xinjianxue-skill-long_distance-global

• Outcome: Review
• Latest audit: Sep 14, 2026 · 3:36 PM UTC
• Version: 1.0.1

Overview

The skill is mostly transparent and purpose-aligned, but it asks the user to paste a sensitive one-time account-binding code into the AI chat and then stores persistent service credentials.

Install only if you trust XinJianXue and are comfortable sending personal birth/location details to its API, spending account tokens, and giving this AI a one-time authorization code that binds your account. Prefer a host secret-entry or official browser-based flow if available, and confirm where the persistent license_key/api_key will be stored before onboarding.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:131

Finding

Sensitive Account-Binding Credential Collected Through the Conversation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:131-146
Vulnerability Type: Sensitive credential exposure through an insecure collection channel
Risk Level: High

Vulnerable Code Snippet

markdown

### Step 2: Ask the user for the XinJianXue AI authorization code and complete the binding

**The AI must stop here and ask the user for the XinJianXue AI authorization code.** It is a one-time credential, **usable only to bind the license above to the user's account**, and for nothing else. Use this fixed wording:

> "Open the official website **www.xinjianxue.com → sign in → "Personal Center" (个人中心) → "AI Assistant Authorization Code" (AI 助手授权码)**, and send me the 8-character authorization code shown there; I need it to complete the account binding.
> Reminder: this code is a **sensitive one-time credential** that is voided the moment the binding succeeds — please confirm you are talking to the official XinJianXue AI assistant (service domain `www.xinjianxue.com`) and send it only to me, this one AI; do not post it in a group chat, do not screenshot or share it, and do not give it to any other AI."

`POST /api/xinjianxue/ai/license/bind` with body:

```json
{ "license": "XJX-AI-xxxxxxxxxxxxxxxx", "auth_code": "<the 8-character code the user sent>" }

On success it returns api_key (the business credential).

⚠️ The AI authorization code is a sensitive one-time credential (8 characters, case-sensitive); it is voided once binding succeeds, and it may only be used for this one binding.

text

### Technical Analysis

The Skill explicitly classifies the eight-character authorization code as a sensitive, one-time account-binding credential, but instructs the user to paste it into the AI conversation. This places the secret in the model context and may also expose it to conversation history, platform telemetry, application logs, debugging systems, or any other component with access to the transcript.

The warning against sharing the code 
...[truncated 1889 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace chat-based credential collection with an OAuth-style authorization-code flow, browser redirect, or device authorization flow.
2. Require the user to enter the authorization code only on the external service's authenticated HTTPS page, not into the AI conversation.
3. Return to the Agent only a short-lived, single-purpose, audience-bound confirmation token that cannot independently bind another license.
4. Bind the authorization transaction server-side to the exact pending license, user session, intended Agent instance, expiration time, and a cryptographic nonce.
5. Make authorization codes short-lived and atomically single-use, with rate limiting and replay detection.
6. Redact authorization codes from prompts, transcripts, telemetry, proxy logs, exception reports, and tracing systems.
7. If compatibility requires temporary conversational entry, use a host-provided secret-input interface that bypasses model context and persistent chat history.
8. Notify users of new bindings through an independent channel and provide a self-service method to review and revoke unauthorized bindings.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

md

- **Self-check**: Do not judge from "distance always fails" or "true love always wins" — judge the maintenance cost across trait groups

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

Call `POST /api/xinjianxue/ai/license/verify` (include credentials if you have them; body or headers are both accepted). **The only criterion is `pass`:**

- `pass: true` → **already onboarded**: use the APIs directly, and do not ask the user for any credential.
- No credentials / `pass: false` → act on the returned `msg`; **go to Step 1 only once you have confirmed "never onboarded"**. Do not blindly re-apply (re-applying produces an extra license that nobody uses).

### Step 1: Apply for the AI business license (once only)

Static analysis

No suspicious patterns detected.