Security audit

ducc-helper

Security checks for vulnerabilities and agentic risk

Overview

This DUCC helper is mostly purpose-aligned, but it needs Review because it can use local JD authentication to read, change, and publish production configuration while showing concrete credential-handling and scoping risks.

Install only in an environment where the agent is allowed to use your local JingME/JD login to access DUCC. Treat all read output as potentially sensitive, avoid running lib/jme_auth.py directly because it prints the cookie, prefer explicit user confirmation before any set/update/delete as well as release, and review the HTTP credential transport and dependency pinning before using this for production configuration.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill exposes powerful capabilities including local token acquisition, network access, file read/write, and shell execution, yet does not declare permissions or constrain their use. In this context, the skill can modify and publish production configuration through DUCC, so undeclared capabilities reduce transparency and increase the risk of unintended or unsafe execution by an agent.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The gray-release path claims to honor a user-supplied orchestration template code, but the actual release request hardcodes orchestrateCode to 1. In a configuration publishing tool, this can silently bypass the intended rollout plan and release to the wrong batch strategy, causing unexpected broad exposure or unsafe deployment behavior in production.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation text is intentionally broad, instructing the agent to invoke the skill whenever DUCC-related terms are mentioned, even if the user did not explicitly request the skill. Because this skill can read, modify, and publish configuration, over-triggering raises the chance of accidental access to sensitive config data or unintended draft changes in response to ambiguous requests.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The client sends an SSO authentication cookie to endpoints defined with plain HTTP URLs (`pserve.jd.com` and proxy targets), which exposes the session token to interception or modification by anyone with network visibility. In a skill whose core purpose is reading and modifying DUCC configuration, theft of that cookie could enable unauthorized config reads, writes, or production publishes.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The module caches reusable me_token and sso_token authentication material on disk in the user's home directory. Although file mode 600 is applied, these tokens remain accessible to local processes running as the same user and can be stolen from backups, shell access, malware, or accidental file disclosure, enabling reuse against internal services.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script prints the full sso.jd.com cookie value to stdout, which makes a live reusable authentication secret easy to leak into terminal scrollback, logs, shell history capture, CI output, agent transcripts, or other monitoring systems. Anyone who obtains that cookie may be able to impersonate the user to internal JD services until expiry.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This documentation gives step-by-step instructions for modifying, deleting, and publishing DUCC configuration, including production routing headers and rollout procedures, but does not prominently require explicit human confirmation, environment gating, or production safety checks at the point of use. In the context of an agent skill that is designed to perform these actions automatically with zero-config authentication, this materially increases the risk of unintended or unauthorized production changes, outages, and harmful config rollout by the agent or a prompt-injecting user.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The get command fetches a configuration item and prints its raw value directly to output. In a configuration-management skill, those values can include secrets such as API keys, database passwords, or tokens, so exposing them to the agent/user channel materially increases the risk of credential disclosure and downstream compromise.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.25.0
Confidence: 95% confidence
Finding: The dependency is specified as `requests>=2.25.0`, which is unpinned and permits installation of a wide range of versions depending on resolver behavior and environment state. In a security-sensitive skill that can read, modify, and publish DUCC configuration, this increases supply-chain risk and reduces build reproducibility, making it easier for vulnerable or unexpected versions to be deployed unnoticed.

Known Vulnerable Dependency: requests==2.25.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

Category: Supply Chain
Confidence: 88% confidence
Finding: The version range `requests>=2.25.0` includes `requests==2.25.0`, which has multiple known security advisories. Because this skill performs authenticated operations against internal configuration systems and may handle sensitive URLs, credentials, and network requests, allowing installation of a known-vulnerable Requests version can expose tokens, bypass expected verification behavior, or otherwise compromise DUCC configuration access.

Static analysis

No suspicious patterns detected.