Smart Agent Template

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:16 AM UTC
• Version: 1.1.0

Overview

This skill is partly a workflow template, but it also ships bot integrations and startup behavior with unsafe defaults that users should review before installing.

Install only after reviewing and disabling the default auto-update, removing TLS-verification bypasses and SDK rewriting, requiring authenticated webhook/bot access, sanitizing IDs before filesystem use, and clearing bundled runtime history. Treat this as a Review item rather than a routine workflow-template skill.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (9)

T03 · Remote Payload Retrieval and Execution

Error

• Location: docs/OLLAMA_SETUP.md:16
• Finding: Unverified Remote Installer Is Piped Directly to a Shell<![CDATA[ ## Vulnerability Details **File Location**: `docs/OLLAMA_SETUP.md:16-18` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash **Linux:** ```bash curl -fsSL https://ollama.com/install.sh | sh ``` ``` ### Technical Analysis The installation instructions download mutable content from a remote URL and pass it directly to `sh`. The downloaded script is neither pinned to a version nor verified using a cryptographic signature or checksum. Although the URL belongs to Ollama's official domain, direct execution still creates a remote code execution channel. The effective payload may change after this Skill has been reviewed. Compromise of the hosting service, release infrastructure, DNS resolution, or TLS trust chain could cause arbitrary commands to run with the privileges of the user following the instructions. ### Attack Path 1. A user follows the Linux installation instructions. 2. The shell establishes a connection to `ollama.com` and downloads the current `install.sh`. 3. The downloaded bytes are immediately interpreted by `sh`; there is no opportunity for inspection or integrity verification. 4. If the remote script or delivery channel has been compromised, attacker-supplied commands execute locally. 5. Those commands obtain all filesystem, process, and network privileges available to the invoking user. If the command is run through `sudo` or as root, system-wide compromise is possible. ### Impact Assessment Successful exploitation can result in arbitrary command execution, installation of persistent services, credential theft, modification of Agent files, and compromise of all data accessible to the invoking account. The scope depends on the privileges used to run the installation command. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the pipeline with a versioned package or release artifact. 2. Download the artifact to a local file before executing it. 3. Verify a publisher-provided cryptographic signature or pinned SHA-256 checksum. 4. Display the artifact version and source to the user and require explicit approval before installation. 5. Prefer the operating system's trusted package manager where an official package is available. 6. Document that installation should occur as an unprivileged user unless a specific step requires elevation. ]]>

