T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/footprints.py:38- Finding
Bearer Token and Private Collection Data Can Be Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
url-manager
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent hosted URL manager, but it creates and persists credentials, sends data to a remote service, can emit reusable magic links, and includes an unpinned remote recovery install path that needs review before use.
Install only if you are comfortable with a hosted service creating an agent account, storing your saved URLs and metadata on ai.ocean94.com, and keeping a local bearer token. Avoid the fallback git-clone install path unless it is pinned and verified, do not use plaintext HTTP endpoints with real tokens, and treat generated magic links as secrets.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T03 · Remote Payload Retrieval and Execution
Warning
- Location
SKILL.md:37- Finding
Unpinned Remote Script Retrieval Allows the Reviewed Payload to Be Replaced
- Content
View full analysis
" --title "" ``` 7. The substituted Python payload executes with the permissions and environment ...[truncated 757 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (21)
Tainted flow: 'req' from os.environ.get (line 107, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python headers["Content-Type"] = "application/json" req = urllib.request.Request(url, data=body, headers=headers, method=method) try: with urllib.request.urlopen(req, timeout=15) as resp: return json.loads(resp.read()) except urllib.error.HTTPError as e: err_body = e.read().decode()
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **Zero setup — token auto-management.** The `footprints.py` script handles everything: reads `{baseDir}/.token`, auto-registers on first use, stores token local
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The skill instructs cloning code from a remote repository and then recursively deleting a path with rm -rf /tmp/um. Although the path is specific, combining remote code retrieval, shell execution, and destructive filesystem operations in a skill increases operational risk if the path is altered, interpolated, or copied incorrectly in another environment.
- Content
mkdir -p {baseDir}/scripts cp /tmp/um/scripts/footprints.py {baseDir}/scripts/ chmod +x {baseDir}/scripts/footprints.py rm -rf /tmp/um
text After that, all commands below work as normal. The script auto-registers on first run.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The skill instructs cloning code from a remote repository and then recursively deleting a path with rm -rf /tmp/um. Although the path is specific, combining remote code retrieval, shell execution, and destructive filesystem operations in a skill increases operational risk if the path is altered, interpolated, or copied incorrectly in another environment.
- Content
mkdir -p {baseDir}/scripts cp /tmp/um/scripts/footprints.py {baseDir}/scripts/ chmod +x {baseDir}/scripts/footprints.py rm -rf /tmp/um
text After that, all commands below work as normal. The script auto-registers on first run.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill declares broad capabilities including shell, file write, network, and environment access but does not constrain them with an explicit permission or allowed-tools policy. In an agent setting, that increases the blast radius of any prompt injection, misuse, or user confusion because the skill can invoke powerful operations beyond its core bookmark-management purpose.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description uses broad trigger phrases like save, bookmark, collect, and remember this, which could cause the skill to activate during ordinary conversation rather than only on clearly scoped requests. Over-broad invocation increases the chance that user content is sent to the remote backend unintentionally, especially because the skill also auto-registers accounts and stores data externally.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
The instruction 'Just run any command and it works' encourages unconstrained execution of a script that performs network registration, token storage, and remote data operations. In an agent environment, this weakens safety expectations and can normalize executing actions without validating parameters, user intent, or tool scope.
- Content
md ## How to Use **Zero setup — token auto-management.** The `footprints.py` script handles everything: reads `{baseDir}/.token`, auto-registers on first use, stores token locally with `chmod 600`. Just run any command and it works. All commands via `python {baseDir}/scripts/footprints.py <subcommand> [--json]`. Add `--json` for machine-parseable output.
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## How to Use **Zero setup — token auto-management.** The `footprints.py` script handles everything: reads `{baseDir}/.token`, auto-registers on first use, stores token locally with `chmod 600`. Just run any command and it works. All commands via `python {baseDir}/scripts/footprints.py <subcommand> [--json]`. Add `--json` for machine-parseable output.
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## How to Use **Zero setup — token auto-management.** The `footprints.py` script handles everything: reads `{baseDir}/.token`, auto-registers on first use, stores token locally with `chmod 600`. Just run any command and it works. All commands via `python {baseDir}/scripts/footprints.py <subcommand> [--json]`. Add `--json` for machine-parseable output.
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to auto-register an account and store user-provided URLs and related metadata on a third-party service with zero setup. This is dangerous because it enables external data exfiltration and account creation without explicit, informed opt-in, and the skill's broad activation language makes accidental collection more likely.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow promotes sending a long-lived, reusable magic link to access stored collections. Such links function as bearer secrets; if forwarded, logged, or exposed in chat history, they may grant unintended access to a user's saved data without additional authentication.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guidelines explicitly direct the agent to auto-register silently and avoid interrupting the user for account setup while using a remote backend. Silent account creation and remote storage undermine informed consent and increase the chance of unauthorized transmission of user data to an external service.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill includes capabilities to autonomously register agent accounts and generate authentication magic links, which exceed the stated URL bookmarking purpose and introduce account-access functionality. In an agent context, this can enable silent account creation or credentialed session handoff without clear user awareness, broadening the blast radius if the skill is misused.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script states that it will automatically register and store a token with no human intervention, then persists that token locally. Silent credential creation and storage can surprise users and leave durable auth material on disk, especially problematic in shared workspaces or agent-executed environments.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The automatic registration flow creates accounts and persists tokens without an explicit approval step, which is risky for a bookmarking tool. This can cause unintended identity creation and persistent authentication state, making later API actions occur under silently established credentials.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
python return "" def _raw_api(path, method="GET", data=None, no_auth=False): """底层 HTTP 调用（不依赖 _get_token，避免循环）""" token = os.environ.get("FOOTPRINTS_TOKEN", "") url = f"{ENDPOINT.rstrip('/')}/api/v1/agent{path}"
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
python return "" def _raw_api(path, method="GET", data=None, no_auth=False): """底层 HTTP 调用（不依赖 _get_token，避免循环）""" token = os.environ.get("FOOTPRINTS_TOKEN", "") url = f"{ENDPOINT.rstrip('/')}/api/v1/agent{path}"
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
python err = {"error": "无法获取 Token — 自动注册失败，请检查网络连接"} _output(err) return err return _raw_api(path, method=method, data=data, no_auth=no_auth) # ── 用户 ──
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The magic-link function prints a one-time login URL directly to output without a strong safety barrier. If logs, transcripts, or downstream tools capture that URL, anyone with access to the output may be able to authenticate as the user during the validity window.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The documentation presents shared category modes as "Cocreate (共建)" and "Subscribe (订阅)," introducing a specific non-user-selected locale in user-facing terminology. The file does not state that the skill is region-specific or offer a language/locale choice, which can conflict with language neutrality expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The natural-language instructions, usage notes, and operational messages are presented exclusively in Chinese, which imposes a language choice on users without offering an alternative or opt-in. This matches the policy category for language or locale constraints that are not explicitly optional or justified.
- Content
Static analysis
No suspicious patterns detected.