ITSM 工单自动提交

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:30 AM UTC
• Version: 2.1.0

Overview

This skill does what it claims, but it exposes ITSM credentials and makes risky system and browser changes that require human review before use.

Only install this in a controlled test environment after removing and rotating the embedded ITSM credentials, disabling password logging and automatic screenshots, replacing automatic sudo/network bootstrap installs with reviewed prerequisites, and adding an explicit confirmation before any live ticket is submitted.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: submit-itsm.py:31

Finding

Hard-Coded Plaintext ITSM Credentials

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: submit-itsm.py:469

Finding

Password Disclosure Through Command-Line Arguments and Debug Logging

Content

View full analysis

1: for arg in sys.argv[1:]: print(f"🔍 [DEBUG] 处理参数: {arg}") if '=' in arg: key, value = arg.split('=', 1) print(f"🔍 [DEBUG] 键值对: {key} = {value}") if key in ['username', 'password', 'sku', 'remark', 'warehouse', 'ticketType', 'attachmentPath']: CONFIG[key] = value print(f"✅ 已设置 CONFIG['{key}'] = {value}") ``` ### Technical Analysis The parser accepts passwords as ordinary command-line key-value arguments. It prints the complete `sys.argv` array, each raw argument, each parsed value, and the resulting configuration assignment. A password supplied as `password=...` is therefore disclosed several times. Independently of the application logs, command-line arguments may be exposed through process-inspection tools and shell history. The behavior conflicts with the safer documented environment-variable interface, which the reviewed implementation does not actually read. ### Attack Path 1. A user invokes the Skill with an argument such as `password=secret`. 2. The shell may retain the argument in command history. 3. While the process is running, other appropriately permitted local users or monitoring agents may inspect its argument list. 4. The script prints the password to the terminal or execution log multiple times. 5. Terminal recordings, CI logs, agent logs, or support bundles retain the plaintext password. 6. A log reader or local attacker obtains the password and uses it to impersonate the ITSM account. ### Impact Assessment Exploitation exposes user-supplied ITSM credentials to local observers and anyone able to access execution logs. The resulting privileges are those of the compromised ITSM ...[truncated 183 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: start.sh:88

Finding

Unverified Remote Bootstrap Execution and Unpinned Dependency Installation

Content

View full analysis

/dev/null; then curl -sS "$GET_PIP_URL" -o "$GET_PIP_FILE" 2>/dev/null elif command -v wget &> /dev/null; then wget -q "$GET_PIP_URL" -O "$GET_PIP_FILE" 2>/dev/null fi if [ -f "$GET_PIP_FILE" ]; then python3 "$GET_PIP_FILE" --user --break-system-packages 2>/dev/null rm -f "$GET_PIP_FILE" export PATH="$HOME/.local/bin:$PATH" if python3 -m pip install selenium requests --break-system-packages 2>/dev/null; then INSTALL_SUCCESS=true echo "✅ 安装成功（get-pip.py）" fi fi ``` ```text selenium>=4.0.0 requests>=2.28.0 ``` The launcher also invokes unpinned installation through multiple pip variants at `start.sh:51-82` and may perform privileged system modification at `start.sh:137-138`: ```bash sudo apt-get update -qq sudo apt-get install -y chromium-browser ``` ### Technical Analysis When pip is unavailable, the launcher downloads `get-pip.py` from a mutable external URL and executes it immediately without a checksum, signature, pinned version, or manual verification step. It then installs dependencies without exact versions or hashes and uses `--break-system-packages`, bypassing Python distribution safeguards. The requirements specify only lower bounds, allowing future package releases to be selected after the Skill has been reviewed. Installation is not isolated in a virtual environment. Although HTTPS protects the transfer in normal conditions, it does not make mutable upstream content reproducible or protect against upstream compromise, compromised package releases, trust-store compromise, or unsafe future dependency changes. ### Attack Path ...[truncated 1162 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: start.sh:143

