Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed read-only debt lookup skill that contacts Debtop and caches a guest token; no hidden, destructive, or unrelated behavior was found.
Install only if you are comfortable sending company lookup terms, client/skill identifiers, and a stable guest device ID to Debtop's service. Use the default agent.debtop.com endpoint unless you control the alternate deployment, and treat the cached guest token file as a credential. Results are public-notice references, not a credit report or full due-diligence conclusion.
The referenced behavior includes a proof-of-work solver and challenge-response flow that are unrelated to the stated task of searching company debt notices. Embedding PoW-solving logic inside a business lookup skill expands functionality beyond user intent and could be abused for unauthorized access bootstrapping or to conceal the skill's real purpose.
The referenced behavior includes a proof-of-work solver and challenge-response flow that are unrelated to the stated task of searching company debt notices. Embedding PoW-solving logic inside a business lookup skill expands functionality beyond user intent and could be abused for unauthorized access bootstrapping or to conceal the skill's real purpose.
The referenced behavior includes a proof-of-work solver and challenge-response flow that are unrelated to the stated task of searching company debt notices. Embedding PoW-solving logic inside a business lookup skill expands functionality beyond user intent and could be abused for unauthorized access bootstrapping or to conceal the skill's real purpose.
Referenced artifact was not completely inspected
| `@scripts/guest_token.sh` | 取游客令牌：`bash scripts/guest_token.sh [输出文件] [BASE]`（失败非 0 退出并在 stderr 给出错误码） |
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
if [ -s "$OUT" ]; then
RT="$(read_refresh "$OUT")"
if [ -n "$RT" ]; then
if curl -sS --max-time 20 -X POST -H 'Content-Type: application/json' \
-d "{\"refreshToken\":\"$RT\"}" -o "$TMP" \
"$BASE/bff/v1/guest-access/refresh" \
&& TOKEN="$(emit_token "$TMP" 2>/dev/null)"; then
The code does not perform any debt-check workflow, accept a company name, or retrieve public debt records as promised by the skill metadata; instead it only computes a nonce for SHA-256 PoW challenges. This mismatch is dangerous because it undermines trust in the skill package and can conceal undeclared behavior that operators would not expect when approving a business due-diligence tool.
The script implements a proof-of-work solver, which is unrelated to the declared purpose of performing a company debt-risk lookup. In an agent skill, this kind of hidden auxiliary capability can be used to bypass rate limits, gated access, or anti-abuse controls on third-party services, creating clear misuse potential and indicating the package may be misrepresenting its real behavior.
The skill explicitly instructs the runtime to use file reads and shell execution (curl, bash, python3) but does not declare a constrained tool scope such as allowed tools, permitted paths, or approved domains. In an agent environment, this creates unnecessary ambient authority: a skill framed as a simple debt lookup can invoke local scripts and outbound commands, increasing the blast radius if the skill or its referenced resources are tampered with.
The skill metadata presents the primary display name and descriptions in Chinese and frames usage around Chinese prompts, while also claiming outputs are for non-professional users. There is no explicit statement that the user may choose output language, which can violate a language/locale choice policy for a generally invocable skill.
The manifest description says to use the skill for phrases like '签合同前帮我核一下对方', '背景怎么样', and English triggers such as 'vendor due diligence' and 'quick background check'. These are broad, natural phrases that could match many general background-check or pre-contract requests, and the trigger guidance does not include negative examples or clear scope limits beyond adjacent-skill routing.
The skill includes direct outbound curl examples and operational guidance for contacting external endpoints to fetch metadata, challenge state, and create guest access. In context, this means the skill is designed to transmit runtime-originated data to a remote service and bootstrap access tokens, which is more sensitive than a read-only local formatting skill and increases data-exfiltration and abuse risk if endpoint control or references are compromised.
curl -s $BASE/.well-known/oauth-protected-resource | grep -qE '"public_create"[[:space:]]*:[[:space:]]*true' \
&& echo "元数据 OK (公开通道已开启)" # 注意: 响应是紧凑 JSON, 冒号后可能无空格
# 2) PoW 挑战端点应可达
curl -s -o /dev/null -w "challenge=%{http_code}\n" $BASE/bff/v1/guest-access/challenge
# 期望: 200；若为 404 说明 GUEST_PUBLIC_CREATE_ENABLED=false
# 3) 免凭据创建必须被要求 PoW（准入校验生效）
curl -s -X POST $BASE/bff/v1/guest-access -H 'Content-Type: application/json' -d '{"source":"web"}'
The entire skill reference is written only in Chinese and does not indicate that another language may be used or that Chinese is required for a specific regional or compliance reason. Under the policy, imposing a specific language without user opt-in is a natural-language policy concern.
