每日唐诗

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:46 AM UTC
• Version: 1.1.1

Overview

The skill is a coherent Tang-poetry study helper, but it sends user answers and a stable user ID to a default external backend and documents optional API keys being placed in URLs.

Install only if you are comfortable sending poem requests, recitation attempts, review answers, activity dates, and a stable identifier to the configured backend. Use a random UUID rather than a Telegram chat ID, phone-related value, username, or reused identifier. Avoid configuring an API key unless the service changes to header-based authentication or you can tolerate query-string exposure in logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:121

Finding

API Credential Transmitted in URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 121–123
Vulnerability Type: Query-string credential exposure
Risk Level: Medium

Complete Relevant Snippet

markdown

**Base URL**: Read from the skill configuration `DAILY_TANG_POEM_API_URL`; the default is defined in the manifest.
**Authentication**: Only when `DAILY_TANG_POEM_API_KEY` is configured, append `?key=configured-value` to every request; otherwise, do not append it.

The excerpt above is a faithful English translation of the documented authentication instruction.

Technical Analysis

The skill instructs clients to transmit DAILY_TANG_POEM_API_KEY through the URL query string. Query strings are commonly recorded in web-server access logs, reverse-proxy logs, observability platforms, error reports, browser history, and debugging traces. HTTPS protects the URL while it is in transit but does not prevent the endpoint or intermediate application infrastructure from recording it.

The instruction also says to attach the key to every request. This unnecessarily increases the number of locations where the credential may be retained and broadens its exposure across endpoints that may not all require authentication.

Attack Path

1. A user configures DAILY_TANG_POEM_API_KEY.
2. The skill appends the credential to API URLs as ?key=....
3. The Vercel deployment, a reverse proxy, an analytics service, or a diagnostic system records the complete requested URL.
4. An attacker, service operator, support user, or other party with access to those logs obtains the key.
5. The exposed key is replayed against the API until it is revoked or expires.

Impact Assessment

An exposed credential may grant unauthorized access to any API operations accepted by that key, including reading poem and review data, submitting validation requests, or modifying pass records, depending on the backend's authorization model.

The project does not docu ...[truncated 291 chars]

Remediation

View remediation

Remediation Suggestions

1. Transmit the credential in an HTTP authorization header, such as:

   http

   Authorization: Bearer <API_KEY>
   

2. Never include authentication secrets in query strings, route paths, analytics parameters, or error messages.
3. Attach credentials only to endpoints that require authentication.
4. Configure the backend and reverse proxy to redact authorization headers from logs.
5. Use scoped, short-lived credentials where possible and provide an explicit revocation and rotation mechanism.
6. Apply server-side authorization independently to each operation rather than treating possession of one unrestricted key as sufficient.
7. Rate-limit authentication failures and monitor for replay from unexpected clients or locations.

other

Warning

• Location: manifest.yaml:9

Finding

Persistent User Identifiers and User-Provided Answers Sent to a Default Third-Party Backend Without a Privacy Notice

Content

View full analysis

Vulnerability Details

File Location: manifest.yaml, lines 9–20; related transmission flows in SKILL.md, lines 53–64 and 72–85
Vulnerability Type: Privacy and external data exposure
Risk Level: Medium

Complete Relevant Snippets

yaml

config:
  DAILY_TANG_POEM_API_URL:
    type: string
    required: false
    default: "https://daily-tang-poem-nqbl.vercel.app"
    description: "API address; works without user configuration"
  DAILY_TANG_POEM_API_KEY:
    type: string
    required: false
    description: "Set this if API authentication is enabled; otherwise leave empty"
  DAILY_TANG_POEM_USER_ID:
    type: string
    required: false
    description: "Unique user identifier. Examples include a UUID, Telegram chat ID, or a custom value such as my-phone. Review is unavailable if omitted."

markdown

POST {URL}/api/validate-recite
Body: {"user_input": "the sentence entered by the user", "date": "the date returned by the API"}

POST {URL}/api/pass
Body: {"user_id": "...", "date": "...", "poem_id": "..."}

GET {URL}/api/review/questions?user_id={DAILY_TANG_POEM_USER_ID}&count=5

POST {URL}/api/review/check
Body: {
  "user_id": "...",
  "seed": "...",
  "question_index": 1,
  "user_answer": "the user's answer"
}

These excerpts are faithful English translations of the relevant configuration descriptions and documented request flows.

Technical Analysis

The skill uses a developer-controlled Vercel deployment as its default API endpoint. Its documented workflows transmit user-generated recitation text, review answers, dates, poem identifiers, and a stable user_id to that external service.

The manifest suggests that the identifier may be a Telegram chat ID. Such an identifier can be associated with an external account and can allow activity across multiple requests to be correlated. Even a custom identifier can become identifying when it is stable or re ...[truncated 1814 chars]

Remediation

View remediation

Remediation Suggestions

1. Display a clear disclosure before the first external request, identifying:
   • The destination service and operator.
   • Every category of information transmitted.
   • The processing purpose.
   • Retention and deletion periods.
   • Whether infrastructure or analytics providers receive request data.
2. Generate a random, pseudonymous identifier locally instead of suggesting Telegram chat IDs, phone-related values, usernames, or identifiers reused by other services.
3. Explicitly warn users not to use account identifiers or personally identifying values.
4. Minimize transmitted data. Avoid sending stable identifiers to endpoints that do not require per-user state.
5. Provide controls to inspect, export, reset, and delete server-side learning history.
6. Publish or bundle the backend implementation so its storage, authorization, validation, and deletion behavior can be audited.
7. Support a self-hosted endpoint and require explicit consent before using the developer-operated default.
8. Encrypt stored records, restrict administrative access, redact request bodies from logs, and define a short retention period.
9. Document incident-response and data-deletion contact procedures.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases include very generic terms such as “诗人” and broad conversational variants, which can cause the skill to activate during ordinary chat rather than through clear user intent. Because this skill sends requests to a backend and may disclose or process user answers, accidental activation creates unnecessary data transmission and consent ambiguity.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill relies on unspecified contextual inference to decide whether a user meant push, review, or recitation-check mode, instead of requiring an explicit mode selection. This increases the chance of unintended backend requests and mismatched handling of user content, especially when prior conversation context is noisy or incomplete.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill sends poem requests and user recitation answers to external backend endpoints, but the description does not clearly warn users that their inputs will be transmitted off-platform. This undermines informed consent and can expose user-generated text or behavioral data unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill uses a persistent environment-based user identifier to track passed recitations and build a review history, but this tracking is not clearly disclosed to users. Even if the identifier is pseudonymous, it enables longitudinal profiling of learning behavior and should be presented transparently.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest's comments and user-facing description fields are entirely in Chinese, including installation-relevant configuration guidance. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The rule '默认中文' imposes a language default in natural-language behavior, but the document does not state that users can request another language or opt into this locale preference. Under the stated policy, language constraints should be optional or clearly justified.

Content

No source excerpt is available for this finding.