Finding

Unauthenticated Chromium DevTools Interface with Unrestricted Origins

Content

View full analysis

/tmp/chromium-$DEBUG_PORT.log 2>&1 & ``` ### Technical Analysis The launcher enables Chromium's DevTools Protocol on port 9222 and permits all origins with `--remote-allow-origins=*`. The submission script then connects to this interface and uses the browser for authentication to the ITSM service. The DevTools interface provides powerful browser-control capabilities, including page inspection, script execution, navigation, and access to authenticated browser state. It has no application-level authentication in this configuration. The command does not explicitly constrain the debugging address to a narrowly isolated interface, and unrestricted origin acceptance weakens protections against unauthorized clients. ### Attack Path 1. The Skill starts Chromium with DevTools Protocol enabled on port 9222. 2. The automation enters ITSM credentials and establishes an authenticated session. 3. A malicious local process, or another client able to reach the exposed endpoint, connects to the debugging interface. 4. The attacker enumerates available pages and attaches to the ITSM tab. 5. The attacker executes JavaScript, reads page content, navigates the authenticated browser, or triggers ITSM actions. 6. The attacker operates with the browser session's effective privileges until the process or session is terminated. ### Impact Assessment Successful exploitation can provide control over the authenticated browser and access to information displayed in it. The attacker could potentially read ticket content, perform actions as the lo ...[truncated 235 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: submit-itsm.py:51

Finding

Unprotected Storage of Sensitive Authenticated-Page Screenshots

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (26)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation includes hardcoded default credentials for ITSM access, including a plaintext password. Embedding credentials in skill documentation encourages credential reuse, risks unauthorized ticket submission or account compromise, and normalizes unsafe secret handling for any user who installs or shares the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill handles usernames, passwords, SKU data, remarks, and warehouse information, yet the documentation does not warn users that credentials and ticket content will be transmitted to an external ITSM system. This omission increases the likelihood of accidental disclosure of sensitive data and prevents informed consent about how secrets and business data are handled.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script downloads get-pip.py from the network and executes it directly with Python, which is equivalent to executing remote code. If the download source, TLS trust chain, DNS, or network path is compromised, an attacker can run arbitrary code on the host under the user's account.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

The configuration contains hardcoded login credentials, including a plaintext password, directly in source code. Anyone with access to the file, repository, backups, or screenshots of the code can reuse the credentials to access the ITSM system, and such secrets are difficult to rotate once copied.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script prints raw command-line arguments and echoes parsed key/value pairs, which will expose a supplied password to stdout, logs, shell history, CI job logs, or orchestration telemetry. In an automation context, this is especially dangerous because secrets are commonly passed non-interactively and logs are often widely accessible.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The document emphasizes Chinese support with statements such as "中文正常" and presents all invocation examples and instructions only in Chinese, without indicating whether other languages are supported or allowing user opt-in. This can constitute a language policy issue when a skill implicitly forces a specific language without documented justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are generic, such as '创建 ITSM 工单' and '提交 ITSM 工单', without constraints, confirmation requirements, or clear scoping. In an agent environment, broad activation can cause unintended invocation of a skill that handles credentials, opens browsers, and performs external actions on behalf of the user.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly states it will automatically install chromium-browser and Python packages on first run, which goes beyond the narrowly described purpose of submitting ITSM tickets. Allowing a skill to modify the host system and package state increases supply-chain and integrity risk, especially when these changes are automatic and not clearly gated by explicit user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation describes automatic installation of dependencies and elsewhere includes process-kill behavior for the browser, but it does not clearly warn users about these system-changing and potentially disruptive actions. Hidden or under-disclosed host modifications reduce user control and can break environments or terminate unrelated browser sessions matching the process pattern.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The documentation instructs the user to run sudo apt-get update, introducing privileged system modification as part of using the skill. Requiring elevation for a ticket-submission workflow increases the blast radius of mistakes or future script changes and can be abused if users are conditioned to grant admin rights without scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

脚本会自动安装，或手动运行：

bash

sudo apt-get update
sudo apt-get install -y chromium-browser

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The documentation instructs the user to run sudo apt-get install -y chromium-browser, which performs privileged package installation for a non-administrative business task. This expands attack surface, introduces supply-chain risk, and normalizes root execution for convenience rather than necessity.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

脚本会自动安装，或手动运行：

bash

sudo apt-get update
sudo apt-get install -y chromium-browser

Python 依赖缺失

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

L003 describes this as a startup script for launching the browser for an ITSM auto-submission skill. However, the script performs substantially more actions: it modifies PATH, installs Python dependencies, may install chromium-browser with sudo apt-get, and finally runs submit-itsm.py to submit a ticket. That is an active contradiction of the stated role as merely starting the browser.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The comment on L004 says the skill uses the system chromium browser with 'zero dependencies', implying no extra installation is needed. In reality, the script checks for missing Python modules, installs selenium and requests via pip, and if needed downloads get-pip.py from an external URL to bootstrap pip, which directly contradicts that claim.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · start.sh (reported line 118)May include surrounding context.