T07 · Tool Hijacking and Spoofing

Error

• Location: integrations/feishu/start_longconn.sh:21
• Finding: Feishu Launcher Rewrites an Installed SDK and Disables TLS Verification<![CDATA[ ## Vulnerability Details **File Location**: `integrations/feishu/start_longconn.sh:21-48`; `integrations/feishu/bot_longconn.py:8-17` **Vulnerability Type**: Local tool hijacking and global TLS certificate validation bypass **Risk Level**: Critical ### Vulnerable Code ```bash # Fix the SSL verification problem in the lark-oapi SDK SDK_FILE=$(python3 -c "import lark_oapi.ws.client, inspect; print(inspect.getfile(lark_oapi.ws.client))") if grep -q "ssl=ssl._create_unverified_context()" "$SDK_FILE"; then echo "✅ SDK 已修复 SSL" else echo "🔧 修复 SDK SSL 验证..." # Backup cp "$SDK_FILE" "${SDK_FILE}.bak" 2>/dev/null || true # Modify line 152 python3 <<EOF import re with open('$SDK_FILE', 'r') as f: content = f.read() # Add ssl import at the beginning of the file if absent if 'import ssl' not in content[:500]: content = 'import ssl\n' + content # Modify websockets.connect invocation content = re.sub( r'conn = await websockets\.connect\(conn_url\)', 'conn = await websockets.connect(conn_url, ssl=ssl._create_unverified_context())', content ) with open('$SDK_FILE', 'w') as f: f.write(content) print('✅ SDK 已修复') EOF fi ``` ```python import os # Disable SSL certificate verification os.environ['PYTHONHTTPSVERIFY'] = '0' os.environ['CURL_CA_BUNDLE'] = '' os.environ['REQUESTS_CA_BUNDLE'] = '' import logging import sys import json import asyncio import ssl ssl._create_default_https_context = ssl._create_unverified_context ``` ### Technical Analysis The launcher locates the installed `lark-oapi` SDK and modifies its source in place. It changes `websockets.connect()` to use an unverified TLS context, affecting the legitimate SDK outside the project directory and potentially every application using that installation. The bot then disables certificate verification through three environment variables and replaces Python's default HTTPS context globally. These changes remove server-authentication guarantees for Feishu aut ...[truncated 1171 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all uses of `ssl._create_unverified_context`. 2. Remove the `PYTHONHTTPSVERIFY`, `CURL_CA_BUNDLE`, and `REQUESTS_CA_BUNDLE` overrides. 3. Never modify installed SDK files at application startup. 4. Reinstall `lark-oapi` to restore any SDK installation already modified by this launcher. 5. Install the correct proxy or enterprise CA certificate into a dedicated trust bundle. 6. Pass that trusted CA bundle only to the specific client requiring it. 7. Fail closed when certificate validation fails and provide diagnostic instructions rather than bypassing validation. 8. Pin and test a supported SDK version in an isolated virtual environment. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/auto_update.sh:42
• Finding: Default Startup Workflow Pulls Unreviewed Code from a Mutable Branch<![CDATA[ ## Vulnerability Details **File Location**: `AGENTS.md:3-9`; `config/auto_update.yaml:1-8`; `scripts/auto_update.sh:42-70` **Vulnerability Type**: Unattended remote update and supply-chain execution channel **Risk Level**: High ### Vulnerable Code ```markdown ## 一、启动流程 1. 读取 `IDENTITY.md` 2. **执行自动更新检查**（`scripts/auto_update.sh`，默认开启） 3. 读取 `memory/hot.md`（HOT 层，≤100行） 4. 如果项目名匹配，读取 `memory/projects/[项目名].md` 5. 应用所有规则 ``` ```yaml # Agent automatic update configuration # Enabled by default and checked at every startup enabled: true check_on_startup: true remote: origin branch: main silent: false ``` ```bash # Silently fetch remote updates git fetch "$REMOTE" "$BRANCH" 2>/dev/null || { [ "$SILENT" != "true" ] && echo "⚠️ 无法连接远程仓库" exit 0 } REMOTE_COMMIT=$(git rev-parse "$REMOTE/$BRANCH") if [ "$LOCAL_COMMIT" = "$REMOTE_COMMIT" ]; then [ "$SILENT" != "true" ] && echo "✅ 已是最新版本" exit 0 fi git pull "$REMOTE" "$BRANCH" || { echo "❌ 更新失败，请手动处理" exit 1 } TIMESTAMP=$(date "+%Y-%m-%d %H:%M:%S") UPDATE_LOG="- [$TIMESTAMP] 自动更新: $LOCAL_COMMIT -> $REMOTE_COMMIT" if [ -f "$MEMORY_FILE" ]; then echo "$UPDATE_LOG" >> "$MEMORY_FILE" fi ``` ### Technical Analysis The mandatory startup procedure invokes an updater that is enabled by default and pulls from the mutable `main` branch. The update is applied without checking a signed commit, pinned release, expected hash, reviewed diff, or user approval. Because the repository contains executable scripts and Agent instruction files, changing the remote branch can alter both locally executed code and the behavioral rules loaded by the Agent. The effective payload can therefore change after the Skill package has passed review. ### Attack Path 1. An attacker compromises the remote repository, maintainer account, CI release process, or configured Git remote. 2. The attacker pushes modified scripts or Agent instructions to `main`. 3. On startup, the workflow executes `scripts/auto_up ...[truncated 508 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set `enabled: false` and `check_on_startup: false` by default. 2. Fetch updates without merging or activating them. 3. Update only to a pinned, signed release or an explicitly approved commit hash. 4. Verify Git commit or release signatures against a maintained publisher key. 5. Show the complete diff and require explicit operator approval before activation. 6. Separate executable updates from memory and instruction updates. 7. Add rollback and post-update integrity checks. 8. Do not run an updater before loading the local security policy. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: integrations/feishu/bot.py:47
