T09 · Insecure Skill Coding Practices
Warning
- Location
summarize.py:67- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
智能摘要
Security checks for vulnerabilities and agentic risk
Overview
This is a straightforward summarization skill, but its unrestricted URL fetching should be reviewed before use in network-sensitive environments.
Install only in environments where arbitrary outbound HTTP(S) requests are acceptable. Avoid using --url on untrusted prompts or links when the runtime can reach internal services, and avoid summarizing confidential local files unless you trust the execution environment and its logs/output handling.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises capabilities to read local files and fetch remote webpages, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent or runtime may grant broader-than-necessary access, increasing the risk of unintended file access or network retrieval in a context that can process sensitive data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill encourages summarizing local documents and fetched webpages but does not warn users that the processed content may contain private, regulated, or otherwise sensitive information. This can lead to accidental exposure of confidential data to the summarization pipeline, logs, downstream models, or remote fetch components without informed user consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code hard-codes a specific output encoding and presents descriptions/messages in Chinese, which constitutes a language/locale constraint with no user opt-in or documented justification. The policy allows locale constraints only when user choice is offered or the constraint is clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest and user-facing instructions are written entirely in Chinese, while the capability list says the skill supports both Chinese and English. There is no explicit language choice or opt-in mechanism, so the default presentation may impose a specific language/locale on users.
- Content