T09 · Insecure Skill Coding Practices
Error
- Location
scripts/package.py:22- Finding
Plaintext API credentials may be included in distributable skill archives
- Content
View full analysis
- Remediation
View remediation
Security audit
Auto Publish
Security checks for vulnerabilities and agentic risk
Overview
This skill should be reviewed because it asks for real publishing credentials while its publishing and analytics code appears to simulate success rather than perform real platform actions.
Install only after reviewing the code and treating it as a demo, not a real publisher. Do not place real platform secrets in scripts/config.json or publish/share archives made by scripts/package.py unless secrets are removed. Use test accounts, isolate dependencies in a virtual environment, and do not rely on reported publish URLs or analytics as real platform data.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
README.md:279- Finding
Installation instructions use unpinned third-party dependencies
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
scripts/auto_publish.py:200- Finding
Simulated publishing and analytics are returned as successful real operations
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README instructs users to place live platform API credentials directly into a local JSON config file but provides no warning about secret sensitivity, file permissions, accidental commits, or safer secret-storage options. This increases the risk of credential leakage through source control, backups, shared workstations, or logs, which could allow unauthorized posting or account/API abuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README presents single and batch publishing as routine commands but does not clearly warn that these operations will perform real external posting actions to connected user accounts. Users may execute examples assuming they are dry-run or demo behavior, causing unintended publication, reputational harm, policy violations, or spam across multiple platforms.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill promotes automated multi-platform publishing and bulk uploads to external accounts without any warning about the risks of unintended posting, account policy violations, or accidental mass distribution. This is dangerous because users may connect privileged creator accounts and trigger irreversible external actions at scale without informed consent or safeguards.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions tell users to place API keys, access tokens, and client secrets directly into a JSON file, but provide no guidance on secure storage, least privilege, rotation, or exclusion from version control. Exposed publishing credentials could let an attacker post content, access account data, or abuse linked platform accounts across multiple services.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file-level description and all user-facing CLI/help text are written only in Chinese, which imposes a specific language on users without any opt-in or alternative. The policy explicitly calls out language or locale constraints as violations when the skill does not offer user choice or clearly justify the restriction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This script performs real publication to external platforms in batch mode unless
--dry-runis explicitly set, but it does not require an affirmative confirmation or present a strong warning about irreversible external side effects. In an automation or agent-skill context, that increases the risk of unintended data transmission, accidental account actions, or mass posting using configured credentials.- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python "index": i, "item": item, "result": result, "timestamp": str(__import__('datetime').datetime.now()) }) # 输出进度
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains natural-language strings that force a specific language/locale for the skill interface, including the module description and command-line help/output text. The policy requires either user language choice or a clearly justified documented locale constraint, neither of which is present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and user-facing CLI messages are written only in Chinese, which imposes a specific language on users without opt-in or alternative locale support. This matches the policy category for language/locale constraints because the script does not offer a language choice or document a justified region-specific limitation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module title and description are written entirely in Chinese, and the user-facing logs, CLI help text, and output throughout the file also assume Chinese as the only interaction language. This creates a natural-language locale constraint without opt-in or documentation that the skill is intended only for a Chinese-language environment.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generate() docstring says the video_path argument is optional and used for analyzing video content, and analyze_video() is documented as analyzing video content. In reality, the code only checks the filename extension and then produces random tags without opening or inspecting the video file, which directly contradicts the documented behavior.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module presents itself as a post-publication tracker and initializes platform-specific trackers, but every tracker returns fabricated hard-coded metrics after a sleep delay. In an agent skill context, this is dangerous because downstream automation or users may treat the output as real platform analytics, causing deceptive reporting, bad decisions, or silent integrity failures.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This Python file contains natural-language descriptions, help text, and output messages exclusively in Chinese, starting with the module docstring and continuing through the command-line interface. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation because users are not offered an alternative locale or language selection.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill advertises post-publication analytics tracking without warning that account/content performance data may be collected, transmitted, stored, or exposed in logs and reports. While common for publishing tools, the lack of disclosure can lead to privacy misunderstandings and unsafe handling of potentially sensitive account analytics.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's docstring, CLI description, argument help text, and runtime messages are written only in Chinese, which imposes a specific language on users. There is no indication that the tool is region-specific or that users can choose their preferred language/locale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The user-facing note strings are written only in Chinese across multiple platform entries, and the file does not indicate that the skill is region-specific or that users may choose another language. This can violate a language/locale policy when a skill imposes a specific language without opt-in or justification.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The constructor accepts keyword_db_path and load_keyword_db() is documented as loading a keyword database, with comments saying it should load from a file or API. However, the implementation does not use db_path at all and instead returns a fixed in-memory dictionary, which diverges from the stated behavior.
- Content
Static analysis
No suspicious patterns detected.