T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:78- Finding
Configurable API Endpoint Can Expose the Bearer Token and Uploaded Document
- Content
View full analysis
- Remediation
View remediation
Security audit
Enterprise Qualification Ocr
Security checks for vulnerabilities and agentic risk
Overview
This OCR skill has a legitimate purpose and discloses remote processing, but it can upload any readable local file and can be configured to send documents and the API token to an arbitrary endpoint.
Review before installing. Only use this skill for documents you are authorized to send to Scnet, verify config/.env points to the intended HTTPS api.scnet.cn endpoint, and do not invoke it on arbitrary local paths. Prefer running it in a restricted workspace with only the target document accessible.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/main.py:90- Finding
Insufficient File Validation Permits Upload of Arbitrary Readable Local Files
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:83- Finding
Unpinned Dependency Installation Creates a Non-Reproducible Supply-Chain Boundary
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # 获取技能根目录（脚本所在目录的上一级） SKILL_ROOT = Path(__file__).parent.parent.absolute() ENV_FILE = SKILL_ROOT / "config" / ".env" # --- 新增：重试配置 --- MAX_RETRIES = 3 # 最大重试次数
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # -------------------- def load_config(): """从 .env 文件加载配置，若文件不存在则抛出友好错误""" if not ENV_FILE.exists(): error_msg = ( "\n===============================================\n"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # -------------------- def load_config(): """从 .env 文件加载配置，若文件不存在则抛出友好错误""" if not ENV_FILE.exists(): error_msg = ( "\n===============================================\n"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # -------------------- def load_config(): """从 .env 文件加载配置，若文件不存在则抛出友好错误""" if not ENV_FILE.exists(): error_msg = ( "\n===============================================\n"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file uses Chinese throughout, including the title and feature descriptions, with no indication that the skill is region-specific or that users can opt into this locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md * [Get started with GitLab CI/CD](https://docs.gitlab.com/ee/ci/quick_start/) * [Analyze your code for known vulnerabilities with Static Application Security Testing (SAST)](https://docs.gitlab.com/ee/user/application_security/sast/) * [Deploy to Kubernetes, Amazon EC2, or Amazon ECS using Auto Deploy](https://docs.gitlab.com/ee/topics/autodevops/requirements.html) * [Use pull-based deployments for improved Kubernetes management](https://docs.gitlab.com/ee/user/clusters/agent/) * [Set up protected environments](https://docs.gitlab.com/ee/ci/environments/protected_environments.html)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill documentation indicates capabilities to read local files, invoke Python from the shell, and send image data to a remote API, but it does not declare an explicit tool scope such as permissions or allowed-tools. That omission weakens enforcement and user visibility around what the skill may access, especially because it processes sensitive enterprise certificate images and transmits them off-device.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The skill is explicitly configured to send uploaded certificate images to
api.scnet.cn, which is a real external transmission of sensitive enterprise identity data. Because the documents include identifiers, addresses, legal representatives, and registration details, external transfer materially increases confidentiality and compliance risk if users are not tightly informed and protected.- Content
SCNET_API_KEY=your_scnet_api_key_here
API 基础地址（一般无需修改）
SCNET_API_BASE=https://api.scnet.cn/api/llm/v1
text 2. 添加：`SCNET_API_KEY=你的密钥` 3. 设置文件权限为 600（仅所有者可读写）
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The auto-trigger guidance says the AI will automatically invoke the skill based on broad description keywords, without strong activation boundaries or an explicit consent gate. In this context, that can cause accidental OCR of local documents and unintended upload of highly sensitive business registration materials to a third-party service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This finding reinforces that the configured API base points to an external service endpoint, meaning the skill depends on remote processing for sensitive document contents. In the context of business qualification certificates, such outbound transfer is significant because it can expose regulated or commercially sensitive records beyond the local environment.
- Content
md | 变量名 | 默认值 | 说明 | |--------|--------|------| | SCNET_API_KEY | 必需 | Scnet API 密钥 | | SCNET_API_BASE | https://api.scnet.cn/api/llm/v1 | API 基础地址（一般无需修改） | ### 输出
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The skill directs users to transmit uploaded files to an external OCR service endpoint, which creates a real data egress path for potentially sensitive business-license and registration documents. In this skill context, the risk is elevated because the listed document types routinely contain identifiers, addresses, legal representative names, and other sensitive organizational information.
- Content
md # Sugon-Scnet OCR API 文档摘要 ## 接口地址 `POST https://api.scnet.cn/api/llm/v1/ocr/recognize` ## 请求头 - `Content-Type: multipart/form-data`
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation instructs users to upload images, PDFs, or archives containing enterprise qualification documents to a third-party OCR endpoint, but provides no privacy, retention, consent, or data-handling warning. Because these documents commonly contain sensitive corporate and personal data, omission of handling guidance can lead to unintended external disclosure and compliance issues.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
L039-L045 和 L148-L152 的错误提示明确告诉用户可通过环境变量 export SCNET_API_KEY 来配置凭据，并将其标注为推荐方式。但 load_config 在 L050-L079 仅解析 config/.env 文件，从未读取 os.environ，因此文档化的配置方式与实际行为相矛盾。
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python " b) 配置文件：\n" f" mkdir -p {SKILL_ROOT}/config\n" f" echo 'SCNET_API_KEY=你的密钥' > {ENV_FILE}\n" f" chmod 600 {ENV_FILE}\n" "\n配置完成后重新运行。" ) sys.exit(error_msg)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python " b) 配置文件：\n" f" mkdir -p {SKILL_ROOT}/config\n" f" echo 'SCNET_API_KEY=你的密钥' > {ENV_FILE}\n" f" chmod 600 {ENV_FILE}\n" "\n配置完成后重新运行。" ) sys.exit(error_msg)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
The skill transmits user-supplied files, which may contain sensitive enterprise registration documents and personal/business data, to an external third-party API endpoint. In an OCR skill this behavior is expected, but it still creates real privacy and data-handling risk because highly sensitive documents leave the local trust boundary.
- Content
python ) sys.exit(error_msg) config.setdefault('SCNET_API_BASE', 'https://api.scnet.cn/api/llm/v1') return config def recognize_with_retry(ocr_type, file_path, config, retry_count=0):
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description is entirely in Chinese and gives no indication that users may interact in other languages or choose a locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest description forces a specific language presentation for invocation and usage context, but the file does not offer the user a language choice or explain that the skill is intentionally limited to Chinese-speaking users or a China-specific deployment. This can violate language/locale policy when no opt-in or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
A language or locale policy issue exists when a skill or its instructions force a specific language without user choice or justification. This file presents all operational documentation in Chinese and does not indicate that the language is optional, selectable, or region-specific.
- Content