Hetu Lyrics Blessing

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:47 AM UTC
• Version: 1.0.2

Overview

The skill mostly matches its stated reminder-and-lyrics purpose, but it ships real-looking email credentials, a fixed recipient, and persistent cron setup that require careful review.

Review this skill before installing. Do not run it as-is: rotate or remove the exposed SMTP credential, replace hardcoded sender and recipient values with your own secured configuration, avoid global unpinned installs, and only add the cron job after confirming you want recurring email delivery and know how to remove it.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:59

Finding

Persistent Daily Execution Through User Crontab Modification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–63
Vulnerability Type: Persistent scheduled task installation
Risk Level: High

Vulnerable Code

bash

### 3. Set up Cron

# Run daily at 23:00
crontab -l | { cat; echo "0 23 * * * /path/to/send_lyrics.py >> /path/to/log.txt 2>&1"; } | crontab -

Technical Analysis

The setup instructions append a scheduled task to the current user's crontab. The task survives the initiating session and executes send_lyrics.py automatically every day at 23:00 without requiring further confirmation.

Scheduling is related to the declared daily-reminder functionality. Nevertheless, direct modification of persistent system state carries elevated risk and must be explicitly authorized, reversible, and idempotent. The supplied command does not check whether the entry already exists, so running it repeatedly can create duplicate tasks and duplicate outbound messages.

The scheduled command also relies on unspecified absolute paths. If the script path or its parent directory is writable by another account or process, later replacement of the script could cause cron to execute attacker-controlled code with the privileges of the user who installed the task.

Attack Path

1. A user follows the setup instructions and runs the supplied crontab command.
2. The command copies the existing crontab and appends the new daily entry.
3. The cron service executes the referenced script every day under the installing user's account.
4. The script performs browser and SMTP network operations without interactive approval.
5. If the referenced script is subsequently modified or replaced, the modified code is executed automatically at the next scheduled interval.
6. Repeating the setup command creates additional entries, potentially causing repeated emails and excess network activity.

Impact Assessment

This establishes cross-session persistence unde ...[truncated 330 chars]

Remediation

View remediation

Remediation Suggestions

• Make scheduling an explicit, separate opt-in step rather than a default installation action.
• Display the exact command, execution identity, network behavior, and destination before requesting approval.
• Use an idempotent installer that checks for an existing uniquely marked entry before adding one.
• Provide documented status and uninstall commands that remove only this Skill's entry.
• Use an absolute script path in a user-owned directory that is not writable by other users.
• Use a dedicated least-privileged account where practical.
• Restrict permissions on the script, configuration, and log files.
• Avoid logging secrets or full message contents, and configure log rotation.
• Consider an application-level scheduler that requires explicit user activation and exposes a visible disable control.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send_lyrics.py:13

Finding

Hardcoded SMTP Authorization Credential and Fixed External Recipient

Content

View full analysis

Vulnerability Details

File Location: scripts/send_lyrics.py, lines 13–18 and 142–144
Vulnerability Type: Plaintext secret exposure and unsafe destination configuration
Risk Level: Critical

Vulnerable Code

python

SMTP_SERVER = "smtp.qq.com"
SMTP_PORT = 465
SMTP_EMAIL = "[e-mail]"
SMTP_PASSWORD = "nzhgbgilzgmabeih"

TO_EMAIL = "[e-mail]"

python

server = smtplib.SMTP_SSL(SMTP_SERVER, SMTP_PORT)
server.login(SMTP_EMAIL, SMTP_PASSWORD)
server.sendmail(SMTP_EMAIL, [TO_EMAIL], msg.as_string())

Technical Analysis

The source code contains a plaintext SMTP username and authorization credential. Anyone who can read the Skill package, repository history, distribution archive, logs containing the source, or a copied installation can recover and attempt to use the credential.

The script also ships with a fixed recipient address rather than requiring the installer to configure and verify a destination. Although sending email is necessary for the declared feature, embedding a real credential and identity-specific destination is not necessary. The documentation presents placeholder settings, but the executable script contains concrete values.

