ima-team-board-socneo

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

This is a straightforward IMA message-board client that sends board content to Tencent IMA using user-provided API credentials, which matches its stated purpose.

Install this only if you intend to connect an agent to Tencent IMA. Use credentials limited to the intended workspace or boards where possible, avoid putting sensitive unrelated notes in reachable boards, keep board IDs private, and prefer a pinned dependency or lockfile for `requests`.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:17
• Finding: Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `README.md:17` **Vulnerability Type**: Unpinned dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash pip install requests ``` ### Technical Analysis The installation command does not specify a reviewed version, lockfile, package hash, or trusted package index. Consequently, installation results may change over time and are determined by the active Python package index and resolver configuration. If the configured package index is compromised, replaced by an untrusted mirror, or serves a malicious future release, following this instruction could install attacker-controlled code. Python packages may execute code during installation, while imported package code executes with the privileges of the application process. The dependency name itself is legitimate and there is no evidence that the project intentionally references a malicious package. Exploitation therefore requires an external supply-chain compromise or an attacker-controlled package source. ### Attack Path 1. An attacker compromises the configured package index, dependency distribution channel, or network/package-manager configuration. 2. The attacker makes a malicious version of `requests` available as the version selected by pip. 3. A user follows the documented `pip install requests` instruction. 4. Pip downloads and installs the malicious release because no version or integrity hash is enforced. 5. Malicious code executes during package installation or when `ima_board.py` imports `requests`. ### Impact Assessment Malicious dependency code would execute with the privileges of the user or service installing or running this skill. Depending on those privileges, it could access local files, environment variables, and the IMA credentials stored in `IMA_OPENAPI_CLIENTID` and `IMA_OPENAPI_APIKEY`; make network requests; alter application behavior; or compromise other data available to the proces ...[truncated 126 chars]
• Remediation: ## Remediation Suggestions - Pin `requests` to a specifically reviewed version rather than allowing unrestricted resolution. - Maintain dependencies in a requirements or lock file. - Record and enforce cryptographic hashes, such as with pip's `--require-hashes` option. - Install packages only from an explicitly configured, trusted package index. - Integrate dependency vulnerability and provenance scanning into release workflows. - Periodically review and deliberately update the pinned version after security testing. Example hardened workflow: ```text requests==<reviewed-version> --hash=sha256:<verified-package-hash> ``` ```bash python -m pip install --require-hashes -r requirements.txt ```

T09 · Insecure Skill Coding Practices

Note

• Location: ima_board.py:52
• Finding: Outbound API Requests Have No Timeout## Vulnerability Details **File Location**: `ima_board.py:52` **Vulnerability Type**: Unbounded network operation **Risk Level**: Low ### Vulnerable Code ```python def _request(self, endpoint: str, data: Dict) -> Dict: """发送 API 请求""" url = f"{self.base_url}/{endpoint}" response = requests.post(url, headers=self.headers, json=data) response.raise_for_status() return response.json() ``` ### Technical Analysis The `requests.post` call does not provide a `timeout` argument. The Requests library does not impose a default overall timeout, so a connection or response that stalls can block the caller indefinitely. The destination is a fixed HTTPS service rather than a user-controlled URL, which reduces direct exploitability. Nevertheless, a service outage, stalled upstream connection, network-level interference, or compromised endpoint that accepts a connection without completing its response can hold an Agent worker or CLI process open until an external supervisor terminates it. ### Attack Path 1. A user or automated Agent invokes an operation such as `create_board`, `append_message`, `read_board`, or `list_boards`. 2. `_request` opens a connection to the configured IMA endpoint. 3. The remote endpoint or an intermediary accepts or partially establishes the connection but does not complete the response. 4. Because no connect or read timeout is set, the call remains blocked. 5. Repeated invocations can consume available workers, threads, process slots, or other execution resources. ### Impact Assessment This issue primarily affects availability. It does not directly grant additional privileges or permit code execution. A successful denial-of-service condition can prevent the current process from completing and, in a worker-based deployment, may progressively exhaust the application's execution capacity. The affected scope includes every operation routed through `_request`.
• Remediation: ## Remediation Suggestions - Configure finite connect and read timeouts for every outbound request. - Catch `requests.Timeout` and return or raise a controlled application-specific error. - Apply narrowly bounded retries only to transient failures and idempotent operations. - Use exponential backoff with jitter and a maximum retry count. - Add an external execution deadline or cancellation mechanism for automated Agent workers. - Avoid automatically retrying document-creation or append operations unless the API provides idempotency guarantees. Example: ```python def _request(self, endpoint: str, data: Dict) -> Dict: url = f"{self.base_url}/{endpoint}" try: response = requests.post( url, headers=self.headers, json=data, timeout=(5, 30), ) response.raise_for_status() return response.json() except requests.Timeout as exc: raise RuntimeError("The IMA API request timed out") from exc ```

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises network access and use of environment-based API credentials, but its manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates a security transparency gap: a host or reviewer cannot easily enforce least privilege or understand that the skill may read secrets from the environment and make outbound API calls. The 'Security audit passed' text slightly increases suspicion because it may encourage trust without actually constraining capability.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file's descriptive text and all user-facing CLI messages are written exclusively in Chinese, with no indication that users may choose another language or locale. This can violate language/locale policy when a skill imposes a specific language without user opt-in.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This code posts user-supplied board content, document IDs, and authentication headers to a remote IMA API endpoint via HTTP requests. Although the methods are documented functionally, there is no user-facing warning, confirmation, or privacy notice explaining that message content will be sent to an external service.

External Transmission

Medium

• Category: Data Exfiltration

Content

def _request(self, endpoint: str, data: Dict) -> Dict:
        """发送 API 请求"""
        url = f"{self.base_url}/{endpoint}"
        response = requests.post(url, headers=self.headers, json=data)
        response.raise_for_status()
        return response.json()

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The initializer accesses sensitive credentials from environment variables to authenticate API calls. While this is a common pattern, the file does not include any warning or documentation note telling users that API secrets are required and will be used by the skill.

Static analysis

No suspicious patterns detected.