T09 · Insecure Skill Coding Practices
Error
- Location
scripts/seederive.py:41- Finding
Cloud credentials and user data can be sent to an arbitrary endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Byted Data Label
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real Seederive/Volcengine data-labeling skill, but it has broad activation rules, sends credentials and user data to a configurable remote endpoint, and exposes delete/configuration actions without clear confirmation safeguards.
Install only if you intentionally want an agent to operate Seederive with Volcengine credentials. Use narrowly scoped credentials, do not set SEEDERIVE_BASE_URL or --base-url to untrusted hosts, avoid sending sensitive datasets unless approved, and manually confirm any delete, model-change, task-change, or bulk-upload operation before it runs.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
scripts/seederive.py:27- Finding
Runtime installation of an unpinned dependency creates a supply-chain execution risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (20)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The activation rules are extremely broad and mandatory, requiring this skill for many common requests involving classification, translation, analysis, or CSV/Excel processing. This can route a wide range of ordinary user data into an external processing workflow without sufficient user awareness or narrower intent matching, increasing the chance of unnecessary data exposure and tool overuse.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill invokes shell commands, reads environment-provided credentials, and communicates with an external service, but it does not declare any explicit tool/permission scope. That creates unnecessary ambiguity about what the skill may access or execute, increasing the risk of unintended command execution, credential exposure, or overbroad file/network access when the skill is activated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation instructs operators to set access key and secret key environment variables and test connectivity, but it provides no warning about secure storage, redaction, rotation, or avoiding disclosure in logs and transcripts. In a skill context, that omission can lead users to paste secrets unsafely or leave long-lived credentials exposed to the execution environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The examples encourage uploading local CSV/Excel files to a remote service and exporting analysis results to local CSV files, but they do not warn that the source data may be transmitted externally or that output files may contain sensitive derived content. This is especially risky because the skill targets bulk unstructured data, which often includes personal, proprietary, or regulated information.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger conditions are overly broad and include common phrases like '帮我优化一下提示词' or '换个模型试试', which can cause the skill to activate in situations where the user did not intend to use Seederive or perform external task modifications. In this skill, activation can lead to downstream actions such as uploading data, changing model settings, or initiating optimization jobs, so mistaken invocation has real operational and privacy consequences.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill requires external credentials and supports uploading error cases/files and modifying model configuration, but it does not clearly instruct the agent to warn the user that data will be sent to an external service or that task settings may be changed. This is dangerous because users may unknowingly expose sensitive text in error cases or trigger configuration changes with cost, privacy, or workflow impact.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill documents a destructive
tag-base delete --id 42command without requiring an explicit confirmation step, safety warning, or guidance to verify the target resource first. In an agentic context, this increases the chance of unintended data loss if the agent executes the command based on ambiguous user intent or a misidentified ID.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly supports deleting tasks and provides a direct deletion command, but it does not require or instruct the agent to obtain explicit user confirmation, show the task details to be deleted, or warn about irreversibility. In an agent setting, this increases the risk of accidental or prompt-induced destructive actions against user data or workflows, especially because task IDs and names may be ambiguous.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Runtime package installation is unrelated to the core purpose of calling a labeling API and materially expands the trust boundary of the skill. In an agent setting, hidden dependency installation can execute unintended code, alter the environment, and pull artifacts from external repositories without review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script runs pip automatically without an explicit user-facing confirmation, which can surprise operators and execute network-dependent installation steps in sensitive environments. This is especially risky for agent skills because users may not expect environment mutation or subprocess execution from a nominal API client.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
The script automatically invokes pip to install requests at runtime via a subprocess when the import fails. This creates an unnecessary code-execution and supply-chain risk surface for a data-labeling CLI, because package installation occurs without explicit user approval and depends on the current Python/pip environment and configured package indexes.
- Content
python except ImportError: print("缺少 requests 库，正在安装...") import subprocess subprocess.check_call([sys.executable, "-m", "pip", "install", "requests", "-q"]) import requests
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script reads access credentials from environment variables and sends them as request headers in multiple API calls. While the docstring names the required variables, it does not clearly warn users that these secrets will be transmitted to the configured remote endpoint, including any overridden base URL.
- Content
Tainted flow: 'data' from requests.get (line 101, network input) → requests.post (network output)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python with open(file_path, "rb") as f: files = {"file": (os.path.basename(file_path), f)} data = extra_fields or {} resp = requests.post(_url(config, path), headers=_headers(config), files=files, data=data) _print_response(resp) return resp
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill is presented as a batch analysis/labeling tool, but the code also exposes destructive remote-management actions such as deleting tasks and modifying platform state. That mismatch is dangerous in an agent context because users may authorize analysis while unintentionally granting the skill the ability to remove or alter remote resources.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Delete operations against remote resources are executed immediately with no confirmation prompt, dry-run mode, or explicit irreversibility warning. In an agent-driven workflow, this materially raises the chance of accidental or prompt-induced destructive actions being carried out against user data or platform state.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This delete path removes additional remote resources without confirmation or a warning about permanence. Because the skill is intended for batch data operations, hidden destructive capabilities become more dangerous when triggered through high-level natural-language instructions.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Model-management operations allow remote configuration changes that go beyond the skill's advertised analysis workflow. In an agent environment this increases risk of unauthorized service changes, degraded model behavior, and accidental policy circumvention if invoked under the guise of simple data processing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Tag-base deletion is a destructive administrative action performed without confirmation or guardrails. In this skill context, that is riskier than in a dedicated admin tool because users may not expect a labeling skill to be capable of removing shared taxonomy resources.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill instructions, trigger phrases, examples, and operational guidance are entirely written in Chinese, with no indication that the user may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
User-facing docstrings, help text, and console messages are presented exclusively in Chinese throughout the CLI. There is no language selection, English alternative, or documented justification for restricting the interface to a single language.
- Content
Static analysis
No suspicious patterns detected.