Security audit

Coding Net

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for Tencent Coding project operations, but it asks users to paste a personal access token into chat and can modify remote project issues.

Install only if you are comfortable giving the skill authenticated access to your Tencent Coding team and projects. Prefer setting CODING_TOKEN through a secret/environment mechanism instead of pasting it into chat, use a narrowly scoped token, rotate it if exposed, and review any create-issue action before it is sent.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:14
Finding: Personal Access Token Requested Through Conversational Input
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (5)

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The skill directly instructs collection of a Coding personal access token from the user and checks for it in the environment, which is credential handling behavior with real abuse potential. In this context, the token grants authenticated access to team and project data and may enable reads and writes, so mishandling it could expose sensitive project information or allow unauthorized modifications.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
bash
python3 -c "import os; print('set' if os.environ.get('CODING_TOKEN') else 'not set')"

If neither is available, ask the user: "Please provide your Coding personal access token (Bearer Token)."

Step 2: Validate the token and confirm the team

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly performs sensitive operations involving environment-variable access and outbound API calls, but it declares no explicit tool scope or permission boundaries. Without scoped declarations, an agent runtime may permit broader-than-expected access, increasing the chance of unauthorized credential use or remote data access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill advertises the ability to create requirements and defects on the remote Coding platform but does not explicitly warn that these are state-changing operations. Users may trigger modifications to project data without clear informed consent, which can lead to accidental creation of issues or workflow disruption.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to solicit and validate a personal access token but does not warn the user that this is a sensitive secret that should be handled carefully and not echoed, logged, or stored unnecessarily. This creates a real risk of credential exposure through chat history, logs, or misuse by the agent during bootstrap.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The implementation allows create_issue(..., issue_type="MISSION") to create task issues even though the skill metadata only advertises creating requirements and defects. This creates a capability/manifest mismatch: policy, reviewers, or callers may assume the skill cannot modify task objects, but the code exposes that write path anyway, increasing the risk of unintended or unauthorized operations on Coding project data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.