T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fraud_analyzer.py:16- Finding
Hardcoded Production Database Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Check User Fraud
Security checks for vulnerabilities and agentic risk
Overview
The skill is framed as fraud analysis, but it ships a reusable database password and exposes sensitive user, login, device, payment, and account data through broad command-line lookups.
Do not install or use this skill as published. The database password should be treated as exposed and rotated, and the workflow should be rebuilt behind an authenticated, case-scoped service with read-only least privilege, masking, audit logging, and removal of arbitrary IP/user enumeration from general skill access.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/query_users_by_ip.py:12- Finding
Unauthenticated Sensitive User Data and Cross-Account Enumeration
- Content
View full analysis
DATE_SUB(NOW(), INTERVAL 7 DAY) ORDER BY l.loginTime DESC LIMIT 50 """ cursor.execute(sql, (ip_address,)) users = cursor.fetchall() ``` The command-line entry point directly passes caller-controlled input into the lookup without authenticating the caller or checking whether the caller is authorized to inspect accounts associated with the IP: ```python if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python3 query_users_by_ip.py ") print("Example: python3 query_users_by_ip.py 180.129.235.223") sys.exit(1) ip_address = sys.argv[1] result = query_users_by_ip(ip_address) ``` The broader analyzer also retrieves sensitive identity information based solely on an arbitrary user identifier: ```python self.cursor.execute(''' SELECT u.id, u.mobile, u.truename, u.regTime, u.inviteCode, IFNULL(p.userId, '') as parentId, IFNULL(i.idNo, ip.idNo) as idNo, IFNULL(ip.status, 0) as proStatus, u.level, u.me ...[truncated 3076 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:94- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (74)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README claims sensitive data is masked, but the documented output fields and SQL show direct retrieval of mobile numbers, Alipay accounts, real names, and ID numbers without any visible masking logic. This creates a substantial risk of exposing personally identifiable and financial identity data to users or downstream systems.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The README includes live-looking MySQL credentials alongside documentation for querying highly sensitive user data. Exposed database credentials can enable unauthorized direct access to the production datastore, resulting in bulk theft, tampering, or destructive actions far beyond the intended skill behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The skill documentation directly embeds live-looking database host, port, username, and password, which constitutes credential disclosure. This is critical because anyone with access to the skill can reuse those secrets to connect to the database, extract or modify sensitive data, and potentially pivot further into the environment.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script hardcodes live MySQL host, username, and password directly in source code. Anyone with repository or artifact access can reuse these secrets to connect to the production database, leading to unauthorized data access, modification, or broader compromise; in a fraud-analysis skill context, this is especially dangerous because the database likely contains sensitive user and task data.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script embeds live MySQL credentials directly in source code and uses them to query user and task records, exposing sensitive infrastructure secrets and enabling unauthorized database access if the file is leaked or reused. In a skill context, this is especially dangerous because agent-accessible code may be broadly readable, logged, or distributed, turning credential disclosure into direct data-compromise risk.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script hardcodes live MySQL host, port, username, password, and database name directly in source code. This is dangerous because anyone with access to the skill can reuse those credentials to connect to the database outside the intended workflow, leading to unauthorized access, data theft, or modification of sensitive production data.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Using hardcoded database credentials without disclosure is not merely a transparency issue here; it exposes reusable secrets directly in the source. In the context of a skill artifact that may be shared, reviewed, or deployed broadly, this makes compromise of the backend database substantially more likely.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script embeds live database host, username, and password directly in source code, enabling anyone with code access to connect to a production-like database containing sensitive user data. Hardcoded secrets are highly dangerous because they are easily leaked through repositories, logs, backups, or skill distribution, and they grant direct access outside normal application controls.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script’s stated skill purpose is fraud/shuadan analysis, but the implementation retrieves and prints broad user profile data including mobile number, Alipay account, identity information, inviter relationship, and membership details. This is dangerous because it enables unnecessary access to sensitive personal data beyond the declared use case, increasing privacy, insider-abuse, and unauthorized profiling risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The file contains hardcoded production database credentials and directly connects to a live MySQL instance. This is highly dangerous because anyone with code access can reuse the credentials to access the database outside intended controls, potentially leading to full data compromise, unauthorized querying, modification, or persistence.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script queries and displays sensitive personal data with no privacy warning, consent check, authorization gate, or minimization controls. In this skill context, that is more dangerous because the manifest frames the capability as fraud analysis, while the implementation effectively acts as a user-detail lookup tool exposing personal and account data to the operator.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The query accesses sensitive PII such as mobile number, Alipay account, real name, and government ID number without clear necessity for the described fraud-analysis function. Even though the ID number is partially masked on output, the code still reads the full value from the database, which expands exposure if logs, exceptions, or downstream handling are compromised.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file’s documented purpose and implementation focus on retrieving detailed user login history, including IP, device ID, location, and timestamps, which is broader and more privacy-invasive than the skill’s stated fraud-analysis role. This creates a capability mismatch that can enable unauthorized surveillance or secondary use of sensitive account activity data.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script hardcodes live database credentials directly in source code and uses them to access sensitive login history. If the code is exposed, reused, or logged, an attacker could obtain direct database access and extract or modify highly sensitive user data at scale.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script directly connects to a production-like database and retrieves privacy-impacting user visit logs without any visible notice, consent flow, or user-facing warning. Because the data includes visit times, device IDs, IP addresses, and related metadata, the skill context makes this more dangerous: it presents itself as fraud analysis while silently enabling broad personal activity inspection.
- Content
Static analysis
No suspicious patterns detected.