Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently performs read-only public debt notice screening, with clearly disclosed guest access, token caching, and rate limits.
Before installing, confirm you are comfortable with the guest fallback creating and caching a short-lived service token under ~/.cache/debtop and making outbound HTTPS calls to agent.debtop.com. Prefer a configured MCP/OAuth connector when available; do not use the helper scripts with an untrusted BASE endpoint.
The skill claims to screen and aggregate debt notices, yet the embedded scripts and references include a generic PoW-solving capability unrelated to debt screening. Undeclared computational or authentication-bypass-adjacent helpers are risky because they can be repurposed, consume resources, and obscure what the skill is truly doing during execution.
The skill claims to screen and aggregate debt notices, yet the embedded scripts and references include a generic PoW-solving capability unrelated to debt screening. Undeclared computational or authentication-bypass-adjacent helpers are risky because they can be repurposed, consume resources, and obscure what the skill is truly doing during execution.
The skill claims to screen and aggregate debt notices, yet the embedded scripts and references include a generic PoW-solving capability unrelated to debt screening. Undeclared computational or authentication-bypass-adjacent helpers are risky because they can be repurposed, consume resources, and obscure what the skill is truly doing during execution.
Referenced artifact was not completely inspected
| `@scripts/guest_token.sh` | 取游客令牌：`bash scripts/guest_token.sh [输出文件] [BASE]`（失败非 0 退出并在 stderr 给出错误码） |
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
if [ -s "$OUT" ]; then
RT="$(read_refresh "$OUT")"
if [ -n "$RT" ]; then
if curl -sS --max-time 20 -X POST -H 'Content-Type: application/json' \
-d "{\"refreshToken\":\"$RT\"}" -o "$TMP" \
"$BASE/bff/v1/guest-access/refresh" \
&& TOKEN="$(emit_token "$TMP" 2>/dev/null)"; then
This script implements a proof-of-work challenge solver, which is unrelated to the stated purpose of a read-only public debt-screening skill. Unrelated capability that helps bypass access-friction or anti-abuse controls is suspicious because it can be used to automate access to gated endpoints and support scraping at scale beyond the declared behavior.
The skill explicitly instructs the agent to read local package files and execute shell/Python scripts (curl, bash, python3) but does not declare a restrictive tool scope such as allowed tools or permissions. That increases the blast radius of prompt-driven behavior and makes it easier for the skill to trigger unintended local file access or command execution beyond its advertised read-only debt-screening purpose.
The primary skill title and body instructions are written in Chinese and explicitly define the output/reporting format in Chinese, while the operational guidance does not state that users may choose their preferred language. Under the policy, forcing a specific language without opt-in is a natural-language locale violation unless a justified region-specific constraint is documented.
The skill contains explicit curl commands that transmit data to an external domain and encourages runtime interaction with remote guest-access and challenge endpoints. Even though this appears intended for legitimate service access, it is still an external transmission surface that can expose environment/network metadata, trigger account/token creation flows, and bypass platform-managed network controls if executed by an agent with shell access.
curl -s $BASE/.well-known/oauth-protected-resource | grep -qE '"public_create"[[:space:]]*:[[:space:]]*true' \
&& echo "元数据 OK (公开通道已开启)" # 注意: 响应是紧凑 JSON, 冒号后可能无空格
# 2) PoW 挑战端点应可达
curl -s -o /dev/null -w "challenge=%{http_code}\n" $BASE/bff/v1/guest-access/challenge
# 期望: 200；若为 404 说明 GUEST_PUBLIC_CREATE_ENABLED=false
# 3) 免凭据创建必须被要求 PoW（准入校验生效）
curl -s -X POST $BASE/bff/v1/guest-access -H 'Content-Type: application/json' -d '{"source":"web"}'
This markdown file contains user-facing operational guidance only in Chinese, which can constitute a language policy violation when no opt-in or alternative locale is provided. The file does not indicate that the skill is region-specific or that Chinese is an intentional, documented limitation.
This file presents all operational instructions, warnings, and examples exclusively in Chinese. That can violate a language/locale policy when users are not explicitly offered a language choice or told the skill is intentionally limited to a Chinese-language audience.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# ④ MCP 三步握手
# ④a initialize —— 从响应头取 Mcp-Session-Id，后续请求都要带
curl -s -D "$CACHE/h.txt" -o "$CACHE/init.txt" -X POST "$BASE/mcp/debt/stream" \
-H "Authorization: Bearer $GUEST_TOKEN" -H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"debtop-skill","version":"1.0"}}}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"debtop-skill","version":"1.0"}}}'
SID=$(grep -i '^mcp-session-id:' "$CACHE/h.txt" | awk '{print $2}' | tr -d '\r')
# ④b notifications/initialized（200/202 即成功）
curl -s -o /dev/null -w "initialized=%{http_code}\n" -X POST "$BASE/mcp/debt/stream" \
-H "Authorization: Bearer $GUEST_TOKEN" -H "Mcp-Session-Id: $SID" \
-H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","method":"notifications/initialized"}'
The entire skill file is written as Chinese-only operational documentation, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is documented and justified, which is not present here.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# 只收紧"已存在的普通文件"; 符号链接与特殊文件跳过, 避免改到别处的目标
secure_file() {
if [ -f "$1" ] && [ ! -L "$1" ]; then
chmod 600 "$1" 2>/dev/null || true
fi
}
secure_file "$OUT"
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# 只收紧"已存在的普通文件"; 符号链接与特殊文件跳过, 避免改到别处的目标
secure_file() {
if [ -f "$1" ] && [ ! -L "$1" ]; then
chmod 600 "$1" 2>/dev/null || true
fi
}
secure_file "$OUT"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if [ -s "$OUT" ]; then
RT="$(read_refresh "$OUT")"
if [ -n "$RT" ]; then
if curl -sS --max-time 20 -X POST -H 'Content-Type: application/json' \
-d "{\"refreshToken\":\"$RT\"}" -o "$TMP" \
"$BASE/bff/v1/guest-access/refresh" \
&& TOKEN="$(emit_token "$TMP" 2>/dev/null)"; then
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
NONCE="$(python3 "$DIR/pow_solve.py" "$CH" "$DIFF")"
# ⑤ 创建游客（source 固定 "web" 是公开通道的要求；挑战一次性，重复提交会被拒）
curl -sS --max-time 20 -X POST "$BASE/bff/v1/guest-access" \
-H 'Content-Type: application/json' \
-d "{\"source\":\"web\",\"skillId\":\"$SKILL_ID\",\"skillCode\":\"$SKILL_CODE\",\"deviceFingerprint\":\"$FP\",\"pow\":{\"challenge\":\"$CH\",\"nonce\":\"$NONCE\"}}" \
-o "$TMP"
Line L014 explicitly singles out Chinese product names as requiring a specific handling path. This is a natural-language locale-specific policy embedded in the documentation, and the file does not present it as an optional user choice or clearly justified region-specific constraint.
No suspicious patterns detected.