T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:78- Finding
Unrestricted API Endpoint Override Can Expose Credentials and Identity Documents
- Content
View full analysis
- Remediation
View remediation
Security audit
Driver License Ocr
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to perform driver-license OCR as advertised, but it needs review because it uploads sensitive identity documents and an API key to a configurable remote endpoint without strong runtime safeguards.
Install only if you are comfortable sending driver's license images to Scnet's remote OCR service. Before use, verify `config/.env` points only to the intended HTTPS Scnet API endpoint, avoid processing documents without the subject's permission, and consider requiring an explicit confirmation before each upload.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:89- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
``` 2. Generate and verify cryptographic hashes for the selected package and all transitive dependencies. Install with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Use a lock-file workflow that records all transitive versions and hashes. 4. Install dependencies inside a dedicated virtual environment under a non-privileged account. 5. Document the approved package index and avoid untrusted extra indexes. 6. Enable automated dependency vulnerability and integrity monitoring. 7. Review and deliberately update the lock file rather than allowing versions to change implicitly at installation time. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # 获取技能根目录（脚本所在目录的上一级） SKILL_ROOT = Path(__file__).parent.parent.absolute() ENV_FILE = SKILL_ROOT / "config" / ".env" # --- 新增：重试配置 --- MAX_RETRIES = 3 # 最大重试次数
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # -------------------- def load_config(): """从 .env 文件加载配置，若文件不存在则抛出友好错误""" if not ENV_FILE.exists(): error_msg = ( "\n===============================================\n"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # -------------------- def load_config(): """从 .env 文件加载配置，若文件不存在则抛出友好错误""" if not ENV_FILE.exists(): error_msg = ( "\n===============================================\n"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # -------------------- def load_config(): """从 .env 文件加载配置，若文件不存在则抛出友好错误""" if not ENV_FILE.exists(): error_msg = ( "\n===============================================\n"
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md * [Get started with GitLab CI/CD](https://docs.gitlab.com/ee/ci/quick_start/) * [Analyze your code for known vulnerabilities with Static Application Security Testing (SAST)](https://docs.gitlab.com/ee/user/application_security/sast/) * [Deploy to Kubernetes, Amazon EC2, or Amazon ECS using Auto Deploy](https://docs.gitlab.com/ee/topics/autodevops/requirements.html) * [Use pull-based deployments for improved Kubernetes management](https://docs.gitlab.com/ee/user/clusters/agent/) * [Set up protected environments](https://docs.gitlab.com/ee/ci/environments/protected_environments.html)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documentation indicates capabilities that include reading local files, invoking Python from the shell, and sending data over the network, but it does not declare any explicit tool scope or permissions boundary. That omission can lead to overbroad execution in agent environments, especially because the skill handles highly sensitive identity documents and transmits them to a third-party API.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
L054 的功能特性明确写的是“支持识别行驶证主页和副页信息”，并列出号牌号码、所有人、车架号、发动机号等机动车行驶证字段，这与清单 L003 及其余文档中声明的驾驶证（驾驶人证件）识别用途直接矛盾。这不是简单的信息缺失，而是把目标证件类型和提取字段写成了另一类证件，属于文档意图与技能定位的主动冲突。
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The skill explicitly sends driver's license images to an external endpoint at api.scnet.cn, which constitutes transmission of highly sensitive personal information outside the local environment. Even though the documentation warns about this behavior, the security risk remains significant because identity data, license numbers, and photos may be exposed through third-party handling, retention, breach, or misconfiguration.
- Content
SCNET_API_KEY=your_scnet_api_key_here
API 基础地址（一般无需修改）
SCNET_API_BASE=https://api.scnet.cn/api/llm/v1
text 2. 添加：`SCNET_API_KEY=你的密钥` 3. 设置文件权限为 600（仅所有者可读写）
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The auto-trigger guidance is broad enough that an agent may invoke this skill based on vague conversational references to an image path, without strong confirmation of user intent or sensitivity review. In this context, that is risky because the skill processes driver's license images containing highly sensitive personal data and sends them off-device to a third party.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
This configuration section reiterates that the OCR workflow depends on a remote API base URL, confirming that processing requires external transmission of sensitive driver's license data. Because the skill context involves government-issued identity documents, external transfer materially elevates privacy and compliance risk even if the endpoint is legitimate.
- Content
md | 变量名 | 默认值 | 说明 | |--------|--------|------| | SCNET_API_KEY | 必需 | Scnet API 密钥 | | SCNET_API_BASE | https://api.scnet.cn/api/llm/v1 | API 基础地址（一般无需修改） | ### 输出
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The skill depends on transmitting uploaded document images to an external domain (api.scnet.cn) for OCR processing. In a driver-license OCR use case, this creates a real data-exposure risk because the payload includes sensitive identity information and document images, even though the external call itself may be functionally necessary.
- Content
md # Sugon-Scnet OCR API 文档摘要 ## 接口地址 `POST https://api.scnet.cn/api/llm/v1/ocr/recognize` ## 请求头 - `Content-Type: multipart/form-data`
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation describes uploading driver license images and related identity documents to a third-party OCR endpoint but does not warn that highly sensitive personal data will be transmitted off-platform. In the context of a driver-license OCR skill, this omission is material because the documents contain regulated PII and users may not realize their files are being sent to an external service.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python " b) 配置文件：\n" f" mkdir -p {SKILL_ROOT}/config\n" f" echo 'SCNET_API_KEY=你的密钥' > {ENV_FILE}\n" f" chmod 600 {ENV_FILE}\n" "\n配置完成后重新运行。" ) sys.exit(error_msg)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python " b) 配置文件：\n" f" mkdir -p {SKILL_ROOT}/config\n" f" echo 'SCNET_API_KEY=你的密钥' > {ENV_FILE}\n" f" chmod 600 {ENV_FILE}\n" "\n配置完成后重新运行。" ) sys.exit(error_msg)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The skill is designed to send documents to an external endpoint at api.scnet.cn, which constitutes external transmission of sensitive driving-license data. In this skill context, that increases privacy and compliance risk because the uploaded files may contain names, license numbers, and other regulated personal data.
- Content
python ) sys.exit(error_msg) config.setdefault('SCNET_API_BASE', 'https://api.scnet.cn/api/llm/v1') return config def recognize_with_retry(ocr_type, file_path, config, retry_count=0):
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script uploads a user-provided driving-license image to a third-party OCR service, which is a real privacy and data-handling risk because the file likely contains sensitive personal information. Although the transmission appears intentional for OCR functionality and uses HTTPS, there is no explicit consent step or transmission warning at the moment the upload occurs, so users may unknowingly send PII off-host.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description is written entirely in Chinese and provides no indication that other languages are supported or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file uses Chinese headings and entries exclusively, which may violate a language/locale policy if the organization expects neutral or user-selectable language. There is no indication that the skill is region-specific or that users can opt into this locale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file presents the skill description, warnings, and usage guidance entirely in Chinese, which can amount to forcing a specific language without user opt-in. The document does not offer alternative language support or explain that the skill is intentionally limited to a Chinese-speaking or region-specific audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file presents all user-facing documentation in Chinese only, including headings and field descriptions. The policy requires flagging language or locale constraints when a specific language is forced without user opt-in or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The docstring, usage text, and error/help messages are written exclusively in Chinese, with no option for another language. This can violate language/locale policy where skills should not force a specific language without user opt-in.
- Content