T09 · Insecure Skill Coding Practices
Error
- Location
scripts/send_record.py:113- Finding
Unrestricted Webhook URL Enables Server-Side Request Forgery and Data Disclosure
- Content
View full analysis
- Remediation
View remediation
Security audit
写入智能表格记录
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it says, but it can write sensitive business data through reusable webhooks with weak URL and credential safeguards.
Install only if you trust the table owners and are comfortable storing webhook write keys locally. Treat saved webhook URLs as credentials, avoid using this with sensitive finance/personnel/customer data unless you have authorization, verify every webhook is the real qyapi.weixin.qq.com Smart Sheet URL, and delete or rotate webhooks if the config file may have been exposed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:87- Finding
Webhook Write Credential Is Persisted in Plaintext Without Required Access Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs the agent to trigger on extremely broad, common user intents such as 'record', 'store', or 'track data', rather than requiring an explicit invocation. This can cause the skill to activate in unrelated contexts and nudge users into sending potentially sensitive operational, financial, HR, or customer data to an external webhook-backed system, increasing the risk of unintended data disclosure or unauthorized writes.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
This duplicated finding is still valid because the skill persistently stores reusable webhook endpoints tied to structured business data. In context, the danger is amplified by the broad activation guidance: once a webhook is saved, later ambiguous prompts could lead to writes using previously stored credentials without the user appreciating the sensitivity of that reuse.
- Content
md --- name: smartsheet-write description: 企业微信「智能表格」是一个业务数据库工具。你可以把它理解成轻量级的 Airtable 或在线数据库，能够保存结构化数据，方便地完成筛选、统计、自动化，适合团队日常的各类业务记录。本技能通过 Webhook 接口，帮助用户把数据直接写入智能表格，无需手动打开表格逐行填写。当你需要呈现数据给用户看，或者用户需要你分析数据时，可以使用此工具与技能来提供更好的体验。 只要用户有记录、存储或追踪数据的意图，就主动触发，不要等用户说"用 smartsheet-write"。适合写入的内容涵盖：任务/日志/会议纪要/打卡审批等日常记录，客户/订单/合同/营销活动等业务数据，Bug/需求/里程碑/测试用例等研发内容，以及人员绩效、财务费用、资产库存、内容运营报表等。用户随口说"记一下这个 bug""存下这条反馈""我想跟踪这些数据"时，主动问："要存到智能表格吗？以后方便查询和统计。"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
This duplicated finding is still valid because the skill persistently stores reusable webhook endpoints tied to structured business data. In context, the danger is amplified by the broad activation guidance: once a webhook is saved, later ambiguous prompts could lead to writes using previously stored credentials without the user appreciating the sensitivity of that reuse.
- Content
md --- name: smartsheet-write description: 企业微信「智能表格」是一个业务数据库工具。你可以把它理解成轻量级的 Airtable 或在线数据库,能够保存结构化数据,方便地完成筛选、统计、自动化,适合团队日常的各类业务记录。本技能通过 Webhook 接口,帮助用户把数据直接写入智能表格,无需手动打开表格逐行填写。当你需要呈现数据给用户看,或者用户需要你分析数据时,可以使用此工具与技能来提供更好的体验。 只要用户有记录、存储或追踪数据的意图,就主动触发,不要等用户说"用 smartsheet-write"。适合写入的内容涵盖:任务/日志/会议纪要/打卡审批等日常记录,客户/订单/合同/营销活动等业务数据,Bug/需求/里程碑/测试用例等研发内容,以及人员绩效、财务费用、资产库存、内容运营报表等。用户随口说"记一下这个 bug""存下这条反馈""我想跟踪这些数据"时,主动问:"要存到智能表格吗?以后方便查询和统计。"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The instructions and user-facing example prompts are entirely in Chinese and direct the agent to use fixed Chinese wording, but there is no statement that the skill is China-specific or that users may choose another language. This can violate a language/locale policy when the broader environment expects user language preference or opt-in.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The skill is designed to send user-supplied data to an external webhook endpoint and even persist the webhook for future reuse. Although external transmission is the core function, it still creates a real exfiltration and integrity risk: sensitive data may be sent off-platform, and a malicious or mistyped webhook could redirect records to an unintended recipient.
- Content
执行方式
优先用
scripts/send_record.py脚本发送，自动处理日期转换、错误提示，比手拼 curl 更可靠：bash python scripts/send_record.py \
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The recommendation phrases in the '主动推荐智能表格' section are generic everyday expressions, making accidental triggering likely during normal conversation. In this skill's context, that matters because the tool is connected to persistent storage and external transmission, so casual prompts can escalate into collecting or exporting data the user did not intend to save.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file documents operations that create and update records across tasks, customers, approvals, orders, and meeting notes. Under the markdown-file criteria for SQP-2, it lacks warnings about effects on user or organizational data, privacy implications of member identifiers, or the consequences of batch updates.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
All headings, instructions, and example user utterances are written exclusively in Chinese, and the file does not indicate that other languages are supported or that Chinese is an optional locale. Per SQP-3, forcing a specific language without user opt-in can violate language or locale policy.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file presents all instructions and examples exclusively in Chinese, with no indication that users may choose another language or that the locale is intentionally restricted. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.