Security audit

Hdl Skills Hub

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent HDL smart-home and shopping API hub, but it asks the agent to handle raw passwords, local app secrets, tokens, and real-world device controls without enough scoping or consent safeguards.

Review this skill before installing. It should only be used in an environment that can protect .env secrets, prevent passwords from being stored in chat transcripts, scope HDL tokens, and require explicit confirmation for cart changes and smart-home device control. Prefer a secure login handoff or secret-input mechanism over typing passwords into chat.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:67
Finding: Authentication Passwords Are Collected Through the Conversational Channel
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: sign-encryption-api/SKILL.md:14
Finding: Request Signature Excludes Security-Sensitive Structured Fields
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to locate and read a root .env file containing core credentials (AppKey, Secret). Embedding instructions for an LLM-driven skill to access local secret material expands the attack surface: prompt injection, skill confusion, or downstream tool misuse could cause unauthorized credential use or accidental disclosure, especially because this hub skill orchestrates multiple authenticated business actions.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
AI 必须根据以下相对结构定位系统资源：

text
. ├── .env <-- 核心凭据文件 (AppKey, Secret, HomeId) ├── SKILL.md <-- 导航塔 (本文件) ├── assets/ │ └── images/ <-- 本地多媒体资源 (设备状态图片)

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: This section reiterates that the agent must read .env for AppKey/Secret and then use those values to perform authentication flows automatically. Even though the text says not to show secrets to the user, instructing an agent to handle raw credentials from local storage is dangerous because a compromised prompt path, tool bug, or logging path could expose secrets or let the skill perform privileged actions beyond user intent.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
- **房屋 ID (homeId) 动态获取**: 严禁在 `.env` 中硬编码 `homeId`。AI 必须在执行设备控制前，先通过 **[房屋管理 (home-management-api)](./home-management-api/SKILL.md)** 获取用户当前的房屋列表及其对应的 `homeId`。 - **支持多房屋控制**: AI 必须允许用户在不同房屋间切换，并根据选定的房屋动态更新请求参数。 - **严禁**要求用户填写、确认或核对 AppKey 和 AppSecret。 - 若 `.env` 缺失或读取失败，AI 必须**立即停止**所有业务调用，并告知：“系统配置缺失，请检查 .env 文件。” 2. **强制 Token 准入 (No Token, No Call)**: - **前置检查**: 在调用任何业务接口前，AI 必须检查当前会话是否存在有效的 `accessToken`。 - **获取/刷新逻辑**:

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill asserts that the signing process must never be described, yet it fully discloses the filtering rules, sort order, secret concatenation method, and a worked example. In an authenticated skill that serves as a core signing reference, this materially lowers the barrier for reverse engineering and unauthorized client implementation, and it normalizes embedding sensitive internal security logic in prompt-accessible documentation.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The skill combines two sensitive behaviors: instructing the agent to obtain a user's login password and directing it to use application secrets from a local .env file to authenticate against the HDL backend. This creates a credential-access and credential-brokering workflow in which both user credentials and local secrets are operationalized by the agent, increasing the blast radius if the skill, environment, or downstream logging is compromised.
Content: Scanner excerpt · user-auth-api/SKILL.md (reported line 85)May include surrounding context.
md
3. **用户**: “19210818109” 4. **AI**: “好的。现在请提供 **登录密码**。” 5. **用户**: “******” 6. **AI**: (自动结合 .env 中的 AppKey/Secret 登录成功) -> “登录成功！正在为您查询方悦面板... ✅” ### 场景 B: 认证失败 1. **AI**: “❌ **认证失败**：用户名或密码不正确。让我们重新开始。请输入您的 **用户名**：”。

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The mandated login guidance is written as required user-facing phrasing in Chinese and the file consistently defines interaction behavior in Chinese without indicating that the user may choose another language. This creates a locale/language policy concern because the skill appears to enforce a specific language rather than offering user preference or opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill name, description, and behavioral instructions are entirely in Chinese, which can impose a specific language on users without any opt-in or alternative locale. This matches the language/locale policy violation category because the file does not document a justified region-specific constraint or offer language choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill exposes physical device control capabilities but does not prominently warn that actions can change the user’s real-world environment, such as turning on devices, changing temperature, or actuating curtains. In smart-home contexts, missing safety warnings and confirmation guidance increase the chance of unsafe or unintended physical actions, especially when combined with broad authenticated access.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill’s security requirements conflict with its parameter documentation: it first requires dynamically obtaining the user-selected homeId from the home-management skill, then later states homeId must be fixed to ${HDL_HOME_ID}. In a device-control context, this ambiguity can cause commands to be sent to the wrong home, enabling unintended cross-home device access or actuation if an agent follows the wrong instruction path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The instruction hard-codes a Chinese prompt the AI must ask the user, which imposes a specific language on interactions. This is a natural-language policy issue because the file does not offer any user language preference or opt-in mechanism.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to read credentials from a root-level ../.env file, which expands the skill from product lookup into local secret access. That creates a secret-exfiltration and privilege-boundary violation risk, especially because a product query does not inherently require filesystem credential discovery by the model itself.
Content: No source excerpt is available for this finding.

