T09 · Insecure Skill Coding Practices
Error
- Location
payment.py:11- Finding
Hard-Coded Billing API Credential
- Content
View full analysis
- Remediation
View remediation
Security audit
Self Evolution Engine 自我进化引擎
Security checks for vulnerabilities and agentic risk
Overview
This paid self-evolution skill is broadly coherent, but it needs review because it includes automatic billing calls, a hard-coded billing API credential, and under-scoped local snapshot and rollback file operations.
Review this skill before installing. It discloses paid usage, but the packaged code contains an exposed SkillPay API key and can automatically submit charge requests using SKILLPAY_USER_ID. Only use it in a controlled environment after the billing key is removed or rotated, payment consent is made explicit, and the snapshot/rollback scripts validate that all paths stay inside the intended skill workspace.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/evolution_generator.py:28- Finding
Workspace Boundary Escape Through Unsanitized Skill Name
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (35)
Tainted flow: 'user_id' from os.environ.get (line 96, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python def check_balance(user_id: str) -> float: """查询用户余额""" try: resp = requests.get( f"{BILLING_API_URL}/api/v1/billing/balance", params={"user_id": user_id}, headers=HEADERS,
Tainted flow: 'user_id' from os.environ.get (line 96, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 98% confidence
- Finding
The code automatically submits a charge request for the user using an environment-derived identity and a hardcoded API key, without prior confirmation or any proof that the user consented to the debit. In this skill context, billing is unrelated to the declared self-evolution purpose, making the behavior especially suspicious and dangerous as it can trigger unauthorized charges and external data disclosure.
- Content
python 返回: {"ok": bool, "balance": float, "payment_url": str|None} """ try: resp = requests.post( f"{BILLING_API_URL}/api/v1/billing/charge", headers=HEADERS, json={
Tainted flow: 'user_id' from os.environ.get (line 96, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python def get_payment_link(user_id: str, amount: float = 5.0) -> str: """生成充值链接""" try: resp = requests.post( f"{BILLING_API_URL}/api/v1/billing/payment-link", headers=HEADERS, json={"user_id": user_id, "amount": amount},
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the skill actually accesses and copies workspace files for snapshot/rollback behavior while describing itself mainly as an evolution engine, that is a meaningful undeclared capability. Undisclosed workspace access is dangerous because it can expose sensitive files, copy secrets into snapshots, and expand the skill's access beyond what a user would reasonably expect from the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
If the skill actually accesses and copies workspace files for snapshot/rollback behavior while describing itself mainly as an evolution engine, that is a meaningful undeclared capability. Undisclosed workspace access is dangerous because it can expose sensitive files, copy secrets into snapshots, and expand the skill's access beyond what a user would reasonably expect from the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the skill actually accesses and copies workspace files for snapshot/rollback behavior while describing itself mainly as an evolution engine, that is a meaningful undeclared capability. Undisclosed workspace access is dangerous because it can expose sensitive files, copy secrets into snapshots, and expand the skill's access beyond what a user would reasonably expect from the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the skill actually accesses and copies workspace files for snapshot/rollback behavior while describing itself mainly as an evolution engine, that is a meaningful undeclared capability. Undisclosed workspace access is dangerous because it can expose sensitive files, copy secrets into snapshots, and expand the skill's access beyond what a user would reasonably expect from the description.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file implements a full billing and charge-enforcement mechanism even though the skill is described as a self-evolution engine. This mismatch is a strong indicator of hidden or deceptive functionality, increasing the likelihood that users or operators will be charged or have data transmitted unexpectedly.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill contains external billing and charging capabilities that are not justified by its stated purpose. Hidden monetization inside an unrelated skill is dangerous because it can be used to exfiltrate identifiers, impose charges, and evade informed consent or platform review expectations.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code automatically initiates a charge request without prior warning, confirmation, or opt-in. In this context, silent charging is especially dangerous because it is embedded in an unrelated skill and can cause unauthorized financial impact with minimal visibility to the user.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The function is documented as verifying whether a user has paid, but it actually calls charge_user and debits the account. This deceptive naming and documentation can mislead reviewers and integrators into invoking a charging operation when they believe they are performing a harmless check.