Check User Fraud

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:21 AM UTC
• Version: 1.0.0

Overview

The skill is framed as fraud analysis, but it ships a reusable database password and exposes sensitive user, login, device, payment, and account data through broad command-line lookups.

Do not install or use this skill as published. The database password should be treated as exposed and rotated, and the workflow should be rebuilt behind an authenticated, case-scoped service with read-only least privilege, masking, audit logging, and removal of arbitrary IP/user enumeration from general skill access.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fraud_analyzer.py:16
• Finding: Hardcoded Production Database Credentials<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/fraud_analyzer.py:16-23` - `scripts/analyze_task_completers.py:17-23` - `scripts/analyze_user_publisher_tasks.py:16-22` - `scripts/analyze_user_tasks_completers.py:17-23` - `scripts/check_fraud.py:16-22` - `scripts/check_fraud_enhanced.py:17-23` - `scripts/query_user_detail.py:16-22` - `scripts/query_user_login_logs.py:16-22` - `scripts/query_user_task_ops.py:16-22` - `scripts/query_user_visit_logs.py:16-22` - `scripts/query_users_by_ip.py:16-22` - `SKILL.md:54-59` - `README.md:135-144` **Vulnerability Type**: Hardcoded database secret and insecure credential distribution **Risk Level**: Critical ### Vulnerable Code ```python DB_CONFIG = { 'host': 'rr-wz97dxha81orq30j0eo.mysql.rds.aliyuncs.com', 'port': 3389, 'user': 'oc_gw', 'password': 'm83KkZVLQp2Wg7HgDVb5cRjQ', 'database': 'yc_db', 'charset': 'utf8mb4' } ``` The same endpoint, username, and password are also published in the project documentation and duplicated across the query scripts. ### Technical Analysis The package embeds a reusable credential for an externally addressed Alibaba Cloud MySQL database. Anyone who can read the project can extract the credential and attempt to connect to the database without going through an authenticated application or authorization-enforcing service. The secret is not scoped to an individual operator or invocation. Its duplication across source files and documentation also makes revocation and secret rotation more difficult. Removing it from only one file would not eliminate the exposure, and prior copies may remain in distribution archives or version-control history. The connection configuration does not explicitly enable certificate-validated TLS. Consequently, the code does not demonstrate that database server identity or transport confidentiality is enforced. ### Attack Path 1. An attacker downloads, receives, or otherwise reads the Skill package. 2. The attacker extra ...[truncated 1325 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the exposed database password. 2. Review database audit logs for connections and queries made using the exposed account. 3. Remove the credential from every source file, documentation file, release artifact, and version-control revision. 4. Treat the credential as compromised even if the database is currently protected by network filtering. 5. Replace direct database access with an authenticated internal API that performs: - Operator authentication - Role-based authorization - Case-scoped access checks - Row-level authorization - Output minimization and masking - Query auditing and rate limiting 6. If direct database access is operationally unavoidable, retrieve short-lived credentials from an approved secret manager rather than environment-independent plaintext files. 7. Restrict the database account to read-only access on narrowly defined views containing only fields required for fraud analysis. 8. Apply network allowlisting and deny public database access wherever possible. 9. Require TLS with certificate and hostname validation. 10. Use separate credentials per service or operator so access can be attributed and independently revoked. 11. Add automated secret scanning to CI and pre-commit checks. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/query_users_by_ip.py:12
• Finding: Unauthenticated Sensitive User Data and Cross-Account Enumeration<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/query_users_by_ip.py:12-95` - `scripts/query_user_detail.py:12-109` - `scripts/query_user_login_logs.py:12-108` - `scripts/query_user_visit_logs.py:12-108` - `scripts/query_user_task_ops.py:12-143` - `scripts/fraud_analyzer.py:41-196` - `README.md:151-309` **Vulnerability Type**: Missing authorization controls and excessive sensitive-data exposure **Risk Level**: High ### Vulnerable Code The IP lookup accepts an arbitrary IP address and returns identity, login, location, and device information for as many as 50 associated accounts: ```python sql = """ SELECT DISTINCT(u.userId), u.id, u.mobile, u.truename, u.regTime, l.loginTime, l.deviceId, a.`name` as appName, l.channel, c.provice, c.city FROM t_user_loginlogs_2022 l INNER JOIN t_user u ON l.userId = u.id INNER JOIN t_sys_app a ON a.