技能大赛全流程备赛助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Chinese contest-prep assistant, but its backend instructions expose reusable Dify API keys and route user content through a plaintext HTTP endpoint.

Review before installing. The skill appears intended for competition preparation, but do not use the documented Dify backend as published: rotate the exposed keys, replace them with user-provided secrets, require HTTPS, and clearly disclose when user materials will be sent to a remote service.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/call-dify-workflow.md:30

Finding

Hardcoded Dify Workflow API Credentials

Content

View full analysis

Vulnerability Details

File Location: scripts/call-dify-workflow.md:30-35
Vulnerability Type: Hardcoded API credentials
Risk Level: High

Vulnerable Code

The following API keys are embedded directly in the distributed workflow documentation:

text

Workflow 01: app-ij16kVlWSBo4tibxh0fXuRod
Workflow 02: app-qPkxVCM2IpzgQHedkrU7XdjZ
Workflow 03: app-JgNEhHO22EuxoJ6xsN8H0YSS
Workflow 04: app-jkqO3Tn6FDR15z7zieQf2sho

Technical Analysis

Four Dify Workflow API keys are stored in plaintext inside the project package. Anyone who can download, clone, inspect, archive, or otherwise access the Skill can recover these credentials without authentication.

The documentation identifies the keys as development-environment credentials and acknowledges that API keys should not be hardcoded. This warning does not protect the exposed values. Their current validity and exact permissions cannot be established through static analysis, but they must be treated as compromised secrets.

If valid, an attacker can use the keys outside the intended Skill and submit requests directly to the associated Dify workflows. Any authorization, quotas, data access, or billable operations attached to the keys would be available to the attacker.

Attack Path

1. An attacker obtains a copy of the Skill package or repository.
2. The attacker opens scripts/call-dify-workflow.md.
3. The attacker extracts the four plaintext API keys.
4. The attacker constructs requests for the documented Dify Workflow API.
5. The attacker invokes workflows under the application identities represented by the exposed keys.
6. The attacker may consume service resources, exhaust quotas, submit malicious workflow inputs, or access workflow capabilities permitted to those credentials.

Impact Assessment

Exploitation does not grant local operating-system privileges based on the reviewed files. The affected scope is the remote Dify environme ...[truncated 500 chars]

Remediation

View remediation

Remediation Suggestions

1. Revoke and rotate all four exposed API keys immediately; removing them from the current file is insufficient because copies may already exist.
2. Remove the credentials from the project package, repository history, release archives, logs, and documentation.
3. Obtain credentials at runtime from an approved secret manager or protected environment variables.
4. Do not place secrets in command-line arguments, generated documentation, frontend configuration, or other locations visible to untrusted users.
5. Assign a separate credential to each workflow and environment.
6. Apply least-privilege permissions, restrictive quotas, expiration dates, and source restrictions where supported.
7. Audit Dify access logs for unexpected calls made with the exposed keys.
8. Add automated secret scanning to pre-commit and continuous-integration checks.
9. Ensure examples use nonfunctional placeholders such as DIFY_API_KEY, never realistic secret values.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/call-dify-workflow.md:23

Finding

Workflow Credentials and User Content Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: scripts/call-dify-workflow.md:23-26; related input definitions at SKILL.md:255-261
Vulnerability Type: Unencrypted transmission of credentials and potentially sensitive workflow data
Risk Level: High

Vulnerable Code

text

Dify Base URL: http://221.226.121.194:8088/v1
Response mode: blocking

The backend inputs defined in SKILL.md:255-261 include:

text

competition_type
project_keyword
reference_text
selected_option
project_plan
duration_minutes
team_size
ppt_outline
script_content
team_members

Technical Analysis

The documented Dify endpoint uses plaintext HTTP rather than HTTPS. HTTP provides neither transport confidentiality nor cryptographic server authentication. Requests to this endpoint can therefore be observed or modified by an attacker with a suitable network position.

Workflow calls would need to authenticate using the documented API keys. Those credentials, along with user-provided reference material, complete project plans, presentation outlines, demonstration scripts, and team information, may consequently cross the network without encryption.

The use of a raw IP address also provides no hostname-based identity assurance. An attacker who controls a network gateway, proxy, wireless access point, DNS-independent route, or another intermediary can intercept or redirect the connection.

Because the Skill uses a chained workflow in which earlier outputs become later inputs, tampering with a response can also influence subsequent generated content.

Attack Path

1. A user or Agent follows the backend-integration instructions.
2. It sends an authenticated request to http://221.226.121.194:8088/v1.
3. A network-positioned attacker captures the plaintext connection.
4. The attacker reads the API credential and submitted workflow content.
5. The attacker can replay the recovered credential in independent req ...[truncated 1080 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the HTTP endpoint with HTTPS on an organization-controlled hostname.
2. Configure a valid certificate issued by a trusted authority and enforce certificate and hostname verification.
3. Reject plaintext HTTP connections and disable automatic downgrade or insecure fallback behavior.
4. Rotate all credentials that may have been transmitted through the plaintext endpoint.
5. Minimize transmitted data and exclude unnecessary personal, proprietary, or competition-sensitive information.
6. Clearly disclose remote processing and obtain appropriate authorization before uploading user-provided reference material.
7. Add request timeouts, response-size limits, and strict response-schema validation.
8. Treat remote workflow output as untrusted data and validate it before using it as input to subsequent workflow stages.
9. Use short-lived, narrowly scoped credentials and apply replay protections where supported.
10. Monitor the endpoint for interception indicators, unexpected clients, credential reuse, and anomalous workflow invocation volume.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document exposes a concrete external service endpoint and multiple live-looking workflow API keys, which are credentials that can be reused by anyone with access to the file. Even though the skill is for contest preparation, these secrets enable unauthorized network access to backend workflows, possible abuse of paid resources, data exfiltration through prompts, and pivoting beyond the skill’s intended local assistant scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Publishing a live API endpoint together with API keys in markdown creates a directly actionable abuse path for any reader, without sufficient protection against unintended use. In this skill context, the documented networked capability is more dangerous because a seemingly benign contest-prep assistant now carries reusable credentials to external automation workflows, expanding risk from content generation to backend service misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill metadata and content assume Chinese-language operation without offering language negotiation or clearly documenting that the skill is intentionally locale-specific. If auto-invoked for non-Chinese users, this can cause misalignment, misunderstood instructions, or inaccessible outputs, especially when combined with the broad trigger behavior in this file.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger keywords are broad, generic terms such as '参赛', '备赛', and '训练计划', which can match many ordinary educational or conversational contexts unrelated to this specialized skill. This can cause unintended activation and prompt-context takeover, leading the assistant to apply restrictive competition-prep behavior when the user did not request it, reducing reliability and potentially steering outputs inappropriately.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire document is written in Chinese and presents the competition rules as fixed-language content without offering any language or locale choice. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file explicitly acknowledges that API keys should not be hardcoded, yet it includes hardcoded keys in the same section. This contradiction strongly indicates insecure secret-handling practices and increases the likelihood that real credentials were committed and may already be exposed to unauthorized users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file is entirely framed as a Chinese-only output template, beginning with a Chinese title and using Chinese instructions throughout. Because the template does not provide any language choice, opt-in, or justification for a locale restriction, it creates a natural-language policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.