T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:14- Finding
Excessive Agent Tool Permissions Violate Least Privilege
- Content
View full analysis
- Remediation
View remediation
Security audit
密钥卫士
Security checks for vulnerabilities and agentic risk
Overview
This skill claims to protect API keys, but it asks for broad agent authority and gives secret-handling instructions that are not backed by an implemented guardrail.
Review carefully before installing. This is not confirmed malware, but users should not rely on it to protect secrets unless a real, audited connector enforces masking before content reaches the agent. Avoid granting command execution or broad read/write access, and do not let it inspect .env files, report key metadata, log keys, or make authenticated external API calls without explicit scoping and approval.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Error
- Location
SKILL.md:124- Finding
Advertised Secret-Protection Controls Have No Included Implementation
- Content
View full analysis
" }) → connector substitutes the real key before writing to disk ``` ``` The document later identifies the package as a pure Markdown skill: ```markdown ### 可用性分类 - **分类**: MD（纯Markdown指令，通过自然语言驱动Agent完成操作） - **说明**: 基于Markdown的AI Skill，通过自然语言指令驱动Agent完成操作。 ``` ### Technical Analysis The skill directs the Agent to invoke `validate_key`, `call_api`, `read_file_masked`, and `write_file_with_keys`, but the audited project contains only `SKILL.md`. It provides no scripts, connector definitions, executable implementation, or tests for these operations. Consequently, the project does not implement or enforce the promised s ...[truncated 2142 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documented behavior expands from narrow key-guardrailing into vulnerability scanning, compliance auditing, threat intelligence, asset scoring, and other operational domains. This overbroad scope creates permission ambiguity and can cause the agent to perform sensitive actions users did not intend under the cover of a seemingly simple security utility.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger language is vague enough that the skill may activate for a broad class of user requests involving 'calls' or automation. Overly broad invocation is dangerous here because the skill also claims sensitive capabilities, increasing the chance of unanticipated secret handling or external actions.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The phrase 'when user asks to call' is materially underspecified and can match many ordinary requests. In the context of a skill with read/exec/write tools and API-call examples, this ambiguity can cause accidental invocation during sensitive workflows.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill claims to prevent API keys from being sent to the AI assistant, but its examples instruct the agent to validate keys, inspect key presence/length, work around direct .env access, and perform authenticated API-call workflows. This contradiction encourages secret-adjacent handling by the model and increases the chance that credentials or sensitive metadata are exposed, transformed, or transmitted despite the stated guardrail purpose.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
Although the text says not to read .env directly, it still guides the agent to enumerate expected keys and report which are configured and their approximate lengths. That is credential discovery behavior and leaks sensitive metadata that can aid attackers in identifying providers, validating secret presence, and tailoring follow-on attacks.
- Content
- Use the returned response — never the key itself
text ### User: "Show me my .env file" ```text Do NOT read .env directly.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
The follow-on guidance to reveal which keys exist and approximate lengths still constitutes secret metadata exposure, despite avoiding full value disclosure. In practice, this normalizes credential enumeration and can reveal integration inventory and operational state to unauthorized viewers of the conversation.
- Content
User: "Show me my .env file"
text Do NOT read .env directly. Instead, call validate_key for each expected key name and show: - Which keys are configured - Approximate length (as a sanity check)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states that it records all intercepted API keys, which creates a direct secret-retention risk. Logging secrets is dangerous because logs are often broadly accessible, retained long-term, copied to external systems, and harder to scrub than primary data stores.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill metadata and description mix Chinese and English and present the display name in Chinese without indicating language selection or user preference. This can violate language/locale policy when a skill implicitly imposes a language or mixed-locale experience rather than offering an explicit choice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description markets the skill as a safety guardrail while omitting a clear up-front warning that it may execute commands, write files, and perform API interactions. This can mislead users and reviewers about the true privilege level of the skill and reduce informed consent for risky operations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The example explicitly performs an authenticated external API call, which is inconsistent with a skill positioned as a guardrail against secret exposure. Even if the key is not printed, external transmission expands the trust boundary and raises the risk of credential misuse, unintended data sharing, or encouraging unsafe patterns.
- Content
text 1. Call call_api({ key_name: "OPENAI_API_KEY", url: "https://api.llm-provider.com/v1/chat/completions", method: "POST", body: { model: "gpt-4o-mini", messages: [...] } })
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill advertises command execution, broad file processing, and external API integration without clear necessity for an API-key guardrail. Such capability inflation widens the attack surface and may lead operators to authorize risky actions that are not required for the claimed function.
- Content