Security audit

CCP Local Proxy

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed local reverse proxy for CCP model access, with credential and daemon behavior that users should understand before use.

Install only if you intend to route WorkBuddy qwen-3.5 traffic through China Mobile CCP. Be aware that your API key is stored persistently in ~/.workbuddy/models.json and the proxy daemon remains running until stopped; protect or remove that key if you no longer use the skill.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill clearly directs execution of shell commands, local file writes, and network proxy behavior, yet no permissions are declared. This creates a transparency and consent problem: an agent may start a persistent daemon, modify user configuration, and forward authenticated traffic without an explicit permission boundary, increasing the chance of unintended or unauthorized actions.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a local proxy manager, but it also modifies the user's model configuration and inserts API credentials into ~/.workbuddy/models.json. This expands its authority beyond simple proxy control and can silently redirect future model traffic through the local proxy while persisting secrets on disk.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The code reads API keys from ~/.workbuddy/models.json and later supports persisting them there, creating credential exposure through local plaintext storage and unintended reuse. For a proxy-management skill, secret handling in a general user config file is more privilege than necessary and increases the blast radius if the account or filesystem is compromised.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs storing a user API key in ~/.workbuddy/models.json but does not warn that this is persistent plaintext credential storage or explain who/what can later read that file. Because the skill also configures a long-running local proxy that forwards Authorization headers, compromise of local config or logs could expose reusable credentials.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: This code writes the supplied API key directly into ~/.workbuddy/models.json without warning the user that credentials will be persisted in plaintext. That can expose secrets to other local processes, backups, shell users, or later accidental disclosure through logs or file sharing.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The proxy forwards Authorization headers and full request bodies from localhost clients to the external upstream service, which means prompts, outputs, and bearer tokens leave the local machine. While forwarding is expected for a proxy, the lack of explicit disclosure and the broad CORS/open proxy behavior on localhost make the data transmission more security-sensitive in this skill context.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.