T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/utils/request.js:82- Finding
API Token Exposed in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
微信搜索
Security checks for vulnerabilities and agentic risk
Overview
This WeChat search skill mostly does what it says, but it handles a private API token and saved search logs in ways users should review before installing.
Install only if you are comfortable sending your WeChat search keywords and GUAIKEI_API_TOKEN to guaikei.com, and with full search results being saved under the skill's logs directory. Treat the token like a password, rotate it if exposed, and delete local logs when searches are sensitive.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill documentation states that queries and results are automatically written to local log files under a logs directory, which expands behavior beyond simple search into persistent local data storage. Storing user search terms and returned content can create privacy and data-retention risks, especially when users are not clearly warned or given control over logging.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill documentation states that queries and results are automatically written to local log files under a logs directory, which expands behavior beyond simple search into persistent local data storage. Storing user search terms and returned content can create privacy and data-retention risks, especially when users are not clearly warned or given control over logging.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill documentation states that queries and results are automatically written to local log files under a logs directory, which expands behavior beyond simple search into persistent local data storage. Storing user search terms and returned content can create privacy and data-retention risks, especially when users are not clearly warned or given control over logging.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill documentation states that queries and results are automatically written to local log files under a logs directory, which expands behavior beyond simple search into persistent local data storage. Storing user search terms and returned content can create privacy and data-retention risks, especially when users are not clearly warned or given control over logging.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill documentation states that queries and results are automatically written to local log files under a logs directory, which expands behavior beyond simple search into persistent local data storage. Storing user search terms and returned content can create privacy and data-retention risks, especially when users are not clearly warned or given control over logging.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill requires access to the GUAIKEI_API_TOKEN environment variable but does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may expose or use sensitive environment data without a clearly bounded contract, increasing the risk of accidental secret access or propagation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that output files are automatically saved in a logs folder with filenames containing timestamps and keywords, but it does not clearly warn that user queries and possibly search results will be persistently written to disk. This creates a privacy and confidentiality risk because sensitive research topics, business interests, or regulated content may be retained locally without informed user consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger conditions are broad, such as activating on generic combinations like 'WeChat search' plus 'keyword' plus content type, without clear exclusions or confirmation requirements. This can cause unintended invocation of a networked skill that consumes a token, performs external queries, and writes logs even when the user did not explicitly consent to using this specific tool.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Several user-facing error strings are hardcoded in Chinese, including the authentication failure guidance and contact instructions. This imposes a specific language on users without offering a language choice or documenting a justified locale restriction, which fits the language/locale policy violation category.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file contains natural-language comments and error messages entirely in Chinese, including all user-visible validation errors. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The help text is entirely in Chinese, and the script's user-facing status and error messages elsewhere are also Chinese-only. For a general-purpose CLI, this imposes a fixed language/locale without opt-in or explanation, which matches the language-policy violation criteria.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script writes the full search output, including keyword and returned results, to a local JSON file without any explicit opt-in, minimization, or warning. Search terms and result sets can contain sensitive or proprietary user interests, and local persistence increases exposure to other local users, backups, or later unintended disclosure.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The human-readable title and descriptions are written only in Chinese, including user-facing field descriptions such as the search keyword and sort options. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language or locale choice is documented.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The title and description are written entirely in Chinese and describe a WeChat-specific article search schema, which imposes a fixed language/locale context in natural-language metadata. There is no indication that users can opt into this language or that the locale restriction is explicitly documented as a justified regional constraint.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This JSON schema description says the skill performs real-time video search and explains command-line parameters, but it does not define any explicit trigger phrases, scope limits, or exclusion conditions. In a manifest-like file, that lack of specificity can contribute to ambiguous activation behavior if this description is used to determine when the skill should run.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file presents all user-facing instructions and parameter descriptions solely in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This code sends a token and user-provided search keyword to external API endpoints via requestApi, which is a network/data-transmission operation covered by the warning requirement for code files. Although the functions have developer-facing docstrings, there is no visible user-facing disclosure here such as a prompt, print/log message, or explicit notice that these inputs are transmitted to a remote service.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The getSearchTask function issues a GET request containing the token, keyword, sort, publish_time, and limit to a remote endpoint. For code files, network calls that transmit user or system data should have some form of user disclosure, and this file contains only developer-oriented comments rather than a user-facing warning.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This code file contains natural-language comments entirely in Chinese, including user-relevant descriptions of constants such as API settings and retry behavior. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation, and there is no indication here that users may choose another language or that the constraint is region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The success and error messages use fixed Chinese text in string literals. For a general utility module, this creates a language/locale constraint without user opt-in or any documented justification, which matches the natural-language policy violation category.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code contains natural-language comments and a thrown error message exclusively in Chinese, with no indication that the skill is region-specific or that users can choose a language. The policy requires flagging language or locale constraints when they are imposed without opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The user-facing warning and promotional console output are entirely hard-coded in Chinese, which imposes a specific language on all users without any opt-in or alternative. This matches the policy concern for language or locale restrictions in natural-language content.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The help text documents examples using
--durationand-D, but the parser actually implements--publishTimeand-T. This is an active contradiction between inline documentation and code behavior, which can mislead users about what the script really accepts.- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest describes this skill as a real-time WeChat search data retrieval tool for articles, videos, and images. In addition to fetching and outputting search results, this script writes the full results to a local log file, which is a persistence behavior not suggested by the manifest description.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The help text and multiple user-facing messages in this file are fixed to a single language, which can violate language/locale policy when no user opt-in or locale selection is offered. The file does not indicate that the skill is intentionally region-specific or provide an alternative language option.
- Content
Static analysis
No suspicious patterns detected.