Virsical 办公助手

• Outcome: Review
• Latest audit: Sep 23, 2026 · 2:55 AM UTC
• Version: 1.0.5

Overview

This appears to be a real Virsical workplace integration, but it needs review because it asks users to paste login authorization codes into chat and ships a recoverable OAuth client credential.

Review this skill before installing. Use it only if you accept that Virsical authorization codes may appear in chat transcripts and that local token files will be created under the skill directory. The publisher should replace chat-pasted authorization codes with a safer OAuth or device-code flow, remove and rotate the embedded OAuth client secret, and require explicit confirmation before live bookings or work-order creation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth_manager.py:218
• Finding: Hardcoded OAuth Client Credential in Distributed Source Code## Vulnerability Details **File Location**: `scripts/auth_manager.py:218-231`, with repeated use at `scripts/auth_manager.py:302-311` and `scripts/auth_manager.py:391-409` **Vulnerability Type**: Hardcoded OAuth client credential **Risk Level**: Medium ### Vulnerable Code ```python try: credentials = "bG9naW4tYWdlbnQ6QWdlbnQjMjAyNg==" body = urllib.parse.urlencode({ "grant_type": "refresh_token", "refresh_token": refresh_token, }).encode() req = Request( f"{self.config.base_url}/vsk/virsical-auth/oauth/token", data=body, headers={ "Content-Type": "application/x-www-form-urlencoded", "Authorization": f"Basic {credentials}", }, method="POST", ) with urlopen(req, timeout=30) as resp: result = json.loads(resp.read().decode()) ``` The same credential is also used for token validation and authorization-code exchange: ```python credentials = "bG9naW4tYWdlbnQ6QWdlbnQjMjAyNg==" ``` The Base64 value decodes to: ```text login-agent:Agent#2026 ``` ### Technical Analysis The Skill embeds an OAuth Basic Authentication credential directly in its distributed Python source. Base64 is an encoding mechanism, not encryption, so anyone who can read or download the Skill can recover the client identifier and client secret without possessing additional keys. The credential is sent as an HTTP `Authorization: Basic` header to the Virsical OAuth endpoints during: - Refresh-token exchanges - Access-token validation - Authorization-code exchanges Although the requests use the configured HTTPS Virsical endpoint, transport encryption does not protect a secret already exposed in the client package. A distributable Agent Skill cannot reliably maintain the confidentiality of an embedded OAuth client secret. This is also inconsistent with the project's own security guidance in `references/auth_flow.md:154`, which states that a client secret should not be committed to the ...[truncated 1519 chars]
• Remediation: ## Remediation Suggestions 1. Immediately revoke and rotate the exposed OAuth client credential. 2. Remove the credential from the current source tree and repository history. 3. Do not place replacement secrets in distributable Skill files, environment templates, documentation, command examples, or build artifacts. 4. Prefer an OAuth public-client design using Authorization Code Flow with PKCE, because an installed or distributed client cannot securely retain a client secret. 5. If a confidential client is required, keep the secret in a trusted server-side component and have the Skill interact through a narrowly scoped backend flow. 6. Store deployment-only secrets in an approved secret manager and inject them only into trusted, access-controlled runtime environments. 7. Restrict the OAuth client to the minimum necessary grant types, scopes, redirect URIs, and token lifetimes. 8. Review authentication logs for unexpected use of the exposed client credential and invalidate affected tokens if misuse is detected. 9. Add secret scanning to source-control and release pipelines to prevent recurrence.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (42)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The code chunk does not implement the business functions named in the description (meeting booking/query, work-order repair creation, visitor record lookup). Instead, it is an authentication manager module for Virsical. While authentication can be a supporting component of such a skill, the declared description presents the skill's purpose as end-user workspace-management operations and does not disclose that this code's actual functionality is exclusively login/token handling, local callback serving, browser launch, and auth event persistence. That is a material description-versus-behavior mismatch for this supplied code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents an end-user integration skill that can perform operational tasks in the Virsical platform such as meeting reservation, facility work orders, and visitor management. However, the supplied code chunk is only a configuration module. It loads base URL values from a local file, returns fixed/default values for auth-related fields, and includes stubbed save/update/validate methods. There is no evidence of API calls, resource access for meetings/work orders/visitors, trigger handling, or user-facing bilingual behavior. This is therefore a material description-versus-behavior mismatch, with the actual code serving only as a supporting config component rather than implementing the declared skill capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents a functional integration for meeting reservation, work order repair handling, and visitor record lookup. However, the supplied code chunk is narrowly focused on license validation: it retrieves product codes from a cloud-OMS license endpoint and determines whether the user has permission for visitor, work order, or meeting modules. This is related to the same product domain, but it is not the same primary capability as booking meetings, creating work orders, or querying visitor records. License checking could be a supporting internal detail, but because the provided chunk contains only that behavior and none of the declared end-user operations, the description does not accurately represent what this code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The code is narrowly focused on meetings. It calls meeting-related endpoints such as /rooms, /rooms/occupied, /meeting/reserve, and /meeting/page; computes free/busy slots; formats room lists; and books/list meetings. This aligns with the declared meeting-query/booking portion. However, the declared description presents a broader integrated skill covering work orders and visitor management, which are absent from this code chunk. Also, there is no clear implementation of bilingual interaction beyond comments/docstrings containing some English. Therefore the description overstates the implemented capabilities for this supplied code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description presents a multi-capability Virsical integration covering meetings, work orders, and visitors. However, the code shown is exclusively for 工单/requirement handling: it calls requirement parameter APIs, project space/location APIs, and a requirement creation API. That means the actual implemented behavior in this chunk is substantially narrower than the declared purpose. While work-order repair is consistent with part of the description, the broader claims about conference booking and visitor lookup are not represented here. This is a description-behavior mismatch because the declared primary scope is materially broader than the code’s actual functionality.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs users to paste a sensitive Agent authorization code into the chat channel, which risks credential disclosure to logs, intermediaries, support personnel, or other systems that retain conversation history. This is especially dangerous because the code is described as sufficient to exchange for user tokens and act on the user's behalf against enterprise systems.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Requesting a sensitive authorization code directly in conversation is a classic secret-handling flaw. In this skill's context, the credential enables token issuance for business APIs, so exposure could allow unauthorized access to meetings, visitor data, or work-order actions under the user's identity.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The workflow repeats and normalizes the practice of pasting the user's sensitive authorization code into chat, increasing the likelihood users will disclose reusable credentials. Repetition makes the unsafe pattern part of the standard operating path, amplifying exposure across all future logins and making compromise through transcript access far more likely.

