T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/reconcile.py:48- Finding
Unvalidated API destination can receive WMS authentication material
- Content
View full analysis
- Remediation
View remediation
Security audit
WMS仓库收费对账
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real WMS billing reconciliation skill, but it needs review because it handles WMS credentials and business data with weak scoping and disclosure.
Install only if you are comfortable providing WMS API credentials to this local script. Verify the WMS base URL yourself, prefer HTTPS, avoid putting real AppSecret values in shared shells or logs, and treat generated HTML reports as sensitive files that may contain business data.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/reconcile.py:650- Finding
AppSecret is exposed through command-line arguments
- Content
View full analysis
" \ --base-url "https://jou.topwms.com/api/open/erp" \ --date-from "2026-06-01 00:00:00" --date-to "2026-08-17 23:59:59" \ [--skip-rent] [--mark-excel] [--output-dir "./output"] ``` `SKILL.md` provides the same invocation pattern: ```bash python scripts/reconcile.py \ --excel "C:/path/to/收费清单.xlsx" \ --base-url "https://jou.topwms.com/api/open/erp" \ --app-key "xxx" \ --app-secret "xxx" \ --warehouse-id "<仓库ID>" \ --date-from "2026-06-01 00:00:00" \ --date-to "2026-08-17 23:59:59" \ --skip-rent # 跳过仓租费 --mark-excel # 标红Excel异常 ``` ### Technical Analysis Command-line arguments are commonly exposed through shell history, process inspection interfaces, task-management utilities, job metadata, audit systems, crash diagnostics, and CI/CD logs. Quoting the secret does not protect it from these channels. The code does not intentionally write the AppSecret into its generated HTML or JSON reports, and it does not directly upload the secret. Nevertheless, accepting the secret as a literal process argument can result in local per ...[truncated 1532 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/reconcile.py:447- Finding
Unescaped spreadsheet and API values enable stored HTML injection
- Content
View full analysis
WMS 仓库收费对账报告
📋 账单编号: {bill_summary.get('bill_no', 'N/A')} 📅 账期: {bill_summary.get('date_range', 'N/A')} 💰 账单总额: {bill_summary.get('bill_total', 'N/A')} CNY 🕐 生成时间: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}``` Order and issue values are also interpolated without escaping: ```python if outbound_issues: html += """""" for r in outbound_issues: html += f"" html += "
" ``` Return SKU information is assembled as raw HTML: ```python for r in return_results: status_color = '#2e7d32' if r['status'] == '已入库' else '#c62828' sku_str = '序号 业务单号 运单号 Excel金额 状态 拦截 问题 {r['index']} {r.get('order_sn','')} {r.get('tracking_no','')} {r.get('excel_fee','')} {r['status']} {r.get('hold_up_status','')} {r.get('issue','')}
'.join([f"{s['sku']}: 入库{s['inStorageQuantity']}, 签收{s['signQuantity']}" for s in r.get('sku_details', [])]) html += f"{r['index']}{r.get('rma_no','')}{r.get('excel_fee','')}{r.get('tab','')}{r.get('gmt_sign','')}{r.get('total_in_storage','')}{sku_str}- Remediation
View remediation
`, separate from escaped data values. 4. Validate and normalize fields that are expected to contain only identifiers, dates, numeric amounts, or fixed status values. 5. Add a restrictive Content Security Policy, for example one that disables scripts and limits network destinations. 6. Avoid inline event handlers and JavaScript entirely because the report is intended to be static. 7. Consider generating a non-active format such as a properly escaped spreadsheet or PDF when feasible. 8. Add tests containing `<`, `>`, `&`, quotes, SVG payloads, image error handlers, and script tags in every spreadsheet/API-derived field. 9. Treat both workbook content and API responses as untrusted, including responses from the normal WMS endpoint. 10. Regenerate previously produced reports from trusted data after applying output encoding. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill directs users to run a script that performs network access and writes files, but the skill manifest does not declare any explicit tool scope or permissions. This weakens reviewability and least-privilege controls: an agent or user may invoke a skill with broader capabilities than are obvious from the metadata, increasing the chance of unintended data access, credential use, or file modification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Several triggers in this range, such as “核账”, “收费核对”, and fee-type phrases, are ambiguous enough to overlap with broader finance, ERP, or non-WMS workflows. In this skill’s context, that ambiguity is more dangerous because the manifest declares sensitive API-key usage plus Read/Write/Bash permissions, increasing the chance of unintended execution against local files or credential-handling paths.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrase at line 25 is simply “对账”, which is extremely broad and likely to match many unrelated accounting or reconciliation requests. Because this skill requests API credentials and has Bash permission, accidental activation could cause the agent to invoke a higher-risk workflow in contexts where the user did not intend to use this warehouse-reconciliation skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file describes a Base URL for external API calls, the use of an appSecret for request signing, and AppKey/Signature headers, but it does not include any warning about privacy, credential handling, or the fact that operational data will be transmitted to an external system. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data, privacy, or system integrity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code writes a generated HTML report to disk, and elsewhere in the script also writes JSON output and may modify or create Excel files. Although these file operations are part of the tool's purpose, the write sites themselves provide no prior warning comment or confirmation, and the top-level docstring does not clearly warn that running the script will create output files and may overwrite the original Excel when marking is enabled.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
When --mark-excel is used, the script modifies workbook content and may overwrite an existing file path without a strong explicit confirmation step at the point of write. In a skill/agent context, file modification of user-supplied documents is more sensitive because users may not realize the original workbook or a chosen output file will be changed, leading to data integrity loss or accidental overwrite.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file is almost entirely presented in Chinese, including the primary legal and safety-related notice content. Under the policy rule, forcing a specific language without giving users a choice or documenting a justified locale restriction is a natural-language policy violation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill asks users to supply AppKey/AppSecret and run a script that can modify the original Excel workbook via --mark-excel, but the warning about in-place file changes is not prominent. This creates a risk of accidental alteration of source billing evidence or operational spreadsheets, which can affect audit integrity and user trust even if no malicious behavior is intended.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script's user-facing documentation and CLI messages are entirely in Chinese, with no indication that another language can be selected. Under the stated policy, forcing a single language without offering user choice is a locale/language policy issue unless clearly justified as region-specific.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
技能描述将用途聚焦于仓库收费清单与WMS业务记录逐笔核对，并在触发词中明确列举了仓租费、出库费、包装费、退件费等场景，但未提及销毁费。这里额外实现了销毁费明细核对逻辑，属于对已声明对账范围的扩展，而不是实现上述已声明能力所必需的细节。
- Content
Static analysis
No suspicious patterns detected.