与 `scripts/acceptance_rate_support.py` / `scripts/acceptance_rate_analysis.py` 为准。**禁止**凭本文件背诵具体百分比、门槛数值或分支细节；若叙述中需要提及规则，只

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.
md
scripts/acceptance_rate_constants.py` 与 `scripts/acceptance_rate_support.py` / `scripts/acceptance_rate_analysis.py` 为准。**禁止**凭本文件背诵具体百分比、门槛数值或分支细节；若叙述中需要提及规则，只

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.
md
- 本 `SKILL.md` 的主职责是：**阶段顺序、终端调用方式、展示字段与顺序、状态块原样输出、对用户可用的业务话术边界（如不暴露内部码）**——不是第二份公式手册。

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This skill persists BIGDATA_ACCESS_TOKEN into Windows user environment or Unix shell profiles, which exceeds the expected read-only scope of an acceptance-rate analysis tool. Persisting a browser-derived access token to long-lived user storage increases the blast radius of credential theft, exposes the token to other local processes/sessions, and creates a covert state-changing side effect users may not expect from analytics code.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The function explicitly guides users to obtain an access token from browser cookies, which is credential acquisition behavior. In the context of a data-analysis skill, this is more dangerous because it conditions users to extract and reuse session credentials manually, and the same file later persists them, compounding the exposure risk.
Content: Scanner excerpt · scripts/acceptance_rate_analysis.py (reported line 278)May include surrounding context.
python
def resolve_access_token(explicit_token: str | None) -> str: """ 解析access token，优先级： 1. 显式传入的token 2. 当前终端环境变量中的token 3. 抛出错误，提示用户从浏览器 Cookie 获取 token 值

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares no explicit tool scope while its instructions clearly require environment access, file reads/writes, and network access. That mismatch weakens least-privilege controls and can cause the agent to run with broader capabilities than users or platform policy would reasonably expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill encourages persistent storage and automatic reuse of a user-provided token without a clear user-facing warning about the security consequences. Users may unknowingly leave long-lived credentials in shell startup files or the Windows user environment, where other local processes or future sessions can access them.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill directs the agent to persist user-provided access tokens into process and user-level environment variables for reuse in future sessions. Persisting secrets beyond the immediate task expands their exposure window and makes compromise of the local account, shell config, or registry much more damaging.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/acceptance_rate_analysis.py:3486