TLS protects the SMTP session in transit, but it does not mitigate disclosure of a secret stored directly in source code. If the credential remains valid, an attacker can attempt to authenticate directly to the configured QQ SMTP service without executing the Skill.

The message includes a medication reminder and personalized text. Running the unmodified script therefore sends potentially sensitive contextual information to the predefined external recipient.

Attack Path

1. An attacker obtains the Skill package or reads the source file.
2. The attacker extracts the SMTP account and authorization credential.
3. The attacker connects to the configured SMTP endpoint over port 465.
4. If the credential remains valid and SMTP ac ...[truncated 1080 chars]

Remediation

View remediation

Remediation Suggestions

• Immediately revoke and rotate the exposed SMTP authorization credential.
• Review mailbox activity for unauthorized authentication and sent messages.
• Remove the credential from the current source and all accessible repository history or published artifacts.
• Load SMTP credentials from a protected secret manager, OS credential store, or environment variables supplied at runtime.
• Restrict secret files to the owning user, such as mode 0600, if a local configuration file is unavoidable.
• Never ship real sender or recipient addresses in a reusable Skill.
• Require the user to configure and explicitly confirm the recipient before the first transmission.
• Fail closed when sender, credential, or recipient configuration is absent; do not silently use a built-in destination.
• Use a provider credential dedicated to this application with the narrowest available permissions.
• Avoid printing credentials or full sensitive message contents to logs.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40

Finding

Unpinned Global Installation of a Third-Party Browser Automation Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40–44
Vulnerability Type: Unconstrained global dependency installation
Risk Level: Medium

Vulnerable Code

bash

### 1. Install Dependencies

npm install -g agent-browser
agent-browser install --with-deps

Technical Analysis

The setup instructions install the latest available agent-browser package globally without a pinned version, lockfile, or integrity verification. They then invoke its dependency installer with --with-deps.

Browser automation is relevant to retrieving lyrics, but global installation expands the affected scope beyond the project. An unconstrained package name resolves to whatever release the registry serves at installation time, so the effective dependency code can change after the Skill has been reviewed. npm package installation can also execute package lifecycle scripts with the privileges of the installing user.

No evidence shows that agent-browser itself is malicious. The vulnerability is the unsafe dependency acquisition process and excessive global installation scope.

Attack Path

1. A user runs npm install -g agent-browser as instructed.
2. npm resolves the package version available at that time rather than a reviewed, fixed version.
3. Package code and any lifecycle scripts execute with the user's installation privileges.
4. If the registry package, maintainer account, or a future release is compromised, attacker-controlled installation code can execute locally.
5. Global installation exposes other projects and shell sessions to the installed executable.
6. The subsequent --with-deps operation may install additional mutable components whose versions and privileges are not documented in the Skill.

Impact Assessment

Successful supply-chain compromise could execute code with the privileges used for installation, access files available to that account, modify user-level configuration, and ...[truncated 325 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specific reviewed version.
• Record and verify package integrity through a lockfile and registry integrity metadata.
• Install the package locally within the project rather than globally.
• Invoke the project-local binary through a controlled package script or an exact-version package runner.
• Review package provenance, maintainers, lifecycle scripts, and release history before adoption.
• Document every component installed by agent-browser install --with-deps.
• Avoid elevated installation privileges and clearly warn users not to run the commands as root.
• Use an isolated virtual machine, container, or restricted account for browser automation where feasible.
• Add an update process that requires security review before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented behavior does not match the implied operational capabilities: it introduces email sending, credential handling, fallback content, and persistence assumptions that differ from the stated narrow purpose. This mismatch is dangerous because reviewers and users may approve a seemingly harmless lyrics skill while it actually handles sensitive credentials, transmits messages externally, and may perform actions beyond expectations.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This is a tool-parameter abuse issue because the skill passes a parameterized command string into a shell to drive browser automation. Even though song_url is currently from a static list, this pattern is dangerous in agent tooling: any future dynamic input, config override, or content poisoning could turn it into command execution, and the browser tool can also be directed to untrusted destinations.

