T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/download.py:45- Finding
Unsafe Solicitation of Reusable Cloud-Storage Session Cookies
- Content
View full analysis
- Remediation
View remediation
Security audit
Cloud Share Downloader
Security checks for vulnerabilities and agentic risk
Overview
The skill claims automatic cloud-link saving, but it can ask users to provide reusable cloud account cookies without clear upfront warning.
Review before installing. Do not paste Baidu, Aliyun, or other cloud-storage Cookies into chat or an agent workflow; those can act like account session credentials. Only use this skill with non-sensitive content you are authorized to copy and re-share, and prefer a version that uses official delegated authorization and clearly states storage, sharing, retention, and deletion behavior.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill advertises fully automatic cloud-share downloading and saving, but the described behavior is broader and inconsistent with that purpose, including handling unrelated social/video links and implying actions it may not actually perform. This kind of capability mismatch is dangerous because it can mislead users into sharing links, credentials, or expecting storage/resharing behavior without accurate disclosure, which increases the risk of data mishandling and abusive collection.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instruction '请提供网盘的Cookie，我可以帮你保存' is a direct request for sensitive authentication data. In this skill context, that is especially dangerous because the skill advertises automatic downloading/saving, making the cookie request appear operationally necessary while actually enabling full session hijacking, unauthorized file access, and possible account takeover.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill says it will store files in the operator's cloud account and return a new share link, but it does not warn users that their submitted links and retrieved content will be processed, stored, and re-shared. That omission is dangerous because users may unknowingly transfer potentially sensitive or copyrighted content into a third party account, creating privacy, compliance, and unauthorized redistribution risks.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module docstring claims the downloader is '无需登录' ('no login required'), but the implementation later requests cookies for Baidu and Aliyun. This kind of misleading claim can lower user caution and make them more likely to disclose sensitive authentication material under false pretenses.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
SQP-3 applies to all file types, including code comments, docstrings, and user-facing strings. The script's title, prompts, and operational messages are entirely in Chinese and present a fixed-language interaction model, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest focuses on '网盘分享链接转存' and related cloud-drive download/save actions, which implies handling shared cloud storage links. However, the code explicitly treats Douyin, Kuaishou, Bilibili, and Weibo links as supported inputs, broadening the behavior into general social-media/video downloading rather than cloud-share transfer.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The function documentation says users only need to send a link and that processing is automatic, yet the code explicitly asks for cookies for some services. In a credential-handling context, deceptive automation claims are dangerous because they create trust and can socially engineer users into providing sensitive session tokens.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script solicits cloud-storage cookies without any safety, privacy, or credential-handling warning. Cookies for services like Baidu Netdisk or Aliyun can function as active session credentials, so requesting them directly creates a serious account-compromise and privacy risk if mishandled, logged, or reused.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The auto_process docstring promises fully automated handling with only a shared link, but the real logic can pivot to requesting user cookies. In the context of a downloader skill, this mismatch increases social-engineering risk because the user is conditioned to expect a low-friction benign flow before being asked for high-value credentials.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
All user-facing instructions, triggers, and examples are presented only in Chinese, with no indication that other languages are supported or that the Chinese-only behavior is intentional and opt-in. This can violate language/locale policy when a skill mandates a specific language without user choice.
- Content
Static analysis
No suspicious patterns detected.