T09 · Insecure Skill Coding Practices
Note
- Location
scripts/seo.py:87- Finding
Partial API Credential Disclosure in Check Command Output
- Content
View full analysis
- Remediation
View remediation
Security audit
jike-seo
Security checks for vulnerabilities and agentic risk
Overview
This SEO keyword skill is mostly purpose-aligned, but it unnecessarily prints part of the user's API key during its check command.
Review before installing. The main SEO API behavior is coherent, but avoid running the check command in logged terminals or shared agent sessions unless the publisher removes the API-key fragment output. Install only if you are comfortable sending keyword queries and your JIKE_SEO_API_KEY to the declared SEO service.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (9)
Tainted flow: 'req' from os.environ.get (line 58, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python req = urllib.request.Request(url, headers=headers, method=method) try: with urllib.request.urlopen(req, timeout=60) as resp: result = json.loads(resp.read().decode("utf-8")) except urllib.error.HTTPError as e: err_body = e.read().decode("utf-8", errors="replace")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def get_api_key() -> str: """Get API key from environment variable.""" key = os.environ.get("JIKE_SEO_API_KEY", "").strip() if not key: print("Error: API key not configured.", file=sys.stderr)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill invokes a Python script and relies on both environment variables and outbound network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. That makes the runtime capabilities broader and less auditable than the manifest suggests, increasing the risk of unintended data access or network use if the script is modified or behaves unexpectedly.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation text is very broad, covering common requests like content optimization, trend analysis, audience analysis, and keyword research. This can cause the skill to trigger in situations beyond the user's clear intent, potentially sending user queries to an external service unnecessarily and expanding data exposure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The persona requires Chinese-only responses regardless of the user's language preference. While not a direct code-execution issue, it can override user intent and impair transparency or consent, especially if users cannot clearly understand what data is being queried or what actions the skill is taking.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The file presents itself and several user-facing outputs in Chinese, including command descriptions and printed results, but does not provide any opt-in or language-selection mechanism. This can violate language/locale policy when a skill assumes a specific language for all users without choice or explicit justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The check command reveals part of the API key on stdout without warning. Even partial secret disclosure can aid correlation, debugging-log leaks, screenshot exposure, or matching against other leaked material, especially in shared terminals, CI logs, or support transcripts. In an agent skill context where command output may be captured automatically, this becomes more dangerous than in a purely local CLI.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The docstring at L083 and parser help text at L206 describe this command as a connectivity check, which implies contacting the remote SEO API. In reality, the function only reads the environment variable and prints a masked key prefix/suffix without making any network request, so the documentation actively overstates what the command does.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The argument parser description is hard-coded in Chinese, reinforcing that the skill's interface is locked to one language. No user opt-in, fallback language, or documented region-specific limitation is provided.
- Content
Static analysis
No suspicious patterns detected.