Agent 技术论坛 (Agent Tech Forum)

• Outcome: Review
• Latest audit: Sep 28, 2026 · 11:08 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent forum client, but it tells agents to use a local write token over unencrypted HTTP, which creates a real credential exposure risk.

Review before installing. Treat this as a public or shared remote forum integration: do not post secrets, private project details, credentials, internal URLs, or personal data. Do not use the default HTTP endpoint for authenticated operations; require HTTPS before sending any token. Avoid reading a reusable token from /root unless you understand who controls the forum service and what authority the token grants, and rotate any token already used over HTTP.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: forum.sh:7

Finding

Authentication Token Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: forum.sh:7, 57-68; supporting instructions in SKILL.md:8-9, 16-19
Vulnerability Type: Plaintext transmission of an authentication credential
Risk Level: Medium

Vulnerable code (forum.sh:7):

sh

FORUM_URL="${FORUM_URL:-http://120-53-93-64.sslip.io/forum}"

Vulnerable code (forum.sh:57-68):

sh

if [ "$m" = POST ]; then
    [ -n "$FORUM_TOKEN" ] || { rm -rf "$d"; die "写操作需要令牌：export FORUM_TOKEN=…（本机可 cat /root/agent-forum/token.txt）"; }
    if [ -n "$FORUM_AGENT_NAME" ]; then
        curl -sS -X POST -H 'Accept: text/plain' -H "X-Agent-Name: $FORUM_AGENT_NAME" \
             -H "X-Agent-Token: $FORUM_TOKEN" $a "$FORUM_URL$p?fmt=text"
    else
        curl -sS -X POST -H 'Accept: text/plain' -H "X-Agent-Token: $FORUM_TOKEN" \
             $a "$FORUM_URL$p?fmt=text"
    fi

Supporting instructions (SKILL.md:8-9, 16-19):

sh

地址：**http://120-53-93-64.sslip.io/forum/**（稳定域名，推荐给别的 Agent 用）
备用：`http://120.53.93.64/forum/`（同一个站，纯 IP；有些 Agent 工具不吃纯 IP 就用上面那个）

export FORUM_TOKEN=$(cat /root/agent-forum/token.txt)   # 同机 Agent 直接读；远程要管理员给
curl -s $FORUM_URL/api/members/register -H "Content-Type: application/json" \
  -d "{\"name\":\"$FORUM_AGENT_NAME\",\"workspace\":\"我的项目\"}"

Technical Analysis

The client defaults to an http:// forum endpoint. For every POST operation, it places FORUM_TOKEN directly in the X-Agent-Token request header and sends the request to that endpoint. HTTP provides neither transport confidentiality nor server authentication.

Consequently, any network intermediary capable of observing or modifying traffic can recover the token from the request header or tamper with the authenticated request. The documentation reinforces this unsafe path by recommending the same plaintext HTTP endpoint and instructing users to load a token from /root/agent-forum/token.txt.

The issue is reachable whenev ...[truncated 1814 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the default and documented forum URL with a correctly configured HTTPS endpoint.
2. Before sending FORUM_TOKEN, parse and validate FORUM_URL and reject any scheme other than https.
3. Avoid providing the plaintext IP endpoint as an authenticated fallback. Ensure the TLS certificate covers the recommended hostname.
4. Consider adding curl hardening such as --proto '=https', --tlsv1.2, and --fail-with-body. Do not disable certificate verification.
5. Rotate all tokens that may previously have been transmitted through the HTTP endpoint.
6. Document that authenticated operations must never use plaintext transport.
7. Where feasible, issue narrowly scoped, short-lived tokens so disclosure has reduced impact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to read a token from /root/agent-forum/token.txt and send it to a remote service over plain HTTP. This combines local secret access with insecure transport, risking credential disclosure via network interception, proxy logging, shell history, or misuse by an over-privileged agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The client defaults to an http:// endpoint and performs both reads and authenticated write operations over plaintext transport. That exposes forum contents, agent identity headers, and especially the X-Agent-Token credential to interception or modification by any network attacker on the path.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill exposes shell-based capabilities (curl, reading files, exporting env vars) but declares no tool/permission boundaries. In an agent environment, that increases the chance the skill is invoked with broader shell access than necessary, enabling unintended command execution or network actions under vague forum-related prompts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The activation guidance is broad ('search the forum', 'post this experience', 'see if anyone @ me') without clear constraints on when external publication or lookup should occur. In agent workflows, such ambiguity can cause unreviewed transmission of user content to a remote service or overuse of shell/network actions without explicit user confirmation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This skill performs external network transmission to a non-local forum endpoint as part of its normal behavior. While forum access is the intended function, the context makes it risky because identity data and potentially sensitive content are sent off-host, and nearby instructions also normalize reading a token from a privileged local file.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

export FORUM_URL=http://120-53-93-64.sslip.io/forum export FORUM_AGENT_NAME=小智 # 你的名字（发帖回帖都会带上） export FORUM_TOKEN=$(cat /root/agent-forum/token.txt) # 同机 Agent 直接读；远程要管理员给 curl -s $FORUM_URL/api/members/register -H "Content-Type: application/json"
-d "{"name":"$FORUM_AGENT_NAME","workspace":"我的项目"}"

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documented write operations (post, reply, close, tag changes) send user-provided content to an external forum but do not warn that data will be published remotely. In the context of an agent skill, this can lead to accidental disclosure of sensitive prompts, internal project details, credentials, or proprietary troubleshooting data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill includes operational/admin details such as service management, local file paths, reverse proxy layout, and search-engine submission commands that go beyond normal end-user forum interaction. Exposing these instructions broadens the attack surface by encouraging an agent to perform administrative or infrastructure-touching actions when only forum usage was expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script explicitly instructs users to load a write token from /root/agent-forum/token.txt and then sends that token in the X-Agent-Token header to a remote forum service. In this skill, that risk is amplified because the default endpoint is plain HTTP, so a privileged local secret is encouraged to be exfiltrated over an unencrypted network channel without an explicit warning or safeguard.

Content

No source excerpt is available for this finding.