Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed LLMFill integration that uploads user-chosen documents to llmfill.com for form filling and knowledge-base use, with meaningful warnings and scoped controls.
Install only if you are comfortable sending the selected documents and knowledge-base files to llmfill.com for processing and storage. Do not upload confidential, regulated, or internal-only material without authorization, protect the long-lived aif_ API token, and confirm any delete operation because remote knowledge-base or result data may not be recoverable.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
$ python scripts/llmfill.py fill-status b_9f2a # 确认 completed/failed/partial（进行中不可删）
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
POST /v1/documents/upload -> {batch_id, tasks} （余额不足 402 拒单） GET /v1/documents/{batch_id}/status （轮询，3-5s 间隔；tasks[].cost = 实扣） GET /v1/documents/{batch_id}/result[?clean=true] （下载） DELETE /v1/documents/batches/{batch_id} （清理）
> 费用链路：余额不足时上传即被拒（402，message 含预估费用与充值指引，
The file documents a destructive DELETE endpoint that permanently removes both the original file and all parsed vector/index data, while explicitly noting that direct API use lacks the CLI confirmation safeguard. In an agent skill context, exposing such a powerful action without strong guardrails, confirmation requirements, or safer operational guidance materially raises the risk of accidental or unauthorized destructive actions through parameter misuse.
`document_id` 从文档列表获取。
> ⚠️ **删除不可恢复**：`DELETE /v1/knowledge-bases/{kb_id}/files/{document_id}`
> 会**同时删除原文件与已解析的全部向量/索引数据**，且无软删除、无回收站，
> 无法恢复。删除前请确认本机留有源文件副本（必要时先用 download 接口导出）；
> CLI 侧 `llmfill kb rm` 会要求交互确认或显式 `--yes`，直接调 API 则没有这层保护。
This duplicate finding reflects the same core issue: the skill contains executable parameterizations for a network tool that can upload documents, send authentication material, poll remote jobs, and delete remote data. In an agent setting, such guidance increases the chance of unsafe automated tool invocation and unauthorized data handling.
# 无 Python 环境的 curl 操作指南
> 本指南用于**本机没有 Python** 时：agent 直接用 Bash + curl 调用网关 API
> 完成全部功能（curl 在 Windows 10+/Linux/macOS 均自带）。有 Python 时
This duplicate finding reflects the same core issue: the skill contains executable parameterizations for a network tool that can upload documents, send authentication material, poll remote jobs, and delete remote data. In an agent setting, such guidance increases the chance of unsafe automated tool invocation and unauthorized data handling.
# 无 Python 环境的 curl 操作指南
> 本指南用于**本机没有 Python** 时:agent 直接用 Bash + curl 调用网关 API
> 完成全部功能(curl 在 Windows 10+/Linux/macOS 均自带)。有 Python 时
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
assert _safe_filename("result.docx") == "result.docx"
def test_posix_traversal(self):
assert _safe_filename("../../etc/passwd") == "passwd"
def test_absolute_posix(self):
assert _safe_filename("/etc/passwd") == "passwd"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
assert _safe_filename("result.docx") == "result.docx"
def test_posix_traversal(self):
assert _safe_filename("../../etc/passwd") == "passwd"
def test_absolute_posix(self):
assert _safe_filename("/etc/passwd") == "passwd"
The skill documentation is written entirely in Chinese, including installation, warnings, and usage instructions, with no indication that users may choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is justified, which is not present here.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
python scripts/llmfill.py fill 表单.docx --json
python scripts/llmfill.py kb create --name "资料库" python scripts/llmfill.py kb upload <kb_id> 手册.pdf python scripts/llmfill.py fill 表单.docx --kb <kb_id>
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
python scripts/llmfill.py fill 表单.docx --json
python scripts/llmfill.py kb create --name "资料库" python scripts/llmfill.py kb upload <kb_id> 手册.pdf python scripts/llmfill.py fill 表单.docx --kb <kb_id>
The documentation shows a concrete authentication header format with a token-looking example (X-Auth-Token: aif_xxx) but gives no warning about secret handling, storage, logging, or accidental disclosure. In agent or automation contexts, this increases the chance that users hardcode real API tokens into prompts, scripts, repos, or logs, leading to credential exposure and unauthorized API access.
The guide explicitly instructs an agent to use curl to upload local documents and an API token to a third-party remote service, which is a real external data transmission risk. Although the file includes privacy warnings and a confirmation gate, the skill still operationalizes exfiltration of document contents and credentials off-host if followed.
# 无 Python 环境的 curl 操作指南
> 本指南用于**本机没有 Python** 时：agent 直接用 Bash + curl 调用网关 API
> 完成全部功能（curl 在 Windows 10+/Linux/macOS 均自带）。有 Python 时
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
cat > ~/.llmfill/curl.conf <<'EOF' header = "X-Auth-Token: aif_你的令牌" EOF chmod 600 ~/.llmfill/curl.conf # 明文凭据文件仅本人可读写
之后所有 curl 命令用 `-K ~/.llmfill/curl.conf` 注入认证头。**不要**用
The entire skill reference is written in Chinese and does not indicate that other languages are supported or that Chinese is a required locale for a region-specific use case. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
This code contains natural-language documentation and runtime messages entirely in Chinese, including exceptions later raised to users. Under the policy, forcing a specific language without offering a language or locale choice is a natural-language policy violation unless clearly justified as region-specific, which is not documented here.
This code embeds natural-language documentation and user-facing exception text exclusively in Chinese, including setup and approval instructions. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
def test_poll_timeout(self):
with pytest.raises(ApiError, match="超时"):
poll_until_done(
interval=0, timeout=0.01,
poll_fn=lambda: {"status": "processing"},
is_done=lambda s: False,
)
This API documentation presents all natural-language instructions and usage details only in Chinese, and there is no statement that the skill is China-region-specific or that users can choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
This test file consistently specifies behavior and expected messages only in Chinese, including the top-level docstring and many assertion strings. That constitutes a natural-language locale constraint without any indication that users may choose another language or that the tool is intentionally region-specific.
No suspicious patterns detected.