• Finding: Feishu Public Webhook Accepts Unauthenticated Message Events<![CDATA[ ## Vulnerability Details **File Location**: `integrations/feishu/bot.py:47-73,93-110,229`; `integrations/feishu/config.py:53-58` **Vulnerability Type**: Missing authentication on a network-accessible webhook **Risk Level**: High ### Vulnerable Code ```python def verify_feishu_signature(timestamp: str, nonce: str, encrypt_key: str, body: str, signature: str) -> bool: """验证飞书请求签名""" if not encrypt_key: return True # 未配置加密则跳过验证 content = timestamp + nonce + encrypt_key + body sig = hashlib.sha256(content.encode()).hexdigest() return sig == signature ``` ```python # Verify signature timestamp = self.headers.get('X-Lark-Request-Timestamp', '') nonce = self.headers.get('X-Lark-Request-Nonce', '') signature = self.headers.get('X-Lark-Signature', '') if config.feishu.encrypt_key: if not verify_feishu_signature( timestamp, nonce, config.feishu.encrypt_key, body, signature ): self._send_response(401, {"error": "Invalid signature"}) return event_data = json.loads(body) # The token is checked only during URL verification if event_data.get('type') == 'url_verification': challenge = event_data.get('challenge', '') token = event_data.get('token', '') if token != config.feishu.verification_token: self._send_response(401, {"error": "Invalid token"}) return ``` ```python server = HTTPServer(('0.0.0.0', config.feishu.port), FeishuWebhookHandler) ``` ```python # VERIFICATION_TOKEN is optional # if not self.feishu.verification_token: # raise ValueError("FEISHU_VERIFICATION_TOKEN is required") ``` ### Technical Analysis The HTTP server listens on all interfaces. For normal message events, authentication is performed only if `FEISHU_ENCRYPT_KEY` happens to be configured. Configuration validation does not require the verification token or encryption key, and the token is checked only for the initial URL-verification event. Consequently, a deployment that follows the all ...[truncated 1077 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require authenticated request verification in every production configuration. 2. Reject all message events if the required signature headers or verification secrets are absent. 3. Verify timestamps within a narrow acceptance window and maintain a nonce cache to prevent replay. 4. Use constant-time signature comparison such as `hmac.compare_digest`. 5. Bind to a private interface and place the service behind an HTTPS reverse proxy with strict access controls. 6. Enforce request body size limits and rate limits before JSON parsing or AI invocation. 7. Validate that event fields and chat identifiers match expected Feishu formats. 8. Separate an explicitly enabled local test mode from production behavior. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: integrations/memory_manager.py:75
• Finding: Externally Supplied User IDs Are Used Directly in Filesystem Paths<![CDATA[ ## Vulnerability Details **File Location**: `integrations/memory_manager.py:75-89,120-157,276-281`; `integrations/task_tracker.py:104-119`; source at `integrations/feishu/handlers.py:55-61` **Vulnerability Type**: Path traversal through unsanitized identifiers **Risk Level**: High ### Vulnerable Code ```python sender = event_data.get('event', {}).get('sender', {}) user_id = sender.get('sender_id', {}).get('open_id', 'unknown') ``` ```python def load_history(self, user_id: str) -> list: path = os.path.join(self.storage_dir, f"{user_id}_history.json") if os.path.exists(path): with open(path, 'r', encoding='utf-8') as f: return json.load(f) return [] def save_history(self, user_id: str, history: list): max_msgs = SHORT_TERM_ROUNDS * 2 if len(history) > max_msgs: history = history[-max_msgs:] path = os.path.join(self.storage_dir, f"{user_id}_history.json") with open(path, 'w', encoding='utf-8') as f: json.dump(history, f, ensure_ascii=False, indent=2) ``` ```python def _load_memory_file(self, user_id: str) -> str: path = os.path.join(self.storage_dir, f"{user_id}_memory.md") if os.path.exists(path): with open(path, 'r', encoding='utf-8') as f: return f.read() return "" def save_memory(self, user_id: str, content: str): path = os.path.join(self.storage_dir, f"{user_id}_memory.md") with open(path, 'w', encoding='utf-8') as f: f.write(content) ``` ```python def _load_tasks(self, user_id: str) -> Dict: path = os.path.join(self.storage_dir, f"{user_id}_tasks.json") if os.path.exists(path): with open(path, 'r', encoding='utf-8') as f: return json.load(f) return {} def _save_tasks(self, user_id: str, tasks: Dict): path = os.path.join(self.storage_dir, f"{user_id}_tasks.json") with open(path, 'w', encoding='utf-8') as f: json.dump(tasks, f, ensure_ascii=False, indent=2) ``` ### Technical Analysis ...[truncated 1609 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate platform identifiers against the exact documented Feishu and Telegram formats. 2. Derive local filenames from a cryptographic hash of the validated platform identifier. 3. Resolve every candidate path and verify that it remains under the resolved storage root. 4. Reject identifiers containing separators, traversal components, control characters, or unexpected lengths. 5. Apply the same validation to memory, history, statistics, tasks, and deletion operations. 6. Run the bot under a dedicated account with write access only to its data directory. 7. Add tests for absolute paths, `../`, encoded separators, Unicode separators, and symlink-based escape attempts. ]]>