Scope Creep

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The declared permission is only authenticated, but the documented behavior requires access to local application secrets such as HDL_APP_SECRET and tokens from .env. This is a privilege mismatch that can mislead reviewers and users about the true capability of the skill and enable unauthorized secret handling under a lower-trust permission label.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill directs sensitive credential handling from a local .env file without any explicit user-facing warning or consent boundary. This increases the chance that secrets are accessed or propagated silently in normal use, reducing transparency around highly sensitive operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill sends authentication and signed request metadata to an external endpoint but does not clearly warn the user that product queries involve network transmission of identity-bearing data. While external API use is expected in an API skill, lack of transparency can cause unanticipated disclosure of operational metadata.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 84% confidence
Finding: The documentation exposes internal local file:/// paths to other skills, revealing repository structure, usernames, and skill layout. This aids skill enumeration and can help an attacker map internal components involved in authentication flows, increasing the usefulness of prompt-injection or lateral-discovery attacks.
Content: Scanner excerpt · product-query-api/SKILL.md (reported line 43)May include surrounding context.
md
| `supplierName` | String | 否 | 供应商名称。 | `"广州河东"` | | `productSaleTypes` | List<String>| 否 | 产品在售类型，通常由系统填充。 | `["STANDARDS"]` | | `zoneType` | String | 否 | 区域类型。 | `"DOMESTIC"` | | `accessToken` | String | 否 | **(BaseDTO)** 用户身份令牌（系统自动处理）。来源：[user-auth-api](file:///Users/super_song/Project/hdl-project/hdl-mcp-server/src/main/resources/.claude/skills/user-auth-api/SKILL.md)。 | `"Bearer eyJhbG..."` | | `appKey` | String | 否 | **(BaseDTO)** 应用标识。固定为 `${HDL_APP_KEY}`。 | `${HDL_APP_KEY}` | | `timestamp` | Long | 否 | **(BaseDTO)** 当前 13 位毫秒级时间戳。 | `1774425423000` | | `sign` | String | 否 | **(BaseDTO)** 安全签名。生成算法参考：[sign-encryption-api](file:///Users/super_song/Project/hdl-project/hdl-mcp-server/src/main/resources/.claude/skills/sign-encryption-api/SKILL.md)。注意：使用 `AppSecret: ${HDL_APP_SECRET}` 进行签名。 | `"abc123xyz..."` |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 84% confidence
Finding: The skill references another internal signing skill via an absolute file path and explicitly mentions use of AppSecret for signing, which leaks architectural details about where sensitive signing logic resides. In context, this makes the skill more dangerous because it combines secret access guidance with a map to adjacent high-value auth/signing components.
Content: Scanner excerpt · product-query-api/SKILL.md (reported line 46)May include surrounding context.
md
| `accessToken` | String | 否 | **(BaseDTO)** 用户身份令牌（系统自动处理）。来源：[user-auth-api](file:///Users/super_song/Project/hdl-project/hdl-mcp-server/src/main/resources/.claude/skills/user-auth-api/SKILL.md)。 | `"Bearer eyJhbG..."` | | `appKey` | String | 否 | **(BaseDTO)** 应用标识。固定为 `${HDL_APP_KEY}`。 | `${HDL_APP_KEY}` | | `timestamp` | Long | 否 | **(BaseDTO)** 当前 13 位毫秒级时间戳。 | `1774425423000` | | `sign` | String | 否 | **(BaseDTO)** 安全签名。生成算法参考：[sign-encryption-api](file:///Users/super_song/Project/hdl-project/hdl-mcp-server/src/main/resources/.claude/skills/sign-encryption-api/SKILL.md)。注意：使用 `AppSecret: ${HDL_APP_SECRET}` 进行签名。 | `"abc123xyz..."` | | `requestId` | String | 否 | **(BaseDTO)** 请求唯一 ID。 | `"req_001"` | ## 2.2 完整请求 JSON 示例

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to read credentials from ../.env and forbids asking the user, which removes user control over credential sourcing and encourages secret access from local files. In an adversarial or over-permissive agent environment, this pattern can normalize unauthorized secret retrieval and lead to credential exposure or misuse beyond the user's intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The file is predominantly written in Chinese and instructs the AI how to respond and handle failures, but does not offer any user language choice or opt-in. This can constitute a locale/language policy issue because the skill effectively constrains interaction language and guidance to a single language without documenting that limitation as a justified region-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The skill name, description, prompts, and interaction examples are entirely in Chinese, and the sample dialogue directs the interaction in Chinese without any indication that users may choose another language. For this rule, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicit and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs the agent to collect a username and password from the user for submission to a remote authentication API, but it does not warn the user that these credentials will be transmitted off-platform to an external service. This creates a phishing-like credential collection flow and undermines informed consent, especially because the skill is a generic hub entry point rather than a clearly bounded first-party login UI.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: L164-L170 声称在接口无返回时应使用“本地资源 (Local Assets)”，但给出的“存放路径”是一个远程 OSS URL；同时 L193 和 L199 的示例又使用相对路径 ../assets/images/... 作为本地文件。文档同时把同一类资源描述为远程 URL 和本地相对路径，属于注释/说明层面的直接冲突。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: SQP-3 applies to all file types and includes language or locale policy violations. These lines require the AI to translate device states into fixed developer-specified terms, which constrains language output behavior without indicating user choice or a documented locale-specific justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This skill performs a state-changing action by adding items to a user's cart, but the description does not clearly warn that invoking it modifies account state. In an agent setting, lack of an explicit side-effect warning increases the risk of unintended purchases workflow manipulation or silent cart changes without sufficiently informed user consent.
Content: No source excerpt is available for this finding.