T09 · Insecure Skill Coding Practices
Error
- Location
src/__init__.py:8- Finding
API Credentials Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
gsdata-search
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward GS Data search client, but it sends API signatures and search terms to a hardcoded plaintext HTTP endpoint.
Review this skill before installing. Use it only if you are comfortable sending the project ID, API signature, keywords, and time filters to the GS Data service, and avoid using sensitive credentials while the endpoint remains plaintext HTTP. Prefer a version that uses HTTPS, avoids passing secrets on the command line, and pins Python dependencies reproducibly.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/__init__.py:61- Finding
Sensitive API Signature Exposed through Command-Line Arguments
- Content
View full analysis
`. 2. The shell may retain the complete invocation in its command history. 3. While the process is running, an authorized local observer or monitoring agent may inspect its command-line arguments. 4. An attacker with access to the history file, process metadata, job output, or monitoring logs extracts the signature. 5. The attacker reuses the signature for API requests within the credential's permitted scope. ### Impact Assessment The attacker can obtain the API signature and potentially impersonate the legitimate client when accessing the GS Data API. Resulting access is bounded by the signature's authorization scope and validity period. Exploitation generally requires local account access, a ...[truncated 191 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
package.json:8- Finding
Ambiguous and Insufficiently Constrained Dependency Declarations
- Content
View full analysis
=2.25.1 ``` ### Technical Analysis The implementation imports the Python `requests` package, but the JSON manifests express the dependency using npm-style syntax. An installer that interprets `package.json` or `plugin.json` as JavaScript package metadata may resolve an npm package named `requests` rather than the required PyPI package. The Python requirement uses an open-ended lower bound and provides no lockfile or integrity hashes. Consequently, installation results can vary over time and may include future versions that were not reviewed with this project. The repository does not itself prove that a malicious dependency is currently installed. The security concern is that its declarations permit ambiguous ecosystem resolution and do not provide reproducible, integrity-checked Python dependency installation. ### Attack Path 1. A plugin or package installer reads an npm-style JSON dependency declaration. 2. The installer attempts to resolve `requests` from the npm ecosystem even though the runtime code expects the Python package. 3. Unintended package installation can introduce unrelated installation scripts or code into the environment, depending on installer behavior. 4. Separately, a Python installation resolves `requests>=2.25.1` to the newest matching release available at installation time. 5. A compromised, malicious, or incompatible future release could therefore be installed without a repository change or integrity verification. ### Impact Assessment The likely immediate impact is installation ...[truncated 471 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill documentation instructs users to provide a project_id, signature, and search parameters for an external API but does not clearly warn that these values will be transmitted off-system to projects-databus.gsdata.cn. This can lead users to disclose sensitive credentials or sensitive search terms without informed consent, which is especially relevant because API signatures are authentication material and search queries may contain proprietary or regulated data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The client sends the project_id, signature, and search parameters to a hardcoded HTTP endpoint, which provides no transport-layer confidentiality or integrity. An attacker on the network path could intercept or modify the request or response, exposing credentials/signatures and search data or tampering with returned results.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
The dependency is specified with a caret range (^2.31.0), which allows automatic installation of newer minor/patch releases rather than a single exact version. This can introduce supply-chain risk through unexpected upstream changes or compromised releases, though the impact here is limited because it affects only one common dependency and there is no additional evidence of malicious package manipulation in this file.
- Content
json "author": "Your Name", "license": "MIT", "dependencies": { "requests": "^2.31.0" } }
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The dependency is specified as
requests>=2.25.1, which allows any newer version to be installed and does not guarantee reproducible or reviewed builds. This can unintentionally pull in vulnerable or breaking releases over time, making supply-chain risk harder to control and audit.- Content
text requests>=2.25.1
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
requestshas multiple known advisories, and because the manifest does not pin the package version, it is not possible to verify whether the installed version is affected or safe. In security-sensitive agent skills, this uncertainty increases supply-chain exposure because deployments may resolve to different versions across environments.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
Natural-language strings such as the module docstring, function docstring, and CLI help are presented in Chinese, which can effectively force a specific language for users who invoke or read the tool. The file does not indicate that this is a region-specific tool or provide any opt-in or alternative language support.
- Content