T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:102- Finding
API Key Exposure Through Credential File Output and Insecure File Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
支持国际短信批量群发 / 全球 SMS批量发送，提供营销短信和商务短信，支持双方回复，一键群发短信并通过即时任务追踪与送达报告监控每一条短信状态。帮助营销人员、销售团队、运营、客服向全球客户触达、追踪短信活动效果、驱动转化与回收——适合促销短信群发、订单/物流通知、客户批量外联与召回，适用于跨境电商、外贸出海与海外用户运营。
Security checks for vulnerabilities and agentic risk
Overview
This SMS skill appears purpose-related, but it handles paid messaging, account actions, and API keys in ways that need careful review before use.
Install only if you trust the Upkuajing service with recipient phone numbers, SMS content, delivery records, and paid account operations. Do not run commands that print ~/.upkuajing/.env, do not pass real API keys with --api_key, restrict the credential file permissions, and require a separate explicit confirmation for every paid SMS send or recharge flow.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sms_send.py:87- Finding
API Keys Can Be Supplied Through Observable Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unbounded Third-Party Dependency Allows Unreviewed Future Releases
- Content
View full analysis
=0.23.0 ``` ### Technical Analysis The dependency specification accepts any `httpx` release from version 0.23.0 onward. It provides no exact version, upper bound, lock file, or package-integrity hash. The documented setup procedure installs this requirement directly with pip. Consequently, two installations performed at different times may resolve to materially different dependency versions. A future incompatible or compromised release could therefore enter the Skill environment without a corresponding review of the Skill package. This finding does not establish that the current `httpx` package is malicious. The risk is that the installation policy automatically trusts future releases and their transitive dependency resolution. ### Attack Path 1. The user follows the documented dependency installation procedure. 2. Pip resolves `httpx>=0.23.0` to the newest available compatible release. 3. A future release or transitive dependency contains malicious or security-regressing behavior, or introduces an incompatible change. 4. The package is installed without hash verification or project-specific security review. 5. Its code executes during import or network operations. 6. Because the Skill processes API keys, SMS content, phone numbers, and account responses, a compromised dependency could access or alter those values within the Python process. ### Impact Assessment A compromised dependency executes with the same operating-system privileges as the Skill. It could potentially: - Read the API key available to the Python process. - Observe or alter SMS recipients and message content. - Intercept authenticated requests and responses. - Read files available to the executing user. - Make additional network requests. - Corrupt the Skill's results or local state. ...[truncated 152 chars]- Remediation
View remediation
other
Note
- Location
scripts/version_check.py:95- Finding
Undisclosed Automatic Version Telemetry and Persistent Home-Directory State
- Content
View full analysis
Path: UPKUAJING_DIR.mkdir(parents=True, exist_ok=True) return VERSION_CACHE_FILE ``` It also performs an additional network request: ```python def check_skill_version(skill_name: str, api_base_url: str) -> Optional[str]: try: url = f"{api_base_url}/agent/api/skills/version" headers = {"Content-Type": "application/json"} with httpx.Client(timeout=10.0) as client: response = client.post( url, json={"name": skill_name}, headers=headers ) response.raise_for_status() data = response.json() if data.get("code") == 0: return data.get("data") except Exception as e: print(f"Error checking skill version:{e}", file=sys.stderr) return None ``` The check is automatically triggered once per process and, subject to the cache, once per day: ```python def check_and_notify(api_base_url: str) -> bool: global _CHECKED_FLAG if _CHECKED_FLAG: return False _CHECKED_FLAG = True skill_name = get_skill_name() if not is_check_needed(skill_name): return False current_version = get_skill_version() latest_version = check_skill_version(skill_name, api_base_url) ``` ### Technical Analysis Ordinary SMS and account requests automatically cause a secondary unauthenticated request to the service's version endpoint. The request transmits ...[truncated 1745 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (41)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill description presents a narrow SMS-sending/status purpose, but the document also includes credential provisioning, local secret persistence, account management, recharge order creation, and error-reporting flows. This mismatch can mislead users and agents about what actions the skill may take, increasing the chance of consent bypass for sensitive or billable operations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description presents a narrow SMS-sending/status purpose, but the document also includes credential provisioning, local secret persistence, account management, recharge order creation, and error-reporting flows. This mismatch can mislead users and agents about what actions the skill may take, increasing the chance of consent bypass for sensitive or billable operations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The skill description presents a narrow SMS-sending/status purpose, but the document also includes credential provisioning, local secret persistence, account management, recharge order creation, and error-reporting flows. This mismatch can mislead users and agents about what actions the skill may take, increasing the chance of consent bypass for sensitive or billable operations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill description presents a narrow SMS-sending/status purpose, but the document also includes credential provisioning, local secret persistence, account management, recharge order creation, and error-reporting flows. This mismatch can mislead users and agents about what actions the skill may take, increasing the chance of consent bypass for sensitive or billable operations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description presents a narrow SMS-sending/status purpose, but the document also includes credential provisioning, local secret persistence, account management, recharge order creation, and error-reporting flows. This mismatch can mislead users and agents about what actions the skill may take, increasing the chance of consent bypass for sensitive or billable operations.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs reading a local .env file containing an API key. Exposing or encouraging access to raw secret material is dangerous because it can leak credentials through logs, model responses, screenshots, or downstream tool calls, enabling unauthorized use of the SMS account and related services.