`code` = l.appId INNER JOIN t_ip_config c ON c.id = INET_ATON(l.ip) WHERE l.ip = %s AND l.loginTime > DATE_SUB(NOW(), INTERVAL 7 DAY) ORDER BY l.loginTime DESC LIMIT 50 """ cursor.execute(sql, (ip_address,)) users = cursor.fetchall() ``` The command-line entry point directly passes caller-controlled input into the lookup without authenticating the caller or checking whether the caller is authorized to inspect accounts associated with the IP: ```python if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python3 query_users_by_ip.py <ip>") print("Example: python3 query_users_by_ip.py 180.129.235.223") sys.exit(1) ip_address = sys.argv[1] result = query_users_by_ip(ip_address) ``` The broader analyzer also retrieves sensitive identity information based solely on an arbitrary user identifier: ```python self.cursor.execute(''' SELECT u.id, u.mobile, u.truename, u.regTime, u.inviteCode, IFNULL(p.userId, '') as parentId, IFNULL(i.idNo, ip.idNo) as idNo, IFNULL(ip.status, 0) as proStatus, u.level, u.me ...[truncated 3076 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove direct production-database access from standalone command-line tools. 2. Place all sensitive queries behind an authenticated internal service. 3. Enforce role-based and case-scoped authorization before every lookup. 4. Apply row-level controls so operators can access only users assigned to an active investigation. 5. Eliminate arbitrary IP-based enumeration or require elevated, separately audited approval for it. 6. Return aggregate fraud indicators instead of raw identity, device, location, and financial records. 7. Mask phone numbers, names, payment identifiers, IP addresses, and device IDs by default. 8. Do not query identity-document fields unless they are indispensable to a documented investigation. 9. Add per-operator rate limits, anomaly detection, and immutable audit logs. 10. Separate identity, financial, login, and fraud-feature data into independently authorized services or database views. 11. Define retention limits for generated reports and prevent terminal or JSON output from being stored in general-purpose logs. 12. Replace the shared database credential with unique, short-lived credentials tied to an authenticated identity. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:94
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:94` **Vulnerability Type**: Unpinned dependency and unsafe package resolution **Risk Level**: Medium ### Vulnerable Code ```bash pip install pymysql ``` ### Technical Analysis The setup instruction installs `pymysql` without specifying an audited version, cryptographic hash, lock file, or trusted package index. The installed artifact therefore depends on the package index and resolver configuration in the operator's environment at installation time. Possible supply-chain failure modes include: - A future compromised or malicious package release - A compromised package index or mirror - A malicious package served through an attacker-controlled index configuration - Non-reproducible installation of a version that has not been reviewed with the Skill This risk is amplified because imported database code executes in a process that has direct access to the embedded production credential and sensitive query results. ### Attack Path 1. An operator follows the installation instruction. 2. `pip` resolves `pymysql` from the configured package index without a version or hash constraint. 3. A compromised index, mirror, account, or package release supplies attacker-controlled code. 4. The malicious package executes during installation or when imported by the scripts. 5. The package reads the hardcoded database credentials from source or process memory. 6. It can access, alter, or exfiltrate data available to the executing user and database account. ### Impact Assessment Malicious dependency code would execute with the privileges of the user running `pip` or the fraud-analysis scripts. It could access: - Local files available to that operating-system user - The embedded production database credential - Database query results containing sensitive user data - Environment variables and other process-accessible secrets - Network resources reachable from the host The maximum impact depends on the privile ...[truncated 60 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `PyMySQL` to a specifically reviewed version. 2. Record cryptographic hashes for all dependency artifacts. 3. Install dependencies using a locked requirements file and hash verification, for example: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Use an approved internal package mirror or an explicitly configured trusted index. 5. Generate and review a software bill of materials for releases. 6. Run dependency vulnerability and provenance scanning in CI. 7. Install into an isolated virtual environment under a non-privileged account. 8. Prevent installation hooks from having access to production credentials. 9. Update dependencies through a controlled review process rather than resolving the latest available release at runtime. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (74)

