T09 · Insecure Skill Coding Practices
Error
- Location
scripts/cloud_doc_scraper.py:884- Finding
Chromium Sandbox Disabled While Rendering Untrusted Remote Content
- Content
View full analysis
- Remediation
View remediation
Security audit
Cloud Product Analysis
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to scrape cloud-provider documentation as advertised, but it uses unsafe browser settings and loose URL validation that deserve review before installation.
Use this only in a low-privilege environment without mounted secrets or sensitive workspaces. Avoid --stealth, choose report output paths deliberately, and prefer a revised version that removes --no-sandbox and enforces strict hostname and redirect allowlists.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cloud_doc_scraper.py:529- Finding
Incomplete Destination Validation Allows Requests to Unapproved Hosts
- Content
View full analysis
list: base_domain = f"{urlparse(base_url).scheme}://{urlparse(base_url).netloc}" links = [] for selector in nav_selectors: try: els = await page.query_selector_all(selector) if len(els) <= 3: continue for el in els: href = await el.get_attribute("href") or "" text = (await el.inner_text()).strip() if not href or not text or href == "#" or href.startswith("javascript"): continue full_url = urljoin(base_domain, href) if href.startswith("/") else href if urlparse(base_domain).netloc not in urlparse(full_url).netloc: continue links.append({"url": full_url, "text": text, "score": score_link(text, href)}) if links: print(f" [{label}] nav selector '{selector}' => {len(links)} links") return links except Exception: continue print(f" [{label}] [WARN] all selectors missed, TOC parse failed") return [] ``` The HTTP fallback also follows redirects without validating each destination: ```python async def fetch_via_http(url: str) -> str: if not HAS_HTTPX: return "" try: async with httpx.AsyncClient(follow_redirects=True, timeout=30, headers={"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"}) as client: resp = await client.get(url) ``` ### Technical Analysis The hostname check is based o ...[truncated 3162 chars]- Remediation
View remediation
bool: host = (host or "").rstrip(".").lower() allowed_host = allowed_host.rstrip(".").lower() return host == allowed_host or host.endswith("." + allowed_host) ``` Use exact equality instead if provider subdomains are not required. 4. Resolve relative links against the complete page URL rather than only the scheme and network location: ```python full_url = urljoin(base_url, href) ``` 5. Disable automatic redirects in `httpx`, process redirects manually, and validate every `Location` target before following it. 6. After Playwright navigation, inspect `page.url` and reject a page if its final hostname is outside the allowlist. 7. Use Playwright request routing to block navigation and subresources to unapproved domains where practical. 8. Apply the same validation to configured homepage, changelog, and deep-link URLs. 9. Add unit tests covering: - `help.aliyun.com.attacker.example` - `attacker.example/help.aliyun.com` - URL user-information tricks - Scheme-relative URLs - External redirects - IPv4 and IPv6 loopback/private addresses - `169.254.169.254` ]]>
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh "Unknown product" # 清理测试文件 rm -f tests/_test_cdn.md # 总结 echo ""
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh "_test_ecs_4way.md" # 清理测试文件 rm -f tests/_test_*.md # 总结 echo ""
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Copy or symlink this directory to ~/.claude/skills/
cp -r cloud-product-analysis ~/.claude/skills/
Or create a symlink
ln -s $(pwd) ~/.claude/skills/cloud-product-analysis
text
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README advertises automatic invocation from a broad natural-language prompt ('Compare ECS products between Alibaba Cloud and AWS') without documenting any confirmation step, constrained trigger format, or scope limits. In an agent setting, this can cause the skill to run unexpectedly on loosely related user input, increasing the chance of unreviewed web access and data processing.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The Chinese example repeats the same unsafe pattern by implying the skill may be auto-invoked from a generic request to compare vendors' ECS offerings. Ambiguous trigger phrasing increases the likelihood of accidental invocation in multilingual environments, where intent classification may already be less precise.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The markdown hard-codes AWS documentation links under the zh_cn locale and presents them as the default documentation source. Because no user opt-in or alternative locale is offered, this creates a language/locale policy issue by implicitly forcing a specific language.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The optional --stealth mode deliberately alters browser fingerprints by masking navigator.webdriver and using an anti-automation-oriented launch profile. For a documentation comparison tool, this evasion behavior is not necessary for core functionality and can enable bypass of site bot-detection controls, creating policy and abuse risk if the skill is repurposed.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
In both browser context creation paths, the code hard-codes
locale="zh-CN". This is a natural-language locale policy concern because the skill enforces a specific locale for all users without opt-in, even though the tool targets multiple providers and does not document that it is restricted to Chinese-only operation.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file describes behavior that writes a markdown analysis report to the workspace, which affects user data and local filesystem state. While the behavior is part of the skill’s purpose, the description does not include any caution about file creation, output location hygiene, or potential overwriting of existing files.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script's user-facing comments and output strings are written in Chinese, including test status and summary messages. This creates a language/locale constraint without any opt-in or alternative language path, which matches the policy-violation category for forced language use.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This shell script emits user-facing status messages and test labels in Chinese throughout the test run, such as at L025, L034-L35, L44, and L110-L123. Because the file provides no language selection, opt-in, or justification for a Chinese-only interface, it conflicts with the policy against forcing a specific language without user choice.
- Content
Static analysis
No suspicious patterns detected.