Security audit

Traffic Standards Knowledge Base

Security checks for vulnerabilities and agentic risk

Overview

The skill has a real standards-lookup purpose, but it pushes proactive third-party API use and includes a public shared token and broad mutable install instructions.

Install only if you are comfortable sending standards lookup queries to solvexpert.net. Avoid sending customer names, exact locations, bid details, unpublished architecture, credentials, or full proposal text; prefer minimal generic keywords. Use project-local installation, avoid update-to-latest without review, and avoid storing long-lived API keys in agent-wide settings when a narrower secret mechanism is available.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:16
Finding: Unpinned Third-Party Installation and Update Commands
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:74
Finding: Publicly Embedded Shared Authentication Token
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:131
Finding: Forced Third-Party Transmission of User Query Content Without Consent Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (29)

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 92% confidence
Finding: The README instructs users to place an API key in ~/.claude/settings.json, which is part of the agent configuration directory and may be more broadly accessible to agent tooling, plugins, or debugging flows than users expect. Storing secrets in agent configuration increases the blast radius if the agent environment is exposed, and the skill context is more dangerous because the same document encourages automated external calls using that credential.
Content: Scanner excerpt · README.md (reported line 76)May include surrounding context.
md
| 优先级 | 配置方式 | 适用场景 | |--------|---------|---------| | 1 | Shell 环境变量 | Bash 命令调用 API | | 2 | `~/.claude/settings.json` | Claude 内部使用 | | 3 | 请求头手动传入 | 临时使用 | **方式一：Shell 环境变量（推荐用于 Bash 命令）**

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 92% confidence
Finding: The skill instructs users to place the API key in ~/.claude/settings.json, an agent configuration location that may be broadly accessible to the agent runtime and other skills. Encouraging storage of secrets in a general agent config increases the risk of inadvertent disclosure, prompt-assisted retrieval, or cross-skill exposure if config data is ever surfaced.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
# Option 1: Export in shell (for bash commands) export STANDARDS_API_KEY="solvex-your-api-key" # Option 2: Add to ~/.claude/settings.json (for Claude internal use) { "env": { "STANDARDS_API_KEY": "solvex-your-api-key"

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README.md (reported line 152)May include surrounding context.
Minimum Working Request

bash
curl -s -X POST "https://solvexpert.net/api/v1/standards/query" \ -H "Content-Type: application/json" \ -H "X-API-Key: $STANDARDS_API_KEY" \ -d '{

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
Minimum Working Request

bash
curl -s -X POST "https://solvexpert.net/api/v1/standards/query" \ -H "Content-Type: application/json" \ -H "X-API-Key: $STANDARDS_API_KEY" \ -d '{

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · api-reference.md (reported line 18)May include surrounding context.
-d '{...}'

text
Get API Key from: https://solvexpert.net ## Configuration

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · api-reference.md (reported line 111)May include surrounding context.
-d '{...}'

text
Get API Key from: https://solvexpert.net ## Configuration

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 73% confidence
Finding: The entire skill description, triggers, and usage guidance are written only in Chinese and are framed around a mandatory workflow without indicating whether other languages are supported or whether the user can opt into a preferred locale. Under the language/locale policy, forcing a specific language without user choice can be a natural-language policy violation unless clearly justified and documented as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README explicitly describes converting natural-language user questions into queries sent to an external API, but it provides no privacy warning or data-minimization guidance. In the context of proposal writing and bid documents, users may include unpublished project scope, customer names, locations, budgets, or regulated infrastructure details, creating a real confidentiality and compliance risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger condition is extremely broad, instructing proactive activation for virtually any transportation-related drafting task. In an agent setting, this can cause unnecessary external API calls with user content, increasing the chance that confidential proposal text, bid material, or project details are sent off-platform without clear user intent.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The example sends user-supplied questions and an API key to https://solvexpert.net/api/v1/standards/query, confirming external transmission of potentially sensitive content. In this skill's context, the transmitted data may contain details from transportation designs, procurement drafts, or operational plans, so the danger is the privacy and data-governance exposure rather than code execution.
Content: Scanner excerpt · README.md (reported line 152)May include surrounding context.
请求示例

bash
curl -s -X POST "https://solvexpert.net/api/v1/standards/query" \ -H "Content-Type: application/json" \ -H "X-API-Key: $STANDARDS_API_KEY" \ -d '{

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Line L278 says '必须通过 Solvex API 查询，不要直接调用 RAG API', which asserts a clear intent restriction. However, the workflow at L052-L058 describes direct use of the SearchBots API endpoints after the standards query, so the documentation contradicts itself about whether direct RAG API access is part of the skill's behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description says the skill is for writing Chinese smart transportation solutions, which imposes a specific language/locale expectation. Elsewhere the file reinforces this Chinese-only framing without stating that users may choose another language or that the restriction is a documented regional-compliance requirement.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The prerequisites claim an API key is required, but the usage notes state requests will fail unless a separate fixed token is always supplied. This mismatch obscures the real authentication model and can trick users into relying on hidden shared credentials, undermining accountability, revocation, and least-privilege controls.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
Minimum Working Request

bash
curl -s -X POST "https://solvexpert.net/api/v1/standards/query" \ -H "Content-Type: application/json" \ -H "X-API-Key: $STANDARDS_API_KEY" \ -d '{

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation embeds and requires a fixed searchAuthToken, which appears to function as shared authentication material separate from the user's API key. Hardcoding a reusable token in public skill content can enable unauthorized access, token abuse, quota theft, and confused-deputy behavior where users unknowingly operate under a shared credential.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api-reference.md (reported line 12)May include surrounding context.
Header: X-API-Key: $STANDARDS_API_KEY

bash
curl -X POST "https://solvexpert.net/api/v1/standards/query" \ -H "Content-Type: application/json" \ -H "X-API-Key: $STANDARDS_API_KEY" \ -d '{...}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api-reference.md (reported line 65)May include surrounding context.
Header: X-API-Key: $STANDARDS_API_KEY

bash
curl -X POST "https://solvexpert.net/api/v1/standards/query" \ -H "Content-Type: application/json" \ -H "X-API-Key: $STANDARDS_API_KEY" \ -d '{...}'

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

other

SkillSpector

Agent Config Directory Access

Agent Config Directory Access

External Script Fetching

Minimum Working Request

External Script Fetching

Minimum Working Request

Credential Access

Credential Access

Natural-Language Policy Violations

Missing User Warnings

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Vague Triggers

External Transmission

请求示例

Intent-Code Divergence

Natural-Language Policy Violations

Intent-Code Divergence

External Transmission

Minimum Working Request

Context-Inappropriate Capability

External Transmission

External Transmission

Static analysis