T02 · Agent Memory Poisoning

Error

• Location: integrations/memory_manager.py:173
• Finding: User-Controlled Instructions Can Be Persisted and Reintroduced as Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `AGENTS.md:300-303`; `integrations/memory_manager.py:173-216,223-234` **Vulnerability Type**: Persistent prompt injection through long-term memory **Risk Level**: High ### Vulnerable Code ```markdown ## 六、学习流程 | 用户说 | 立即执行 | |--------|---------| | "不对" / "错了" / "应该是" | 记录到 logs/YYYY/MM/DD.md | | "记得" / "总是" / "永远" | 记录到 memory/hot.md | | "我喜欢" / "我不喜欢" | 记录到 memory/hot.md | ``` ```python existing_memory = self.load_memory(user_id) history_text = "\n".join([ f"{m['role']}: {m['content']}" for m in history ]) compress_prompt = f"""请从以下对话中提炼重要信息，更新用户记忆。 【现有记忆】 {existing_memory if existing_memory else "（空）"} 【新对话内容】 {history_text} 请输出更新后的记忆，格式如下（控制在500字以内）： ## 个人信息 （用户的基本信息、偏好） ## 项目/任务 （正在进行的项目和任务） ## 重要决策 （已做出的重要决定） ## 注意事项 （需要记住的特殊要求） 只保留真正重要的信息，过程细节不需要记录。""" response = self.ai_client.messages.create( model=self.ai_model, max_tokens=800, messages=[{"role": "user", "content": compress_prompt}] ) new_memory = response.content[0].text self.save_memory(user_id, new_memory) ``` ```python def build_system_prompt(self, user_id: str, base_prompt: str = "") -> str: memory = self.load_memory(user_id) parts = [base_prompt or "你是一个智能助手，回答简洁友好。"] if memory: parts.append(f"\n【用户记忆】\n{memory}") parts.append("\n请根据用户记忆和对话历史，准确理解上下文并回复.") return "\n".join(parts) ``` ### Technical Analysis The workflow explicitly instructs the Agent to persist statements containing trigger phrases such as “remember,” “always,” and “forever.” Separately, conversation history is summarized by an AI model and the generated result is saved as long-term memory. Stored memory is subsequently concatenated into the system prompt without being represented as structured, untrusted data. There is no policy that distinguishes factual preferences from executable instructions, no confirmation workflow, and no filtering of prompt-control language. This permits a user or unauthenticated web ...[truncated 980 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store only typed, structured facts such as approved preferences and project metadata. 2. Reject or quarantine memory containing commands, policy overrides, role changes, or tool instructions. 3. Treat all recalled memory as untrusted data and state explicitly that it must not override system or developer instructions. 4. Require explicit user confirmation before creating or modifying long-term memory. 5. Record provenance, creator identity, timestamp, and confidence for every memory item. 6. Provide review, edit, expiration, and deletion controls. 7. Use a deterministic sanitizer rather than relying solely on another model to summarize hostile content. 8. Keep global Agent policy memory separate from per-user conversational memory. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: integrations/feishu/data/memory/ou_13bb618d4267d6f3b15db89f6cc12d1b_history.json:1
• Finding: Runtime Feishu Identifier and Conversation Transcript Are Included in the Package<![CDATA[ ## Vulnerability Details **File Location**: `integrations/feishu/data/memory/ou_13bb618d4267d6f3b15db89f6cc12d1b_history.json:1-42` **Vulnerability Type**: Committed user data and conversation history **Risk Level**: Medium ### Vulnerable Code ```json [ { "role": "user", "content": "你是谁" }, { "role": "assistant", "content": "我是一个智能助手，旨在为您提供信息、解答问题和协助解决各种任务。很高兴为您服务！有什么我可以帮助您的吗？" }, { "role": "user", "content": "你是 glm5 吗" }, { "role": "assistant", "content": "我是由Z.ai训练的GLM大语言模型，能够理解和生成自然语言文本，帮助您解决问题和提供信息。\n\n我的训练包含了大量文本数据，让我能够回答问题、参与对话和提供各种信息支持。不过请注意，我的知识可能有一定局限性，不能完全替代专业建议。