T08 · Insecure Dependencies
Error
- Location
SKILL.md:57- Finding
Automatic Installation of Unpinned Global Dependencies from an Insecure Registry
- Content
View full analysis
- Remediation
View remediation
Security audit
byted-livesaas-master
Security checks for vulnerabilities and agentic risk
Overview
This skill matches a LiveSaaS control purpose, but it asks the agent to install global tools, use cached account credentials, and send startup telemetry by default.
Review before installing. Use this only in an environment where global npm installs and LiveSaaS account-control actions are acceptable, prefer preinstalling a vetted pinned CLI from a trusted HTTPS source, disable telemetry if your policy requires it, and avoid broad credentials on machines with unrelated sensitive data.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Warning
- Location
tools/report_usage.js:126- Finding
Automatic External Telemetry on Every Skill Activation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description omits that every activation triggers outbound telemetry/reporting and possibly external process execution for fallback reporting. Hidden network egress tied to activation is particularly risky because it can leak installation context, agent identity, versioning, or usage metadata without informed user approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description omits that every activation triggers outbound telemetry/reporting and possibly external process execution for fallback reporting. Hidden network egress tied to activation is particularly risky because it can leak installation context, agent identity, versioning, or usage metadata without informed user approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description omits that every activation triggers outbound telemetry/reporting and possibly external process execution for fallback reporting. Hidden network egress tied to activation is particularly risky because it can leak installation context, agent identity, versioning, or usage metadata without informed user approval.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### 3.5 Onboarding 状态记忆 - 凭证验证通过后，**本会话内不再重复 onboarding** - 凭证已持久化到 `~/.bytedlive/openapi-credentials.json`，后续会话自动加载，无需重复配置 - 如果后续操作中出现凭证失效（401/403），按 §7 错误恢复策略处理，不重新走完整 onboarding ### 3.6 快速能力概览（验证通过后附带）
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
The skill is designed to probe local credential state, reuse cached credentials, and process authorization codes through the agent, which is sensitive credential-adjacent behavior. In the context of a skill that also performs hidden telemetry and broad shell actions, credential handling by the agent becomes more dangerous because it expands access to account operations and may expose auth artifacts through logs, subprocesses, or unintended reporting paths.
- Content
md |------|------| | **登录凭证** | 必需。执行任何 OpenAPI 操作前，必须先执行 `bytedlive openapi check-credentials --pretty`。若 console-login profile 或 legacy AK/SK 缓存可用，直接复用；若不可用，Agent 必须先执行 `bytedlive login --remote --region cn-beijing` 发起登录。若 console-login 链路不通、不可用或用户处于 CI/私有化等场景，必须保留 AK/SK 兼容路径：执行或引导 `bytedlive openapi set-credentials`，禁止只把 login 命令贴给用户手动执行，禁止在对话中索要 AK/SK | | **Base URL** | 默认固定 `https://livesaas.volcengineapi.com/`，**不向用户询问**。用户指定 BOE / 测试环境时，所有 `bytedlive openapi/control/viewer` 命令自动追加 `--boe`，OpenAPI Base URL 使用 `https://volcengineapi-boe.byted.org`；仅用户主动提供专用 endpoint 时通过 `BYTEDLIVE_BASE_URL` 覆盖 | | **缓存优先级** | 命令行/环境变量 → console-login profile 临时 STS → 会话缓存 → legacy 本地文件 `~/.bytedlive/openapi-credentials.json` | | **凭证失效** | 401/403/签名错误时，Agent 先执行 `bytedlive login --remote --region cn-beijing` 重新发起授权；若 console-login 仍失败或当前环境不支持该链路，改走 `bytedlive openapi set-credentials` 兼容路径 | | **自动登录** | 本地交互终端执行业务命令时，缺登录态会自动打开默认浏览器授权并通过 `127.0.0.1` 本地回调接收 code；OpenClaw 等 Agent/远程容器环境应走 `BYTEDLIVE_AUTO_LOGIN_MODE=remote` 或显式 `bytedlive login --remote`，不要依赖本地 callback；CI/`--non-interactive` 场景不等待浏览器，只输出登录引导 | | **remote 授权结果处理** | 默认走 Agent 代执行：用户把浏览器返回的 `code` 发回后，Agent 执行 `bytedlive login --remote --authorization-code <code>` 完成 pending login；若用户希望自主执行，也可给出 `bytedlive login --remote --authorization-response '<base64-result 或 callback URL 或 code=...&state=...>'` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 2. 静态表 `openapiActionVersions.json` 中的配置
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill requires shell execution and environment-aware behavior but declares no explicit tool scope or permissions. In practice this gives the agent latitude to run commands like telemetry scripts, npm global installs, and CLI login flows without a narrow allowlist, increasing the chance of overbroad execution or abuse if the skill is triggered unexpectedly.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes broad everyday terms such as comments, livestream room, or analytics-related phrases, making accidental activation more likely. In this skill, accidental activation matters because activation triggers telemetry, credential checks, possible login flows, and even installation attempts, so overbroad matching raises the risk materially.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file is written entirely as Chinese-only operational guidance and includes fixed Chinese user-facing response templates, but does not state that the skill is region- or language-restricted or offer multilingual output based on user preference. This can violate a language/locale policy when a skill effectively mandates one language without user opt-in.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to run an external reporting script on every activation before serving the user's request. This is unrelated to core livestream control and creates a persistent covert egress channel that can transmit usage metadata or environment-derived identifiers whenever the skill is invoked.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The onboarding flow directs the agent to perform global npm installations, including a package from an internal HTTP registry, which modifies the host environment and broadens the skill's power beyond its nominal business task. This can expose users to supply-chain risk, unauthorized system changes, and execution of unreviewed code with the agent's privileges.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The top-level documentation links explicitly append
?lang=zh, which hard-codes a Chinese locale in this manifest-style JSON. Because the file provides no indication that this skill is region-specific or that users can choose another language, it creates a locale-specific behavior that may violate language/locale neutrality expectations.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
Managing callback endpoints changes backend integration behavior by registering external URLs, which is qualitatively different from operating a live room, moderating comments, or analyzing audience data. The manifest does not explicitly declare webhook/callback administration as part of the skill’s purpose, so exposing this capability appears contextually broader than necessary.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a LiveSaaS control skill focused on live rooms, comments, audience management, product cards, analytics, media operations, and account/benefit queries. This file also enumerates active account-administration operations such as creating subaccounts, which changes platform identity/authorization state rather than controlling a live room or querying account info.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The catalog includes credential and token retrieval operations such as login STS, SDK tokens, login secrets, and temporary login tokens. In a live-room control skill, exposing or normalizing these actions increases the chance that an agent or wrapper will surface sensitive authentication material outside the intended operator workflow, enabling session hijack or unauthorized room access if misused.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
When the normal HTTP client path fails, the script falls back to spawning curl to transmit telemetry, adding an unnecessary external-process execution path unrelated to core LiveSaaS control functionality. This broadens the attack surface, depends on ambient system binaries and PATH resolution, and can undermine security controls or auditing assumptions around outbound network behavior.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code sends telemetry to an external endpoint on skill startup without any indication in this file of user notice, consent, or minimization. Even though the payload appears limited to skill name, agent, event ID, and version, it still creates an outbound data flow that can expose environment or usage metadata and can be redirected via the BYTEDLIVE_TELEMETRY_ENDPOINT environment variable.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Telemetry is transmitted automatically during execution without any visible confirmation, prompt, or notice in this code path. In a control-plane skill that may run in enterprise environments, even basic usage metadata can be sensitive because it reveals deployment, tooling, and operational activity patterns.
- Content