T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:26- Finding
Excessive Filesystem and Command-Execution Permissions with Unsafe Privilege-Escalation Guidance
- Content
View full analysis
- Remediation
View remediation
Security audit
admapix-free
Security checks for vulnerabilities and agentic risk
Overview
This skill is mainly an AdMapix API client, but it asks for and describes broad file, command, and admin-style troubleshooting powers that do not fit its narrow lookup purpose.
Install only if you are comfortable giving this skill shell and filesystem-capable authority in your agent environment. Keep use limited to AdMapix API queries, provide the API key only through the environment variable, do not paste secrets into prompts, and avoid following any request to read or write unrelated local files or rerun operations as administrator.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The skill explicitly directs the agent to use exec to transmit user-supplied query data and an API key to an external service. External transmission is expected for an API client, but it remains security-relevant because it moves potentially sensitive prompts, search terms, and authenticated requests off-platform to a third party.
- Content
md | curl 或等价 HTTP 客户端 | 命令行工具 | 必需 | 系统自带或包管理器安装 | ### 可用性分类 - **分类**: MD+EXEC（Markdown 指令驱动，需 exec 执行 curl 命令） - **说明**: 基于自然语言指令驱动 Agent 调用 AdMapix API，透传原始结构化 JSON ## 能力梳理
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This snippet shows authenticated transmission to an external API using the ADMAPIX_API_KEY header. Although core to the skill's purpose, it is still a true external-data-transfer risk because misuse or loose prompting could send sensitive information to the vendor or expose secrets through command construction/logging.
- Content
使用
ADMAPIX_API_KEY作为X-API-Key请求头。永不打印或暴露 Key.bash curl -s "https://api.admapix.com/api/data/{endpoint}?{params}" -H "X-API-Key: ${ADMAPIX_API_KEY}" curl -s -X POST "https://api.admapix.com/api/data/{endpoint}" \ -H "X-API-Key: ${ADMAPIX_API_KEY}" -H "Content-Type: application/json" -d '{...}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The POST example sends JSON payloads to an external third-party endpoint with authentication, which creates the same external transmission and secret-handling risk as the GET example. In this skill context the behavior is intended, but it is more dangerous because free-form JSON bodies can carry larger amounts of user or workspace-derived data if not constrained.
- Content
使用
ADMAPIX_API_KEY作为X-API-Key请求头。永不打印或暴露 Key.bash curl -s "https://api.admapix.com/api/data/{endpoint}?{params}" -H "X-API-Key: ${ADMAPIX_API_KEY}" curl -s -X POST "https://api.admapix.com/api/data/{endpoint}" \ -H "X-API-Key: ${ADMAPIX_API_KEY}" -H "Content-Type: application/json" -d '{...}'
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The '能力边界' section says the skill only passes through raw structured JSON and does not analyze, summarize, or generate reports. Later sections discuss '自动化数据处理' and '生成内容需人工审核', which imply the skill processes data and generates content, directly conflicting with the earlier intent documentation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is presented as a narrow AdMapix raw-JSON client, but later claims generic file read/parse/write capabilities unrelated to that purpose. This capability drift can cause an agent or user to over-trust the skill and permit broader filesystem actions than expected, increasing the chance of unintended file modification or data handling outside the advertised scope.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Broad, underspecified capability claims make the skill eligible for invocation in contexts far beyond AdMapix lookups. That increases the chance an agent selects this skill for tasks involving files or shell actions, leading to overbroad authority use and unexpected side effects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Advertising file write capability without prominent restrictions or warnings is dangerous because it normalizes state-changing behavior in a skill that users would expect to be read/query oriented. In an agent environment, this can lead to silent overwrites, creation of files containing sensitive data, or persistence of data outside user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises command execution capability without a clear warning that shell commands can affect the local system and network. Because the skill already instructs use of exec with curl, this materially raises the risk of unsafe command invocation, command expansion mistakes, or broader shell usage than necessary.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
A skill documented as an AdMapix API client later advertises generic file and command-execution behaviors unrelated to its stated purpose. In an agent setting, such unrelated operational guidance can broaden when and how the skill is invoked, increasing the risk of unnecessary shell execution or filesystem interaction beyond the user's reasonable expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
Most user-facing metadata and instructions are written in Chinese, including the display name and primary description, with no indication that the skill can operate in another language on user request. For skills intended for broad agent platforms, hardwiring a single language without opt-in can be a locale-policy issue.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description repeatedly states '不分析、不总结、不排序' and positions the skill as a pure pass-through client. Yet the example output is followed by an '分析' section that interprets the result count and advises pagination, which contradicts the stated non-analysis posture at the documentation level.
- Content