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The README claims sensitive data is masked, but the documented output fields and SQL show direct retrieval of mobile numbers, Alipay accounts, real names, and ID numbers without any visible masking logic. This creates a substantial risk of exposing personally identifiable and financial identity data to users or downstream systems.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The README includes live-looking MySQL credentials alongside documentation for querying highly sensitive user data. Exposed database credentials can enable unauthorized direct access to the production datastore, resulting in bulk theft, tampering, or destructive actions far beyond the intended skill behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A skill described as user-focused fraud analysis but actually querying by IP and clustering accounts/devices is performing a different, broader investigative function. That mismatch can facilitate unauthorized correlation of users across accounts and devices, which is especially sensitive because it expands from behavior scoring into identity linkage and surveillance.

Context-Inappropriate Capability

High

• Confidence: 100% confidence
• Finding: The skill documentation directly embeds live-looking database host, port, username, and password, which constitutes credential disclosure. This is critical because anyone with access to the skill can reuse those secrets to connect to the database, extract or modify sensitive data, and potentially pivot further into the environment.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script hardcodes live MySQL host, username, and password directly in source code. Anyone with repository or artifact access can reuse these secrets to connect to the production database, leading to unauthorized data access, modification, or broader compromise; in a fraud-analysis skill context, this is especially dangerous because the database likely contains sensitive user and task data.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script embeds live MySQL credentials directly in source code and uses them to query user and task records, exposing sensitive infrastructure secrets and enabling unauthorized database access if the file is leaked or reused. In a skill context, this is especially dangerous because agent-accessible code may be broadly readable, logged, or distributed, turning credential disclosure into direct data-compromise risk.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script hardcodes live MySQL host, port, username, password, and database name directly in source code. This is dangerous because anyone with access to the skill can reuse those credentials to connect to the database outside the intended workflow, leading to unauthorized access, data theft, or modification of sensitive production data.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Using hardcoded database credentials without disclosure is not merely a transparency issue here; it exposes reusable secrets directly in the source. In the context of a skill artifact that may be shared, reviewed, or deployed broadly, this makes compromise of the backend database substantially more likely.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script embeds live database host, username, and password directly in source code, enabling anyone with code access to connect to a production-like database containing sensitive user data. Hardcoded secrets are highly dangerous because they are easily leaked through repositories, logs, backups, or skill distribution, and they grant direct access outside normal application controls.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script’s stated skill purpose is fraud/shuadan analysis, but the implementation retrieves and prints broad user profile data including mobile number, Alipay account, identity information, inviter relationship, and membership details. This is dangerous because it enables unnecessary access to sensitive personal data beyond the declared use case, increasing privacy, insider-abuse, and unauthorized profiling risk.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The file contains hardcoded production database credentials and directly connects to a live MySQL instance. This is highly dangerous because anyone with code access can reuse the credentials to access the database outside intended controls, potentially leading to full data compromise, unauthorized querying, modification, or persistence.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The script queries and displays sensitive personal data with no privacy warning, consent check, authorization gate, or minimization controls. In this skill context, that is more dangerous because the manifest frames the capability as fraud analysis, while the implementation effectively acts as a user-detail lookup tool exposing personal and account data to the operator.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The query accesses sensitive PII such as mobile number, Alipay account, real name, and government ID number without clear necessity for the described fraud-analysis function. Even though the ID number is partially masked on output, the code still reads the full value from the database, which expands exposure if logs, exceptions, or downstream handling are compromised.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file’s documented purpose and implementation focus on retrieving detailed user login history, including IP, device ID, location, and timestamps, which is broader and more privacy-invasive than the skill’s stated fraud-analysis role. This creates a capability mismatch that can enable unauthorized surveillance or secondary use of sensitive account activity data.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script hardcodes live database credentials directly in source code and uses them to access sensitive login history. If the code is exposed, reused, or logged, an attacker could obtain direct database access and extract or modify highly sensitive user data at scale.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The script directly connects to a production-like database and retrieves privacy-impacting user visit logs without any visible notice, consent flow, or user-facing warning. Because the data includes visit times, device IDs, IP addresses, and related metadata, the skill context makes this more dangerous: it presents itself as fraud analysis while silently enabling broad personal activity inspection.

Static analysis

No suspicious patterns detected.