sh

echo "请手动尝试以下命令之一："
        echo "  pip3 install selenium requests"
        echo "  python3 -m pip install selenium requests --user"
        echo "  sudo apt-get install python3-pip && pip3 install selenium requests"
        exit 1
    fi
else

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script automatically performs sudo apt-get update/install without an explicit confirmation step, causing privileged system modification beyond merely launching a browser. In a skill context, this is more dangerous because users may not expect the action to alter the host or invoke privilege escalation during normal task execution.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The script invokes sudo apt-get update automatically, introducing privileged host changes during execution. While apt itself is legitimate, unprompted privilege escalation in an automation skill expands blast radius and can be abused or surprise users in environments where least privilege is expected.

Content

Scanner excerpt · start.sh (reported line 137)May include surrounding context.

sh

# 检查 chromium-browser 是否安装
    if ! command -v chromium-browser &> /dev/null; then
        echo "📦 正在安装 chromium-browser..."
        sudo apt-get update -qq
        sudo apt-get install -y chromium-browser
        echo "✅ chromium-browser 安装完成"
    fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The script invokes sudo apt-get install -y chromium-browser automatically, which performs privileged package installation without a clear consent step. In an agent skill, automatic root-level modifications are risky because they change the system state and increase consequences if the workflow or package source is tampered with.

Content

Scanner excerpt · start.sh (reported line 138)May include surrounding context.

sh

if ! command -v chromium-browser &> /dev/null; then
        echo "📦 正在安装 chromium-browser..."
        sudo apt-get update -qq
        sudo apt-get install -y chromium-browser
        echo "✅ chromium-browser 安装完成"
    fi

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The script launches Chromium with a remote debugging port and allows all origins, then backgrounds it with nohup. This creates a locally reachable browser control interface that may persist long enough for other local processes to attach, inspect pages, or drive authenticated sessions, making the context more dangerous because the script is intended to automate a live ITSM login/session.

Content

Scanner excerpt · start.sh (reported line 143)May include surrounding context.

sh

fi

    # 启动 chromium-browser（可见窗口模式）
    nohup chromium-browser         --remote-debugging-port=$DEBUG_PORT         --remote-allow-origins=*         --no-first-run         --window-size=1920,1080         --window-position=0,0         --force-device-scale-factor=1.0         --disable-blink-features=AutomationControlled         > /tmp/chromium-$DEBUG_PORT.log 2>&1 &

    sleep 3

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file-level natural-language description and all user-facing strings are written as Chinese-only operational guidance, with no indication that the user can choose another language or that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code performs a potentially irreversible external action by clicking the final submit button and creating a real ticket. The file contains progress logging, but there is no explicit confirmation prompt or warning near the submit step to ensure the user understands that a live submission will occur.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The user-facing description and status messages are entirely in Chinese (for example, the comment at L03 and echo output at L07/L11/L13). This can violate a language/locale policy when the skill does not offer any language choice or explain that it is intended only for a Chinese-speaking environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The package description states "中文正常显示," which communicates an expectation or requirement around Chinese-language display. This can be read as a language/locale constraint without indicating user choice or opt-in, which falls under the policy check for forced language behavior.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a lower bound only (selenium>=4.0.0), which makes builds non-reproducible and allows future installs to pull unexpected versions. This is dangerous because a newly released or compromised upstream version could be introduced without review, and it also prevents confirming whether known-vulnerable versions are excluded.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

selenium>=4.0.0
requests>=2.28.0

Unverifiable Dependency: selenium has 2 known advisory(ies) (CVE-2022-28108 (Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content ); CVE-2023-5590 (NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

selenium has known advisories, but because the manifest does not pin an exact version, it is impossible to determine whether the installed package is affected or safely updated. In a skill context, Selenium often drives browsers or web sessions, so uncertainty around its version increases operational and supply-chain risk even if the manifest alone does not prove active exploitation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified as requests>=2.28.0 rather than an exact version, so installs may resolve to different releases over time. This increases supply-chain risk and makes it harder to verify whether the environment is using a version affected by known advisories.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

selenium>=4.0.0
requests>=2.28.0

Static analysis

No suspicious patterns detected.