raai-price-probe-noprice-20260421

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:02 AM UTC
• Version: 0.0.1

Overview

This is a coherent customer-support automation skill, but it needs Review because it encourages broad customer-data processing, CRM/ticket mutations, and automatic customer replies without enough scoping or approval controls.

Review this before installing in a real support environment. Use least-privilege credentials only for integrations you explicitly enable, avoid putting live secrets in config.yaml, require human approval for refunds, outbound customer messages, and CRM writes, and narrow triggers to deliberate commands or approved channels.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: build.sh:20

Finding

Configured Secrets Can Be Included in Release Archives

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:5

Finding

Skill Requests Credentials Beyond Its Implemented Requirements

Content

View full analysis

/dev/null || true echo "[✓] Файлы скопированы в $TARGET" # 3. Создать .env из шаблона если нет if [[ ! -f "$TARGET/.env" ]]; then cp "$SRC_DIR/.env.example" "$TARGET/.env" echo "[✓] Создан $TARGET/.env (заполнять только если нужны интеграции)" else echo "[i] $TARGET/.env уже существует — не перезаписываю" fi ``` ### Technical Analysis The Skill metadata declares both `ANTHROPIC_API_KEY` and `OPENAI_API_KEY` as mandatory and identifies several high-value integration credentials as optional. However, the audited project contains no code that directly consumes these values and no implementation for the advertised Telegram, CRM, Google Sheets, or webhook integrations. Its primary behavior consists of agent instructions, response templates, configuration, packaging, and validation scripts. Requiring both model-provider credentials exposes more authority to the Skill execution context than the demonstrated functionality needs. A deployment normally needs only the credential for the model provider selected by the host platform, and that credential should ideally be managed by the platform rather than exposed directly to Skill content. The installer also creates a local `.env` from a template, encouraging ...[truncated 1615 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (63)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is designed to process customer messages, CRM records, contact details, order history, sentiment, and support analytics, yet the description does not warn users that sensitive personal and business data will be transmitted across third-party APIs and integrations. This omission increases the risk of privacy violations, unsafe deployment, and noncompliance with internal policy or legal obligations.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger set contains broad generic phrases such as 'тикет', 'helpdesk', 'customer support', and other everyday support-related terms that can cause accidental invocation in unrelated conversations. Because this skill can categorize tickets, generate customer replies, and drive escalation workflows, unintended activation could expose customer data, create records, or send misleading automated responses.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Stating that the module activates on any incoming customer message creates an effectively universal trigger within connected channels. In a system with CRM access, ticket creation, sentiment-based escalation, and autoresponse behavior, such ambiguity can cause over-collection of customer data and autonomous actions without sufficient user intent or operator review.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 30)May include surrounding context.

sh

cp "$SRC_DIR/SKILL.md" "$SRC_DIR/config.yaml" "$SRC_DIR/README.md" "$SRC_DIR/install.sh" "$SRC_DIR/.env.example" "$TARGET/"
cp -r "$SRC_DIR/docs" "$SRC_DIR/examples" "$SRC_DIR/proof" "$SRC_DIR/test" "$TARGET/"
chmod +x "$TARGET/install.sh" "$TARGET/test/smoke-test.sh" 2>/dev/null || true
echo "[✓] Файлы скопированы в $TARGET" # 3. Создать .env из шаблона если нет
if [[ ! -f "$TARGET/.env" ]]; then cp "$SRC_DIR/.env.example" "$TARGET/.env" echo "[✓] Создан $TARGET/.env (заполнять только если нужны интеграции)"
else echo "[i] $TARGET/.env уже существует — не перезаписываю"
fi # 4. Напомнить про OBLIGATORY-поля

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 31)May include surrounding context.

sh

cp "$SRC_DIR/SKILL.md" "$SRC_DIR/config.yaml" "$SRC_DIR/README.md" "$SRC_DIR/install.sh" "$SRC_DIR/.env.example" "$TARGET/"
cp -r "$SRC_DIR/docs" "$SRC_DIR/examples" "$SRC_DIR/proof" "$SRC_DIR/test" "$TARGET/"
chmod +x "$TARGET/install.sh" "$TARGET/test/smoke-test.sh" 2>/dev/null || true
echo "[✓] Файлы скопированы в $TARGET" # 3. Создать .env из шаблона если нет
if [[ ! -f "$TARGET/.env" ]]; then cp "$SRC_DIR/.env.example" "$TARGET/.env" echo "[✓] Создан $TARGET/.env (заполнять только если нужны интеграции)"
else echo "[i] $TARGET/.env уже существует — не перезаписываю"
fi # 4. Напомнить про OBLIGATORY-поля

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 32)May include surrounding context.

sh

cp "$SRC_DIR/SKILL.md" "$SRC_DIR/config.yaml" "$SRC_DIR/README.md" "$SRC_DIR/install.sh" "$SRC_DIR/.env.example" "$TARGET/"
cp -r "$SRC_DIR/docs" "$SRC_DIR/examples" "$SRC_DIR/proof" "$SRC_DIR/test" "$TARGET/"
chmod +x "$TARGET/install.sh" "$TARGET/test/smoke-test.sh" 2>/dev/null || true
echo "[✓] Файлы скопированы в $TARGET" # 3. Создать .env из шаблона если нет
if [[ ! -f "$TARGET/.env" ]]; then cp "$SRC_DIR/.env.example" "$TARGET/.env" echo "[✓] Создан $TARGET/.env (заполнять только если нужны интеграции)"
else echo "[i] $TARGET/.env уже существует — не перезаписываю"
fi # 4. Напомнить про OBLIGATORY-поля

