Company cooperate evaluate search wdy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:51 AM UTC
• Version: 1.0.3

Overview

The skill is mostly coherent for a WenDaoYun company-risk lookup, but it has credential-handling and commercial-redirection behavior users should review before installing.

Install only if you are comfortable using WenDaoYun as a third-party data provider and storing `WENDAOYUN_API_KEY` in your environment. Avoid sharing chat transcripts if authentication errors occur, and consider editing the skill to redact API keys, bearer tokens, and authorization details instead of returning raw error messages.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:26

Finding

Forced Commercial Promotion and External Registration Funnel

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26 and 44–45
Vulnerability Type: Forced user-facing output and third-party commercial redirection
Risk Level: Medium

Vulnerable Code Snippet

The following is a complete English translation of the relevant source instructions:

markdown

- If absent → Return the complete contents of the [Configuration Instructions](#configuration-instructions) section below, guide the user to configure an API key, and stop all subsequent operations.

1. **🎁 New-user benefit**: Receive an **88-yuan trial credit** after first logging into a WenDaoYun account. The credit can be used to purchase API access. Register on the official website first.
2. Obtain an API key: Visit https://open.wendaoyun.com/home → [Personal Center - API Key]

Technical Analysis

When WENDAOYUN_API_KEY is unavailable, the Skill requires the agent to reproduce the entire configuration section. That section contains a financial incentive and directs the user to an external commercial registration page.

The mandatory promotional text is not necessary to explain the technical prerequisite. Because the instruction reliably changes the agent's response into advertising and a registration funnel whenever the environment lacks the key, it constitutes instruction-level output hijacking.

The URL uses HTTPS and the reviewed files contain no evidence that it serves executable content. The issue is therefore forced promotion and redirection, not remote code execution.

Attack Path

1. A user invokes the Skill by requesting a company cooperation or risk assessment.
2. The Skill checks the WENDAOYUN_API_KEY environment variable.
3. The environment variable is absent or empty.
4. The Skill requires the agent to stop the requested workflow.
5. The agent reproduces the complete configuration section, including the promotional credit and external registration URL.
6. The user may follow the ...[truncated 566 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the trial-credit advertisement and other promotional language from operational instructions.
2. Do not require verbatim reproduction of an entire configuration section.
3. Replace the behavior with a concise, neutral message explaining that an API key is required.
4. Provide the external account-management URL only when the user explicitly asks how to obtain a key.
5. Clearly identify the URL as a third-party service and avoid implying that registration or payment is required by the agent platform itself.
6. Permit alternative handling, such as asking the user to configure the key through an approved secret-management mechanism.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:65

Finding

Verbatim API Error Disclosure Can Leak Authentication Secrets

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 65
Vulnerability Type: Unsanitized disclosure of upstream error responses
Risk Level: Medium

Vulnerable Code Snippet

The following is a complete English translation of the relevant source instruction:

markdown

- If any API-call error response contains the keyword `apiKey`, immediately stop all operations, return the original error message verbatim to the user, and guide the user to obtain a new API key.

Technical Analysis

The Skill explicitly requires the agent to return an upstream error message verbatim whenever it contains apiKey. No redaction, schema validation, allowlist, or output filtering is required before disclosure.

API gateways and backend services can include reflected request parameters, authorization details, diagnostic context, internal endpoint information, or key values in error responses. The keyword check does not establish that the message is safe. On the contrary, an error that mentions apiKey is more likely to contain authentication-related information.

This is a sensitive-data handling weakness. The issue is conditional because the reviewed repository does not contain an actual leaked key or a sample response proving that the upstream service reflects credentials. Nevertheless, the mandated unsafe error-handling path would expose such content if it were present.

Attack Path

1. The agent sends a request to the configured API endpoint with the API key in the Authorization: Bearer header.
2. The request fails because of an invalid key, malformed input, account problem, gateway error, or maliciously influenced upstream response.
3. The upstream response contains the string apiKey and may also contain a key value, authorization header, request metadata, or internal diagnostic details.
4. The Skill's keyword condition is satisfied.
5. The agent returns the complete error response to the user without saniti ...[truncated 880 chars]

Remediation

View remediation

Remediation Suggestions

1. Never return authentication-related error responses verbatim.
2. Replace upstream details with a generic message such as: Authentication failed. Verify or rotate the configured API key.
3. Redact Bearer tokens, API keys, authorization headers, cookies, query credentials, and key-value patterns before displaying or logging any response.
4. Use an allowlist of safe fields, such as a normalized status code and a non-sensitive error category, rather than attempting to blacklist specific secret names.
5. Store detailed diagnostics only in access-controlled server logs after applying secret redaction.
6. Add automated tests covering reflected credentials, mixed-case key names, encoded tokens, authorization headers, nested error objects, and malicious upstream text.
7. If accidental disclosure occurs, revoke and rotate the affected key and review its usage history for unauthorized requests.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The output section prescribes a fixed response template entirely in Chinese and does not provide any option to match the user's language or locale. This creates a natural-language policy issue because the skill effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file presents all user-facing documentation in Chinese, including the title, parameter descriptions, and response field explanations. This effectively enforces a specific language for users without any opt-in or justification of a region-specific requirement, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file contains user-facing natural language exclusively in Chinese, including the title and all field descriptions. Under the policy rule for language/locale, forcing a specific language without opt-in can be a policy violation when no user choice or justification is provided.

Content

No source excerpt is available for this finding.