T09 · Insecure Skill Coding Practices
Error
- Location
scripts/api_call.py:18- Finding
Credentials Can Be Transmitted over Insecure HTTP or Forwarded Across Redirect Boundaries
- Content
View full analysis
- Remediation
View remediation
Security audit
api-caller
Security checks for vulnerabilities and agentic risk
Overview
This skill is a real REST API helper, but it also includes under-scoped local persistence and credential-handling risks that users should review before installing.
Install only if you are comfortable reviewing or editing the scripts first. Use HTTPS-only API URLs, avoid passing highly privileged tokens, avoid running the learner with directories outside this skill, and avoid putting secrets or sensitive API details in learner notes because they are stored locally in plaintext.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/api_call.py:79- Finding
Unredacted API Response Data Is Written to Terminal and Automation Logs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
This finding describes a more severe description-behavior mismatch: the skill is presented as an API caller but reportedly does not implement the declared API functionality and instead introduces unrelated local learning and persistence behavior. That can mislead operators about what data is being stored locally and why, creating privacy, audit, and trust risks—especially when persistence is outside the user’s expected workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding describes a more severe description-behavior mismatch: the skill is presented as an API caller but reportedly does not implement the declared API functionality and instead introduces unrelated local learning and persistence behavior. That can mislead operators about what data is being stored locally and why, creating privacy, audit, and trust risks—especially when persistence is outside the user’s expected workflow.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file implements a generic persistence and self-learning subsystem that is unrelated to the declared REST API helper purpose of the skill. In a skill ecosystem, this kind of hidden capability expansion is dangerous because it increases the attack surface and can normalize data collection or behavior outside user expectations, especially when paired with filesystem writes and cross-skill directory targeting.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill advertises and instructs use of network access, environment-injected secrets, and file output, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and governance gap: downstream systems or reviewers cannot clearly constrain or audit what capabilities the skill is expected to use, increasing the chance of over-privileged execution or accidental secret exposure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says the skill should be called when the user needs phrases like "调用接口", "拉取 API 数据", "对接某开放平台", or "写个请求脚本". Several of these, especially "写个请求脚本", are broad everyday task descriptions and the file provides no negative examples or scope constraints to distinguish when this skill should or should not activate.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest description is entirely in Chinese and presents the skill as a Chinese-language interface without indicating that the user may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash python scripts/api_call.py \ --method GET \ --url "https://api.example.com/v1/data" \ --header "Authorization: Bearer $API_TOKEN" \ --retry 3 --timeout 30 \ --out result.json
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module description, usage text, and user-facing output strings are written exclusively in Chinese, which imposes a specific language/locale by default. The file does not indicate that the language is optional, configurable, or justified as a region-specific tool.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The resolver accepts either an arbitrary directory path or a skill name mapped under ~/.workbuddy/skills, allowing this script to read and write learning data for other skills. That cross-skill filesystem reach breaks least privilege and could be abused to create, overwrite, or influence metadata in unrelated skill directories, especially if invoked by another component with untrusted input.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code persistently stores usage history, errors, notes, and preferences to disk, even though that behavior is not justified by the advertised API-caller functionality. This creates a privacy and data-retention risk because free-form notes and preferences may contain sensitive API details, tokens, endpoint data, or user operational context that can later be read by other processes or users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script writes user preferences and operation notes to learned_patterns.json without any explicit warning or consent mechanism. This is dangerous because notes are free text and may unintentionally capture credentials, personal data, incident details, or proprietary API information, creating silent local data collection outside the user's expectation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
SQP-3 applies to all file types and includes language or locale policy violations. This file presents its module docstring entirely in Chinese, which can force a specific language on users without any opt-in or alternative.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The argparse help strings for multiple options are written only in Chinese. This imposes a specific language on users and matches the policy category for forced language/locale behavior when no choice is offered.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The success and failure messages printed to stdout/stderr are Chinese-only. Because the script does not offer a user-selectable language or document a justified locale restriction, this is a natural-language policy concern.
- Content