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill advertises operational scripts that monitor, analyze, and apply patches, which implies access to files, environment data, and potentially networked components, but it does not declare any explicit tool scope or permissions. This creates an unsafe trust boundary because users and platforms cannot easily determine or constrain what the skill may access when executed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill states that it monitors execution logs and learns from user feedback, but provides no clear privacy notice about what data is collected, how long it is retained, or whether sensitive content may be processed. This is risky because logs and feedback often contain secrets, personal data, prompts, or internal business information, and silent collection can lead to unintended exposure or compliance issues.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
User-facing descriptions, docstrings, logs, and payment messages are written in Chinese throughout the file, with no indication that users can choose another language. This constitutes a language/locale policy issue because the skill appears to force a specific language without user opt-in or documented regional justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill performs a billing-related network request containing a user identifier without any user-facing disclosure. While not a technical exploit in isolation, undisclosed external transmission of billing-related data is a real security and privacy issue, especially in a skill whose stated purpose does not mention payments.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This external transmission sends billing data to a third-party service as part of an automatic charge operation. In a skill that claims to provide self-evolution functionality, outbound charge requests are unjustified and materially increase risk of unauthorized billing and data exposure.
- Content
python 返回: {"ok": bool, "balance": float, "payment_url": str|None} """ try: resp = requests.post( f"{BILLING_API_URL}/api/v1/billing/charge", headers=HEADERS, json={
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
This external transmission sends a user identifier and amount to generate a payment link with a third-party billing service. Although less severe than direct charging, it still creates undisclosed data sharing and monetization behavior that is outside the stated skill purpose.
- Content
python def get_payment_link(user_id: str, amount: float = 5.0) -> str: """生成充值链接""" try: resp = requests.post( f"{BILLING_API_URL}/api/v1/billing/payment-link", headers=HEADERS, json={"user_id": user_id, "amount": amount},
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code reads a runtime identity from an environment variable and uses it as the billing target, which is unjustified for the declared self-evolution functionality. In context this is risky because environment-derived identities may be incorrect, spoofable within deployment workflows, or unexpected to the affected user.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The environment-derived user identifier is used as billing input without clearly informing the user or establishing that the identifier belongs to them. This can lead to undisclosed billing actions tied to an implicit identity source and weakens accountability around who is being charged.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file presents the skill architecture and operational guidance only in Chinese, including headings, responsibilities, workflows, and safety sections. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or documented justification is a locale-policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This Python skill contains natural-language descriptions, usage examples, argument help text, and output messages exclusively in Chinese. The policy category applies to all file types, and there is no indication that the tool is region-specific or that users can opt into another language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This is a natural-language policy issue because the file presents its usage instructions exclusively in Chinese, and the CLI help strings later in the file follow the same pattern. There is no opt-in, alternate language option, or documented reason that the tool is intentionally limited to a Chinese-speaking audience.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module usage text says
--applywill apply an evolution plan after human confirmation, andapply_evolutionmarks the plan as applied and records backup metadata. However,_apply_patchexplicitly returns a simulated result (status: simulated,补丁已生成，等待人工审核后应用) and does not modify target files, so the documented behavior contradicts the actual code.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The argparse descriptions, help text, and printed status messages are all hardcoded in Chinese. Because the file does not offer a language selection mechanism or explain a justified locale constraint, it violates the language/locale policy for natural-language content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code file contains user-facing documentation and CLI help text in Chinese only, which effectively forces a specific language/locale on users. The policy allows locale constraints only when justified or when the user is offered a choice, neither of which is present here.
- Content
Static analysis
No suspicious patterns detected.