T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:34- Finding
Plaintext SMTP Authorization Credential Exposed in Skill Documentation
- Content
View full analysis
- Remediation
View remediation
Security audit
发送邮件
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed email-report sender, but it exposes an SMTP credential and relies on an unreviewed external Python config module before sending local attachments.
Review carefully before installing. Rotate the exposed SMTP authorization code, remove secrets from documentation, replace the external Python config import with a reviewed non-executable configuration source, and require an explicit preview/confirmation showing recipient, subject, body, and attachments before any email is sent.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/send_email_to.py:3- Finding
Arbitrary Code Execution Through an Externally Loaded Python Configuration Module
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares no explicit tool scope or permissions even though it is documented to read local files and generate outbound email content. In an agent setting, missing scope boundaries increases the chance of unintended file access or silent expansion of what the skill can read and send, especially because it processes local market data and attachments.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad common-language commands like '发送邮件' and '发送报告', which can easily appear in ordinary conversation and invoke the skill unintentionally. Because this skill can read local files and send attachments to a fixed recipient, accidental activation materially raises the risk of unintended data disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description says it automatically reads local market data and discovers same-day Word/PPT files for attachment, but it provides no user warning or consent checkpoint. In context, this is dangerous because it can package and transmit local file contents off-host via email without making the privacy and exfiltration risk explicit to the user.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation exposes a real SMTP server, sender address, recipient, and what appears to be a hardcoded authorization token. Publishing live credentials in skill documentation enables credential theft, unauthorized email sending, account takeover of the mail function, and abuse for phishing or data exfiltration.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a generic email-sending skill with Chinese attachment support, triggered by broad user intents like sending mail or reports. But the code is hardwired to compose a specific金融市场日报 message, pull market data from a predefined file, and generate a fixed subject/body for that report, so actual behavior does not match the broader claimed scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script hard-codes Chinese natural-language content in the module description, email body, and subject, which imposes a specific language on recipients without any apparent opt-in or configuration. Under the policy, locale or language constraints should either be user-selectable or clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The description and invocation examples are written only in Chinese and the skill is presented as operating through Chinese phrases, without offering a language choice or documenting that it is intentionally region-specific. This can violate language or locale policy when users are not given an explicit opt-in or alternative.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
A mail-sending skill would be expected to construct and send messages, including reading specified attachments. Here the code additionally reads a structured market data JSON file and scans an output directory for date-matched Word/PPT report files, which reflects report-generation/report-assembly workflow beyond the manifest's stated email-sending purpose.
- Content
Static analysis
No suspicious patterns detected.