Credential Access

High

• Category: Privilege Escalation

Content

如果 token 即将过期，会自动尝试刷新。

        Returns:
            Access token 字符串，如果无效返回 None
        """
        token = self._token or self.load_token()
        if not token:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

如果 token 即将过期，会自动尝试刷新。

        Returns:
            Access token 字符串，如果无效返回 None
        """
        token = self._token or self.load_token()
        if not token:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

self.timeout = 30  # 默认 30 秒超时

    def _get_token(self) -> str:
        """获取有效的 access token，失败时抛出异常。"""
        token = self.token_manager.get_access_token()
        if not token:
            raise Exception(

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

self.timeout = 30  # 默认 30 秒超时

    def _get_token(self) -> str:
        """获取有效的 access token，失败时抛出异常。"""
        token = self.token_manager.get_access_token()
        if not token:
            raise Exception(

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

self.timeout = 30  # 默认 30 秒超时

    def _get_token(self) -> str:
        """获取有效的 access token，失败时抛出异常。"""
        token = self.token_manager.get_access_token()
        if not token:
            raise Exception(

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

self.timeout = 30  # 默认 30 秒超时

    def _get_token(self) -> str:
        """获取有效的 access token，失败时抛出异常。"""
        token = self.token_manager.get_access_token()
        if not token:
            raise Exception(

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no explicit tool scope or permission boundaries while its documented behavior includes shell execution, local file reads/writes, and network-based authentication/API access. Without least-privilege constraints, unintended or expanded execution paths could expose local data, persist credentials, or make unauthorized outbound requests if the skill is misused or invoked unexpectedly.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Overly broad trigger keywords increase the chance of unintended activation in unrelated conversations, which is more concerning here because activation can lead into authentication, token handling, and external API actions. Accidental invocation of a networked enterprise-integration skill can expose sensitive workflow prompts or cause users to provide credentials when they did not intend to use this integration.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The meeting reservation endpoint performs a persistent, state-changing action, but the documentation does not warn that it creates real bookings. In an agent workflow, this increases the risk of accidental or unauthorized reservations being made from ambiguous user requests or automated execution without clear confirmation.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The work-order creation API creates a persistent service ticket, yet the reference does not clearly warn about the real-world effect of submitting the request. For an AI-driven skill, this can lead to accidental maintenance requests, record pollution, and operational disruption if the agent acts on incomplete or misinterpreted input.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documented organization-structure endpoints expand the skill's reachable capability beyond the manifest-described scope of meeting booking, work orders, and visitor queries. In an agent setting, undocumented scope expansion can enable unnecessary access to employee directory and department data, increasing privacy exposure and the chance of over-privileged use.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documented agent login flow instructs users to paste an authorization code directly into chat, which exposes a sensitive credential to the conversational platform, logs, transcript retention, and any downstream tooling that can access message history. In a chat-based skill context this is more dangerous than a normal web OAuth flow because the secret is intentionally routed through the assistant channel rather than a dedicated browser redirect or masked input path.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document specifies local JSON storage of access and refresh tokens, usernames, and tenant/user identifiers without an explicit user warning about credential persistence risks. If the file is readable by other local users, included in backups, indexed, or exfiltrated by malware, an attacker could reuse the tokens or associated metadata to access the Virsical account until expiry or refresh failure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This command reference exposes live session-affecting actions such as login, token exchange, local browser-based authentication, and logout without explicit operator warnings about side effects or confirmation requirements. In an agent skill context, documenting directly executable commands increases the chance an agent will trigger state changes on behalf of a user without sufficiently signaling that credentials, tokens, or session state will be modified.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file includes directly executable commands for booking meeting rooms and creating work orders, which are live write operations affecting real business systems. Without strong warnings, dry-run guidance, or confirmation gates, an agent could translate a casual request into unintended reservations or ticket creation, causing operational disruption, spam records, or unauthorized actions.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This markdown file contains user-facing headings, error descriptions, and remediation guidance entirely in Chinese. Under the policy rule, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function returns the generated agent authorization code directly in a user-facing message (`Agent 授权码已生成: {auth_code}`). That code is effectively a bearer-style secret for exchanging into tokens, so displaying it in normal output increases the risk of accidental disclosure through chat history, logs, screenshots, or shared terminals.

Static analysis

No suspicious patterns detected.