The entire skill file is written in Chinese and does not indicate that other languages are supported or that the user may choose their preferred language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# ④ MCP 三步握手
# ④a initialize —— 从响应头取 Mcp-Session-Id，后续请求都要带
curl -s -D "$CACHE/h.txt" -o "$CACHE/init.txt" -X POST "$BASE/mcp/debt/stream" \
-H "Authorization: Bearer $GUEST_TOKEN" -H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"debtop-skill","version":"1.0"}}}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"debtop-skill","version":"1.0"}}}'
SID=$(grep -i '^mcp-session-id:' "$CACHE/h.txt" | awk '{print $2}' | tr -d '\r')
# ④b notifications/initialized（200/202 即成功）
curl -s -o /dev/null -w "initialized=%{http_code}\n" -X POST "$BASE/mcp/debt/stream" \
-H "Authorization: Bearer $GUEST_TOKEN" -H "Mcp-Session-Id: $SID" \
-H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","method":"notifications/initialized"}'
The file title and all user-facing documentation are written exclusively in Chinese, and there is no indication that the user may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The script's natural-language comments and stderr messages are entirely in Chinese, including operational guidance and dependency/error output. This imposes a specific language on users without any opt-in, language selection, or documented justification for a Chinese-only locale.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# 只收紧"已存在的普通文件"; 符号链接与特殊文件跳过, 避免改到别处的目标
secure_file() {
if [ -f "$1" ] && [ ! -L "$1" ]; then
chmod 600 "$1" 2>/dev/null || true
fi
}
secure_file "$OUT"
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# 只收紧"已存在的普通文件"; 符号链接与特殊文件跳过, 避免改到别处的目标
secure_file() {
if [ -f "$1" ] && [ ! -L "$1" ]; then
chmod 600 "$1" 2>/dev/null || true
fi
}
secure_file "$OUT"
The script sends a cached refresh token to a remote endpoint specified by the configurable BASE argument. Because refresh tokens are bearer credentials, allowing an untrusted or attacker-controlled BASE can exfiltrate secrets to a third party and enable unauthorized reuse of the guest session.
if [ -s "$OUT" ]; then
RT="$(read_refresh "$OUT")"
if [ -n "$RT" ]; then
if curl -sS --max-time 20 -X POST -H 'Content-Type: application/json' \
-d "{\"refreshToken\":\"$RT\"}" -o "$TMP" \
"$BASE/bff/v1/guest-access/refresh" \
&& TOKEN="$(emit_token "$TMP" 2>/dev/null)"; then
The script transmits a stable device fingerprint, skill identifiers, and proof-of-work response to a remote service. While this is expected for the feature, the configurable BASE parameter means this identifying data could be sent to an unintended host, creating privacy leakage and endpoint-confusion risk.
NONCE="$(python3 "$DIR/pow_solve.py" "$CH" "$DIFF")"
# ⑤ 创建游客（source 固定 "web" 是公开通道的要求；挑战一次性，重复提交会被拒）
curl -sS --max-time 20 -X POST "$BASE/bff/v1/guest-access" \
-H 'Content-Type: application/json' \
-d "{\"source\":\"web\",\"skillId\":\"$SKILL_ID\",\"skillCode\":\"$SKILL_CODE\",\"deviceFingerprint\":\"$FP\",\"pow\":{\"challenge\":\"$CH\",\"nonce\":\"$NONCE\"}}" \
-o "$TMP"
This reference document forces a specific language/locale for all users without offering an alternative or documenting that the skill is intentionally region- or language-specific. Under the policy, language constraints should be opt-in or clearly justified.
The module docstring and CLI usage/help text are presented only in Chinese, which is a natural-language locale choice embedded in the skill. Under the policy rule, forcing a specific language without user opt-in or a documented region-specific justification is a violation.
No suspicious patterns detected.