Content

Scanner excerpt · scripts/send_lyrics.py (reported line 62)May include surrounding context.

python

# 使用 agent-browser 打开百度百科
    cmd = f'agent-browser open "{song_url}"'
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    print(f"Result: {result.stdout}")
    
    # 等待页面加载

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/send_lyrics.py (reported line 71)May include surrounding context.

python

# 获取页面内容
    cmd = 'agent-browser eval "document.body.innerText"'
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    content = result.stdout
    
    # 提取歌词部分

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/send_lyrics.py (reported line 87)May include surrounding context.

python

lyrics.append(line.strip())
    
    # 关闭浏览器
    subprocess.run('agent-browser close', shell=True)
    
    if lyrics:
        # 取前4行作为每日歌词

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares no explicit tool scope or permission boundaries even though it instructs use of shell-capable operations such as global package installation and cron modification. In an agent setting, missing scope constraints can let the skill trigger broader-than-expected command execution or persistence-related actions without clear user awareness.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The invocation guidance is broad enough to match common everyday requests like reminders or warm messages, which increases the chance the skill is selected in situations where users did not intend browser fetching or email transmission. Over-broad triggering can cause unintended data sharing, external network use, or persistent automation from innocuous prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill involves browser-based retrieval and SMTP delivery of content and recipient details, but it does not warn about privacy-sensitive network transmission or third-party exposure. Users may unknowingly provide personal email addresses, message contents, or account credentials that are sent to external services.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The cron setup establishes persistent scheduled execution on the host, which is a form of session/system persistence. In an agent or shared environment, persistence is risky because the task continues running after the initial interaction, can repeatedly send outbound emails, and may be difficult for users to notice or revoke.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

bash

# Run daily at 23:00
crontab -l | { cat; echo "0 23 * * * /path/to/send_lyrics.py >> /path/to/log.txt 2>&1"; } | crontab -

Important Rules

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring explicitly says the skill must use agent-browser to fetch lyrics from baike.baidu.com, implying that fetched lyrics are required behavior. However, the implementation catches fetch failures and substitutes predefined local lyrics, which directly contradicts the documented requirement rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file-level docstring specifies the skill purpose and requires use of Baidu Baike in Chinese, with no indication that users may choose another language or locale. This is a natural-language locale constraint that is imposed by default rather than offered as an explicit opt-in.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 94% confidence

Finding

This call builds a shell command with interpolated data and executes it with shell=True, which creates a command-injection surface if song_url is ever modified, sourced externally, or influenced through future changes. In this skill, the browser automation requirement increases risk because it launches an external tool against remote content while also embedding a hardcoded SMTP credential elsewhere in the script, making abuse more consequential.

Content

Scanner excerpt · scripts/send_lyrics.py (reported line 62)May include surrounding context.

python

# 使用 agent-browser 打开百度百科
    cmd = f'agent-browser open "{song_url}"'
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    print(f"Result: {result.stdout}")
    
    # 等待页面加载

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send_lyrics.py (reported line 71)May include surrounding context.

python

# 获取页面内容
    cmd = 'agent-browser eval "document.body.innerText"'
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    content = result.stdout
    
    # 提取歌词部分

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send_lyrics.py (reported line 87)May include surrounding context.

python

lyrics.append(line.strip())
    
    # 关闭浏览器
    subprocess.run('agent-browser close', shell=True)
    
    if lyrics:
        # 取前4行作为每日歌词

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code sends medication reminder emails even though the skill is described as a lyrics blessing tool, creating a scope mismatch and covert outbound-action risk. Skills that send messages on a schedule to a real recipient are more dangerous when their manifest understates that behavior, because users and reviewers may not realize health-related reminders and fixed-recipient messaging are being automated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script sends email to a fixed external recipient automatically and without any user-facing confirmation, creating an unauthorized outbound communication channel. In the context of an agent skill, this is especially risky because it can be triggered silently on a schedule and combined with embedded credentials, enabling spam, harassment, privacy violations, or covert notifications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.