T09 · Insecure Skill Coding Practices
Error
- Location
references/tencent-pg-mem0-deploy/references/api_reference.md:123- Finding
Persistent and Broadly Inherited Storage of Cloud Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
TencentDB PostgreSQL Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly coherent for Tencent Cloud PostgreSQL administration, but it asks users to expose powerful cloud credentials broadly and supports unscoped endpoint overrides for signed API calls.
Install only if you are comfortable giving the skill Tencent Cloud PostgreSQL authority. Use a least-privilege CAM sub-account, prefer short-lived/session credentials, avoid storing secrets in shell profiles, launchctl, or persistent Windows user variables, and do not use endpoint override variables with production credentials unless the destination is strictly controlled.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
references/tencent-pg-rest-deploy/references/api_reference.md:14- Finding
Credentialed API Requests Can Be Redirected Through Unrestricted Endpoint Overrides
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file contains user-facing templates and instructions exclusively in Chinese, including required reply wording, but it does not indicate that Chinese is optional or that the skill is limited to Chinese-speaking users. That can violate a language/locale policy when users have not opted into that language.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 11. Summarize as a final service-control result: target scope, requested action, resolved slots and their sources, preflight facts, executed actions, current mem0 status, usable endpoint on open success or closed-state confirmation on close success, and the next copyable step. ## Pitfalls - Do not ask the user to paste `EmbeddingApiKey` or any other secret into the conversation. - Do not tell the user only `自己去控制台找`; always provide the direct official console / product-site entry links plus the shortest click path documented in `@references/api_reference.md` when a required mem0 slot is missing, and add an agent-assisted lookup option whenever the missing slot is non-secret and the current toolchain can fetch it safely. - Do not run `OpenMem0Service` or `CloseMem0Service` on an ambiguous target or when multiple candidate instances remain. - Do not reopen an already running mem0 service, and do not close a service that is already confirmed closed.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 11. Summarize as a final service-control result: target scope, requested action, resolved slots and their sources, preflight facts, executed actions, current mem0 status, usable endpoint on open success or closed-state confirmation on close success, and the next copyable step. ## Pitfalls - Do not ask the user to paste `EmbeddingApiKey` or any other secret into the conversation. - Do not tell the user only `自己去控制台找`; always provide the direct official console / product-site entry links plus the shortest click path documented in `@references/api_reference.md` when a required mem0 slot is missing, and add an agent-assisted lookup option whenever the missing slot is non-secret and the current toolchain can fetch it safely. - Do not run `OpenMem0Service` or `CloseMem0Service` on an ambiguous target or when multiple candidate instances remain. - Do not reopen an already running mem0 service, and do not close a service that is already confirmed closed.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Auth: `TC3-HMAC-SHA256` - Preferred call path: official Tencent Cloud SDK; fallback: locally generated TC3-signed HTTPS request - Credentials: read from runtime environment only - Never hardcode secrets, never write them into repository files, and never ask the user to paste them into chat when runtime environment is the intended source ## Aligned action set for this skill
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Auth: `TC3-HMAC-SHA256` - Preferred call path: official Tencent Cloud SDK; fallback: locally generated TC3-signed HTTPS request - Credentials: read from runtime environment only - Never hardcode secrets, never write them into repository files, and never ask the user to paste them into chat when runtime environment is the intended source ## Aligned action set for this skill
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - Auth: `TC3-HMAC-SHA256` - Preferred call path: official Tencent Cloud SDK; fallback: locally generated TC3-signed HTTPS request - Credentials: read from runtime environment only - Never hardcode secrets, never write them into repository files, and never ask the user to paste them into chat when runtime environment is the intended source ## Aligned action set for this skill
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file instructs the skill to use Chinese-only parameter acquisition text and a Chinese reply template, including exact required user follow-up phrases. This imposes a specific language/locale on users without any opt-in or alternative language path, which matches the policy-violation category for natural-language locale constraints.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The example clarification message is written only in Chinese, and later guidance requires specific Chinese waiting phrases, which steers the skill toward a fixed language regardless of user preference. This is a natural-language locale policy issue because the file does not offer a language choice or document a justified locale constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The rule requires the reply to include phrases such as
等你确认or确认后我再继续, which effectively imposes Chinese wording for a standard interaction pattern. Because there is no opt-in or documented locale limitation, this conflicts with the policy against forcing a specific language.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document defines two conflicting success conditions for opening the REST service: earlier it correctly allows success without a public address when
EnableWanNet=false, but the later guardrail says to never claim open success without a usable public address. This inconsistency can cause the agent to mis-handle state, report false failure, or take incorrect follow-up actions in security-sensitive service enablement flows.- Content
Static analysis
No suspicious patterns detected.