T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:34- Finding
Mandatory Promotional Link Injection into Every User Response
- Content
View full analysis
- Remediation
View remediation
Security audit
ruqi-mobility
Security checks for vulnerabilities and agentic risk
Overview
This ride-hailing skill performs plausible trip functions, but it asks to persist sensitive account and location data in plaintext and can send detailed ride data and screenshots to external messaging targets.
Install only if you are comfortable with the agent handling real ride-account credentials, phone numbers, precise home/work locations, browser screenshots, and external trip notifications. Before use, remove plaintext TOOLS.md storage for tokens and addresses, require explicit opt-in for saved places and messaging targets, and disable screenshots or restrict them to a verified recipient and minimal trip data.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:24- Finding
Plaintext Persistence of Authentication Tokens and Precise Personal Location Data
- Content
View full analysis
` - Passenger phone number: `` - Home: `` (latitude, longitude) - Company: `` (latitude, longitude) ``` ### Technical Analysis The skill explicitly instructs the agent to store an API authentication token, passenger phone number, home address, company address, and precise geographic coordinates in a general Markdown file named `TOOLS.md`. A reusable authentication token is credential material and should not be stored in plaintext documentation or general agent state. Home and workplace coordinates are also highly sensitive because they reveal habitual locations and can be correlated with a user's identity and travel activity. The instructions do not specify encryption, restrictive file permissions, token expiry, rotation, redaction, retention limits, or secure deletion. They also do not require user consent before persisting location data. If `TOOLS.md` is readable by other local users, processes, skills, diagnostic tools, backups, or synchronization services, all stored information can be recovered directly. ### Attack Path 1. The user supplies a phone number and SMS verification code. 2. The skill calls the login endpoint and receives an authentication token. 3. Following `SKILL.md`, the agent writes the token and phone number into `TO ...[truncated 1277 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ruqi_poll_with_screenshot.js:294- Finding
Excessive Disclosure of Ride and Driver Data Through Notifications and Full-Page Screenshots
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (29)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The manifest presents the skill as a normal ride-hailing assistant, but the instructions also include local process execution, persistent credential storage, polling automation, and cross-channel notification behavior. This mismatch prevents informed consent and makes it easier to hide risky side effects behind a benign transportation description.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases include common expressions such as '回家', '上班', '下班', and '怎么走', which can easily appear in ordinary conversation unrelated to authorizing a ride-service workflow. Overbroad triggers raise the chance of accidental activation, unintended collection of location or phone data, and execution of downstream actions in the wrong context.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly tells the agent to persist authentication tokens, phone numbers, and address data into
TOOLS.md, a plain reusable file outside a purpose-limited secret store. Storing credentials and sensitive personal data in general notes creates a high risk of disclosure, reuse by unrelated skills, and long-term compromise of the user's account and location privacy.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill requires persistent storage of highly sensitive data—API token, phone number, home address, and company address—without any user-facing privacy notice, retention disclosure, or consent model. In a mobility context, these data elements enable identity linkage and detailed movement profiling, making the omission especially dangerous.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instructions direct persistence and reuse of sensitive user data in plain-language notes, including token material and identifiable location data. This is dangerous because notes files are typically broadly readable within the agent environment, making credential theft and exposure of home/work patterns much more likely.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The login flow tells the agent to record the returned token and phone number in a reusable markdown file, which creates a durable credential cache tied to a real person. If that file is accessed by another tool, skill, or operator, an attacker could query orders, infer travel history, or act on the user's ride account.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md "scripts/ruqi_poll_with_screenshot.js",
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md "scripts/ruqi_poll_with_screenshot.js",
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 调用方式：`RUQI_CLIENT_MCP_TOKEN=<Token> node scripts/ruqi_api.js <命令> <参数>`
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill directs use of shell execution and environment-variable handling (