- Content
使用此技能需要API密钥。API密钥保存在
~/.upkuajing/.env文件中：bash cat ~/.upkuajing/.env文件内容示例：
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The workflow instructs checking for a local API key and, if absent, automatically applying for a new key and saving it to ~/.upkuajing/.env. Automatic secret creation and persistence in a general local file increases attack surface, risks accidental disclosure, and blends account provisioning with ordinary tool use without strong trust boundaries.
- Content
md ### **未设置API密钥** 请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY; 如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择： 1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件) 2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env 等待用户选择；
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
This section continues the secret-handling pattern by directing the agent to inspect and populate a local .env file with UPKUAJING_API_KEY. In context, the danger is heightened because the same skill also performs outbound network and billable operations, so a leaked key can directly enable unauthorized messaging, account actions, and potential financial abuse.
- Content
md 请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY; 如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择： 1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件) 2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env 等待用户选择； ### **账户充值**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
This line persists a newly created API key in plaintext to a local .env file. Plaintext secret storage can expose the credential to other local users, misconfigured permissions, backups, or accidental inclusion in diagnostic output or repository files.
- Content
python "envFilePath": str(env_file) } # 保存到 .env 文件 try: with open(env_file, 'w', encoding='utf-8') as f: f.write(f"{API_KEY_ENV}={api_key}\n")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python API_BASE_URL = "https://openapi.upkuajing.com" API_KEY_ENV = "UPKUAJING_API_KEY" UPKUAJING_DIR = Path.home() / '.upkuajing' UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env' UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs' # 日志开关
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares access to environment variables and explicitly instructs reading and writing local credential files and making network requests, but it does not declare any tool scope or allowed-tools restrictions. This weakens least-privilege controls and makes accidental or unauthorized file, secret, and network access harder to constrain or audit.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
技能名称带有“zh”，全文说明也仅以中文提供，且未声明这是可选语言模式或仅面向特定中文场景。根据语言/locale 政策，若技能实际上强制使用单一语言而不给用户选择，可能构成自然语言策略违规。
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description focuses on sending SMS and viewing status, but the body also directs API-key application and recharge order creation. Expanding from messaging into credential issuance and payment-adjacent workflows without clear up-front disclosure increases the risk of unexpected sensitive actions.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document says the skill provides three SMS scripts, but later instructs the agent to perform additional actions like key issuance, pricing lookup, account info access, recharge order creation, and error reporting. This creates a deceptive interface boundary that can cause users to authorize a messaging tool without realizing it also performs secret management and financial/account operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill handles phone numbers and message content and sends them to external telecom-related services, yet the description does not clearly warn users about data externalization, privacy implications, or compliance obligations. In a messaging context, this omission is significant because the processed data is often personal, regulated, and cross-border.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Recharge order creation is a payment-related action that is not essential to the core task of sending or checking SMS messages. In skill ecosystems, hidden or loosely scoped financial operations are especially risky because they can trigger unintended charges, phishing-like payment flows, or social engineering around payment URLs.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Broad natural-language trigger guidance can cause the agent to invoke this skill in response to ambiguous everyday requests. Because the skill can access credentials, contact data, and billable SMS operations, accidental invocation raises privacy, consent, and cost risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation explicitly allows sending request parameters, response data, and exception context to an error-reporting endpoint, which can easily include customer phone numbers, message contents, API payloads, tokens, or stack traces containing secrets. Although it mentions that sensitive fields are 'automatically desensitized', it does not define what is treated as sensitive, does not require minimization, and provides no clear warning or consent guidance before transmitting potentially private data off-path for diagnostics.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
python pass # 如果读取失败，继续执行 # 不需要认证申请新密钥 response = make_request('/agent/auth/create', {}, require_auth=False) # 检查是否申请成功 if response.get('code') != 0:
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/common.py:197
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/sms_send.py:25
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/sms_task_list.py:28
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/sms_task_record_list.py:30