T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:27- Finding
Unscoped access to sensitive mobile notifications
- Content
View full analysis
- Remediation
View remediation
Security audit
yoooclaw-world-cup-match-talk-scene-en
Security checks for vulnerabilities and agentic risk
Overview
This skill is a Review item because it can search broad mobile notifications for football chatter and includes an insecure public-source scraper, though I found no destructive behavior or confirmed data exfiltration.
Install only if you are comfortable with the agent searching recent mobile notifications for match-related chatter. Prefer providing a narrow notification file, exact apps/groups, and a short time range. Treat public-source results as untrusted because the bundled scraper has TLS and source-validation weaknesses.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/probe_cn_football_sources.py:185- Finding
TLS certificate verification disabled for external content retrieval
- Content
View full analysis
tuple[int, str, str]: request = Request( url, headers={ "User-Agent": USER_AGENT, "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.6", }, ) context = ssl._create_unverified_context() try: with urlopen(request, timeout=timeout, context=context) as response: raw = response.read() charset = response.headers.get_content_charset() or guess_charset(raw) return response.status, raw.decode(charset, "ignore"), "" except HTTPError as exc: raw = exc.read() return exc.code, raw.decode(guess_charset(raw), "ignore"), str(exc) except (URLError, TimeoutError, OSError) as exc: return 0, "", repr(exc) ``` ### Technical Analysis `ssl._create_unverified_context()` disables server-certificate verification. As a result, the scraper does not verify that an HTTPS endpoint presents a certificate issued by a trusted authority for the requested hostname. This undermines the confidentiality and integrity guarantees of HTTPS. A network-positioned attacker can present a forged or self-signed certificate and modify responses from search engines or sports websites without causing the request to fail. The fetched content is parsed into titles, summaries, publication dates, authors, and sample facts. Although the reviewed code does not execute page scripts or downloaded Python code, forged content can still poison the factual material subsequently used by the Skill. ### Attack Path 1. The Skill invokes the scraper to gather football-source material. 2. The scraper requests an HTTPS search or article URL. 3. An ...[truncated 868 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/probe_cn_football_sources.py:231- Finding
Domain allowlist bypass through substring hostname matching
- Content
View full analysis
list[str]: extractor = TextExtractor() extractor.feed(body) candidates = extractor.links + re.findall(r"https?%3A%2F%2F[^\"'<>\\\s]+", body) urls: list[str] = [] for candidate in candidates: candidate = html.unescape(unquote(candidate)) if candidate.startswith("//"): candidate = "https:" + candidate if not candidate.startswith(("http://", "https://")): continue parsed = urlparse(candidate) if any(domain in parsed.netloc for domain in domains): urls.append(clean_tracking_url(candidate)) return urls ``` ### Technical Analysis The code attempts to restrict search-result URLs to approved sports domains, but it checks whether an approved domain appears anywhere in `parsed.netloc`. Substring matching does not establish hostname ownership. For example, an attacker-controlled URL such as: ```text https://dongqiudi.com.attacker.example/article ``` contains `dongqiudi.com` in its network location and therefore passes the current check. Similar bypasses are possible for the other configured source domains. The value of `parsed.netloc` may also include user-information and port components. It is therefore inappropriate for direct domain comparison. The normalized `parsed.hostname` property should be used instead, followed by an exact-domain or legitimate-subdomain comparison. Search-result HTML is external input. An attacker able to influence a search result, injected response, or intermediary page can cause the scraper to request an unapproved host and process its content as if it came from a trusted sports source. ### Attack Path 1. The scraper requests a search-results p ...[truncated 1305 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is presented as a conversation-kit generator, but its workflow includes source probing, structured crawling, command execution, and scraping-diagnostics generation that materially exceed or differ from the declared purpose. This mismatch undermines informed consent and can conceal data collection or tool use that users would not reasonably expect from the description alone.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code creates an unverified SSL context with ssl._create_unverified_context(), disabling certificate validation for all HTTPS requests. This makes the scraper susceptible to man-in-the-middle attacks, allowing attackers on the network path to tamper with fetched pages, inject false sports content, or return malicious data while appearing to come from trusted sites.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill instructs use of network access, file output (
--out /tmp/...json), and command execution behaviors, but does not declare explicit tool scope or permissions. That creates an authorization gap where the runtime may permit broader capabilities than users expect, reducing transparency and making abuse or accidental overreach harder to detect.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes searching mobile notifications, fan groups, and recent device-derived signals, including a default time window and potentially unrestricted scope, without a clear upfront privacy warning or explicit opt-in language. Notifications can contain sensitive personal, social, and contextual data, so silent or weakly disclosed access materially increases privacy and data-minimization risk.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 87% confidence
- Finding
The skill authorizes autonomous decisions such as inferring match identity and, more importantly, querying recent notifications without limiting groups or applications when context is deemed needed. In a skill that touches device notifications and external retrieval, this reduces meaningful user control and can expand data access beyond what the user explicitly requested.
- Content
md If `who to follow' is not enough to uniquely determine the match, public information will be used to infer it first; if there are still multiple candidate matches, only one confirmation will be asked. If `what to focus on` is empty, no output mode is specified, or it only says "module output" but does not list specific modules, directly use `full` to output in full without asking.If `Which groups and applications to follow` is empty, you can still generate a discussion package based only on public information; when notification context is needed, query recent notifications without limiting the scope of groups and applications. Users are not required to provide fan group notifications. Notification refinement is only performed when the user requests a notification/group chat context, provides a notification file, or includes a notification scope in Groups and Apps to Follow. ## Output mode
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction 'Chinese output is used by default unless the user specifies other languages' imposes a language choice on the user. This is a natural-language policy concern because it defaults to a specific locale/language rather than offering a neutral choice or asking user preference first.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The template explicitly encourages extracting conversation topics from a user's mobile phone notifications and fan-group signals, but it provides no privacy guardrails, consent requirement, minimization rule, or warning about handling personal data. In this skill's context, that creates a real risk of processing sensitive personal or group information beyond user expectations, especially when notification retrieval is integrated into the workflow.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The template instructs users to generate copywriting to post directly on "Moments/Weibo," which implies a specific language/locale and platform context without any opt-in or alternative. This is a natural-language locale policy concern because the file does not indicate that the skill is region-specific or that users may choose another language or platform.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script actively probes third-party search engines and Chinese sports sites using direct HTTP requests, which expands behavior beyond a narrowly scoped notification-retrieval skill and creates ungoverned outbound network access. In an agent environment, this can bypass expected platform retrieval controls, increase privacy/compliance risk, and fetch untrusted content from arbitrary external pages for downstream use.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The HTTP request hard-codes
Accept-Language: zh-CN,zh;q=0.9,en;q=0.6, which steers remote services toward a specific language/locale regardless of user preference. This is a natural-language policy concern because the script does not expose any option for users to choose or override the locale.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The line instructs the user to 'just say and pronounce them,' and the document is framed as a fixed set of phrases to use directly. Because the template provides no option to choose language or locale, it may implicitly enforce a particular wording style without user opt-in.
- Content