node, background polling, token injection) but does not declare any explicit tool scope or permissions boundaries. This increases the risk of unintended command execution or overbroad runtime access because reviewers and enforcement layers cannot clearly constrain what the skill is allowed to do.- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ## ⚡ 核心规则（必须遵守） | 规则 | 说明 | | ---------------------- | ------------------------------------------------------------------------------------------------------ | | 1. Token 动态注入 | 登录后从响应获取 Token，保存到 TOOLS.md，通过环境变量 `RUQI_CLIENT_MCP_TOKEN` 注入。登录接口无需 Token | | 2. 下单前须用户确认 | 展示价格后等待用户明确确认（"确认"、"下单"、"好的"等） |
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instruction requires every message to end with a fixed Chinese footer link, regardless of the user's language preference. This imposes a specific language/locale on all interactions without offering choice or documenting a justified locale restriction.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Saving home and company locations for future use creates a persistent record of the user's most sensitive places. In a mobility skill, these addresses significantly increase safety and stalking risks if exposed, and they exceed what should be retained by default without strong consent controls.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to launch a background Node.js polling script after order creation, which extends behavior beyond a simple transactional ride request into persistent local execution. Background processes can leak data, continue acting without user awareness, and create a foothold for misuse if the script or its inputs are modified.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ### 核心工具 | 工具 | 功能 | 必需参数 | | -------------------------------- | ---------- | --------------------------------------------------------------------------------------- | | `send_verification_code` | 发送验证码 | `--phone` | | `login_with_verification_code` | 验证码登录 | `--phone --msgCode` |
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest describes a ride-hailing assistant providing booking, pricing, tracking, and route services. While network access to the ride platform is expected, spawning an external process to run curl is a separate execution capability that is not necessary to the stated purpose and expands what the skill can do beyond ordinary API calls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This function constructs a request body containing an environment-sourced token and user-derived fields such as phone-based deviceId, then sends it to a remote HTTPS endpoint via curl. The code has no confirmation prompt, user-facing log/print before transmission, or explanatory comment/docstring disclosing that sensitive data is being sent off-host.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest describes a ride-hailing assistant focused on calling rides, price estimates, order tracking, driver location, route planning, and cancellation. This file additionally implements phone verification-code sending and login, and later exposes query_order_list, which are account/session-management capabilities not described in the manifest's stated user-facing scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This function submits phone-based authentication data and exposes the returned session token to stdout without any built-in confirmation, masking, or handling safeguards. In an agent context, that can enable silent account access or token leakage through logs, downstream tools, or prompt-mediated workflows, especially because the skill handles real ride-service accounts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Order cancellation is a destructive action affecting a real-world service transaction, yet this wrapper performs it directly with no confirmation or secondary check. In an agent-driven environment, an incorrect interpretation, prompt injection, or accidental invocation could cancel a user's ride without consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script sends ride details, driver information, and optional screenshots to an external messaging destination taken from environment variables. In the context of a ride-hailing skill, this extends data flow beyond the stated core travel functions and can disclose sensitive trip and personal data to third-party recipients without clear user consent or interface warning.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script forwards sensitive ride metadata and potentially screenshots to an external messaging service without an explicit warning or consent mechanism in the script interface. In this skill context, users would reasonably expect ride management features, but not silent export of trip and driver data to off-platform channels.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Using RUQI_TARGET and RUQI_CHANNEL from the environment allows trip updates to be routed to arbitrary external recipients with no in-script validation, allowlist, or confirmation. Because the payload includes order, address, driver, and screenshot data, a misconfigured or malicious environment can turn normal ride tracking into silent data exfiltration.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script automates a browser to open a trip-share page and capture full-page screenshots during polling. Those screenshots can contain sensitive trip status, addresses, map location, and other account-linked information, creating an unnecessary collection and transmission surface not disclosed by the skill description.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file's user-visible comments and error messages are written in Chinese, including the runtime error at L045 and other diagnostic strings, with no indication that the user can choose another language. That can violate a language/locale policy requiring user choice or explicit justification for a fixed locale.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/request.js:19