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 31)May include surrounding context.

sh

cp -r "$SRC_DIR/docs" "$SRC_DIR/examples" "$SRC_DIR/proof" "$SRC_DIR/test" "$TARGET/"
chmod +x "$TARGET/install.sh" "$TARGET/test/smoke-test.sh" 2>/dev/null || true
echo "[✓] Файлы скопированы в $TARGET" # 3. Создать .env из шаблона если нет
if [[ ! -f "$TARGET/.env" ]]; then cp "$SRC_DIR/.env.example" "$TARGET/.env" echo "[✓] Создан $TARGET/.env (заполнять только если нужны интеграции)"
else echo "[i] $TARGET/.env уже существует — не перезаписываю"
fi # 4. Напомнить про OBLIGATORY-поля
echo ""

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README encourages processing customer support tickets and generating replies, which commonly involves personal data, account details, order information, and potentially sensitive complaint content, yet it provides no privacy, retention, access-control, or human-review guidance. This creates a realistic risk of mishandling customer data or allowing the model to act on sensitive inputs without appropriate safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Refund decisions, CRM-card generation, and NPS/CSAT reporting can directly influence money movement, customer records, and business decision-making, but the README does not warn about verification, authorization, auditability, or data sensitivity. In a support automation context, this increases the chance of unauthorized refunds, inaccurate CRM enrichment, privacy leakage, or flawed automated decisions affecting customers and operations.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says "Русский язык нативно" and states that prompts, templates, and triggers are tailored to Russian-speaking business, presenting the language choice as fixed rather than optional. The file does not offer user opt-in for language/locale selection or clearly justify the restriction as a region-specific compliance requirement.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill claims L1 has read-only CRM access, but later workflows instruct the bot to create tickets, update CRM records, set tags, and log events automatically. This mismatch can cause deployments to grant broader privileges than operators expect, increasing the chance of unauthorized writes, data corruption, or unintended customer-impacting actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill can automatically create tickets, send customer-facing replies, and escalate issues, but it does not present a clear warning that these actions may happen without human review. In customer support contexts, silent automation can generate erroneous commitments, reputational harm, or workflow disruption if classification or sentiment analysis is wrong.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The header states the script only builds a ZIP, but later it unpacks the newly created archive and executes bash test/smoke-test.sh from its contents. That discrepancy can mislead reviewers and users into running a script that performs code execution beyond packaging, increasing the risk of unnoticed execution of untrusted test logic bundled in the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script's human-readable instructions and comments are presented in Russian only, with no indication of language choice or opt-in. This can violate language/locale policy where skills should not force a specific language unless the constraint is documented and justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The listed trigger phrases are generic business requests such as 'Set up ticket management' and 'Create support dashboard', which can plausibly appear in normal workplace conversation and unintentionally activate the skill. Accidental invocation can cause the wrong workflow or guidance to be applied, creating operational confusion and increasing the chance of unintended actions in support environments.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown repeatedly presents Russian language support as a fixed characteristic ("Русский язык | ... | ДА") and later states competitors are "EN-only," but does not mention any user option to choose language. Under the policy, forcing a specific language without opt-in is a natural-language locale violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Line L47 explicitly says "Русский язык — все 3 конкурента EN-only," describing Russian as a defining behavior of the skill. Because no user language choice or region-specific justification is provided in the file, this can violate the language/locale policy for natural-language instructions.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The setting auto_approve_return_under_rub: 1000 authorizes a business action without human review, creating a pathway for financial abuse, policy bypass, or repeated low-value fraudulent returns at scale. In a customer-support automation context, this is more dangerous because the same system also includes escalation and CRM automation, increasing the chance that approvals are executed operationally without sufficient fraud checks.

Content

Scanner excerpt · config.yaml (reported line 27)May include surrounding context.

yaml

# TONE-OF-VOICE
# ═══════════════════════════════════════════════════ tone: default: "дружелюбный деловой" on_negative_sentiment: "спокойный эмпатичный" on_vip: "персональный профессиональный" on_legal_threat: "нейтральный официальный" address_form: "вы" use_emoji: false response_length: "medium" # ═══════════════════════════════════════════════════
# ВОЗВРАТЫ
# ═══════════════════════════════════════════════════ returns: return_policy_days: 14 return_processing_days: "5-7 рабочих" auto_approve_return_under_rub: 1000 requires_reason_code: true # ═══════════════════════════════════════════════════
# CRM-ИНТЕГРАЦИЯ (опционально)
# ═══════════════════════════════════════════════════ crm: enabled: false type: "bitrix24" # bitrix24 / amocrm / hubspot / freshdesk / zendesk api_url: "" api_key: "" auto_create_ticket: true auto_update_client_card: true required_fields: - "client_id" - "ticket_category" - "priority" - "channel" - "status" # ═══════════════════════════════════════════════════
# КАЧЕСТВО И NPS/CSAT

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The config explicitly sets language: "ru" and elsewhere defaults to Russian locale values such as timezone: "Europe/Moscow", but the file does not indicate that language selection is optional or limited to a clearly justified region-specific deployment. This creates a natural-language policy concern because the skill appears to enforce a single language/locale without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.