T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lafeitu_client.py:74- Finding
Passwords Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Lafeitu (辣匪兔) Spicy Food
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Lafeitu shopping skill, but it handles account credentials and order/profile actions with security weaknesses users should review before installing.
Install only if you are comfortable with an agent managing a Lafeitu account, cart, profile data, and order creation. Avoid entering real passwords in command-line arguments or examples because they may appear in shell history, process lists, or logs; prefer the website flow or a safer secret-input mechanism, and use logout/delete credentials when finished.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lib/commerce_client.py:73- Finding
Custom Authentication Headers May Leak Across Cross-Origin Redirects
- Content
View full analysis
Dict[str, Any]: url = f"{self.base_url}{path}" try: response = self.session.request(method, url, timeout=10, **kwargs) return self._handle_response(response) except Exception as e: return {"success": False, "error": f"Connection error: {str(e)}"} ``` ### Technical Analysis The `requests` library follows redirects by default. It provides special handling for standard authorization mechanisms, but this client stores credentials in application-specific headers named `x-user-account` and `x-api-token`. The implementation does not: - Disable redirects for authenticated requests - Validate the origin of each redirect target - Remove custom authentication headers before a cross-origin redirect - Restrict the final response URL to `https://lafeitu.cn` The initial endpoint is correctly fixed to HTTPS on `lafeitu.cn`, which prevents users from directly selecting an attacker-controlled destination. However, that restriction does not by itself protect custom session headers if the official service returns a redirect to another origin. Exploitation therefore depends on a compromised or misconfigured API, or an open-redirect condition affecting an API route. Because the authentication values are session-level heade ...[truncated 1557 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 68% confidence
- Finding
The README advertises account flows, cart management, and order creation, which implies session or credential persistence for continued authenticated use. In a commerce skill, persistent authenticated context increases exposure if local credential storage, token reuse, or session handling is insufficiently controlled, especially because the skill can perform account-linked and purchase-preparation actions.
- Content
md # Lafeitu Gourmet Skill A brand-specific commerce skill for Lafeitu (辣匪兔). This project gives agents a structured way to browse products, manage carts, handle account flows, and create orders against the official `https://lafeitu.cn/api/v1` backend, while leaving final payment to the user. Official Website: https://lafeitu.cn clawhub: https://clawhub.com/NowLoadY/agentic-spicy-food
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README describes account-bound and state-changing actions such as login, registration, profile updates, cart modification, and order creation without clearly warning that these operations can alter user account data or create purchase-ready orders. In an agentic commerce context, missing user-consent and side-effect warnings increase the risk of unintended or unauthorized actions being triggered by an assistant.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill invokes python scripts, accesses a credentials path under the user's home directory, and calls a remote API, but it declares no explicit tool or permission scope. That creates an overbroad execution surface where an agent may use shell, filesystem, and network capabilities without clear restriction or user visibility, increasing the chance of unintended sensitive data access or unsafe command execution.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
The skill is designed for authenticated commerce workflows including cart management, profile updates, order history, and order creation, which inherently rely on persistent session state. In this context, session persistence increases risk because stale or silently reused authentication could let later prompts or users act on a prior user's account, especially in multi-user or long-lived agent environments.
- Content
md - inspect variants, pricing, promotions, or shipping thresholds - manage a Lafeitu cart - log in, register, or update Lafeitu profile data - create a Lafeitu order and hand payment back to the user - retrieve official Lafeitu brand, company, or contact information ## Tool Priority & Fallback Strategy
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that credentials are stored locally under a fixed path, but it does not warn the user, describe protection measures, or limit retention. Because the skill also handles login, registration, profile, and order flows, this local token storage could expose authentication material to other local processes, users, or overly capable agents if the directory permissions are weak or the environment is shared.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file contains multiple user-facing descriptions and outputs exclusively in Chinese, including comments describing the tool, CLI help text, and runtime messages such as cart and product displays. There is no indication that the user can choose a language or that the Chinese-only behavior is a documented, justified locale restriction, which creates a natural-language locale policy concern.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a brand-specific skill for Lafeitu's official API, but the class is documented and implemented as a universal commerce client with per-domain credential storage and multi-merchant isolation. That broader behavior meaningfully exceeds the stated single-brand scope rather than being a necessary implementation detail of a Lafeitu-only skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The get_api_token method posts account and password to obtain a token, but there is no visible warning, confirmation, or explanatory disclosure in the code about sending credentials over the network. This is a safety-critical operation involving sensitive authentication data.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest says the skill is for browsing, recommending, carting, ordering, and handling account/profile/promotion/brand information. This file additionally implements sending verification codes and registering new accounts, which are distinct account-creation capabilities not clearly covered by the stated description.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The register method transmits email, password, name, verification code, invite code, and visitor ID to a remote endpoint. Although this behavior may be functionally necessary, the code provides no visible user disclosure, confirmation, or warning that sensitive identity and credential data will be sent and stored.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The update_profile method sends arbitrary profile data over the network, which may include personal information, but there is no confirmation prompt, logging, or explanatory comment/docstring warning that user data will be transmitted. For this file-level review, the operation is safety-relevant because it affects user privacy and lacks visible disclosure in the code.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring explicitly states the formatters are 'Chinese-localized' with 'Mandarin display labels' and defaults to Chinese currency conventions. This creates a language/locale constraint in natural-language behavior without any visible user opt-in or alternative locale handling in the file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 0% confidence
- Finding
No actionable SQP-3 finding was identified. The file includes bilingual content rather than imposing a single language without opt-in.
- Content
Static analysis
No suspicious patterns detected.