\n\n有什么我可以帮您解答的问题或提供帮助的方向吗？" }, { "role": "user", "content": "哈喽" }, { "role": "assistant", "content": "哈喽！你好呀！很高兴见到你。我是你的智能助手，有什么我可以帮你的吗？😊" }, { "role": "user", "content": "哈喽" }, { "role": "assistant", "content": "哈喽！你好呀！我是你的智能助手。有什么我可以帮你的吗？😊" }, { "role": "user", "content": "哈喽，你是谁" }, { "role": "assistant", "content": "哈喽！我是一个智能助手，由人工智能驱动，致力于为你提供知识解答和实用建议。你可以叫我“智能助手”，随时告诉我你的问题或需求，我们一起解决！" } ] ``` ### Technical Analysis The project includes a runtime history file whose filename contains a Feishu-style open user identifier and whose contents include a retained conversation transcript. This data is distributed to every user who receives the Skill package and may also remain available through repository history. Even though the transcript shown is not highly sensitive, committing operational user records establishes an unsafe data-handling practice and exposes an identifier associated with the conversation. ### Attack Path 1. A user downloads or clones the Skill. 2. The bundled history file is available without authentication. 3. The recipient reads the platform identifier from the filename and the conversation from the JSON content. 4. If the repository is public, search engines, mirrors, forks, and historical commits can preserve the data after deletion ...[truncated 270 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the runtime history file from the distributed package. 2. Purge the file from repository history where feasible. 3. Add `integrations/feishu/data/memory/`, `data/memory/`, and `data/tasks/` to ignore rules. 4. Include only synthetic fixtures with unmistakably fictional identifiers. 5. Encrypt production conversation data at rest and define retention and deletion periods. 6. Add automated secret and personal-data scanning to the release process. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: integrations/telegram/bot.py:36
• Finding: Telegram Bot Token Prefix Is Written to Process Logs<![CDATA[ ## Vulnerability Details **File Location**: `integrations/telegram/bot.py:36-40` **Vulnerability Type**: Partial credential disclosure through logging **Risk Level**: Medium ### Vulnerable Code ```python try: config.validate() print(f"✅ 配置验证通过") print(f"📱 Bot Token: {config.telegram.bot_token[:20]}...") print(f"👤 Admin Chat ID: {config.telegram.admin_chat_id}") print(f"🤖 AI Engine: {config.ai.engine}") ``` ### Technical Analysis The application prints the first 20 characters of the Telegram bot token during startup. Startup output commonly enters terminal history, container logs, systemd journals, cloud logging services, and support bundles. A token fragment is secret material and is not required to diagnose whether configuration succeeded. Partial disclosure can help correlate credentials, identify bot ownership, or reduce the unknown portion of a credential obtained from another source. ### Attack Path 1. The Telegram bot starts. 2. The token prefix is emitted to standard output. 3. A user, service, or log collector with access to process logs records the value. 4. An attacker with log access obtains the token fragment and combines it with other leaked material or uses it for credential correlation. ### Impact Assessment This finding does not expose the complete token by itself, but it unnecessarily discloses credential material to every log reader. If combined with another partial leak, it can contribute to bot-account takeover. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all token substrings from startup output. 2. Log only a boolean configuration state, such as `Telegram token configured`. 3. Restrict access to existing logs and rotate the token if logs have been broadly exposed. 4. Apply centralized secret-redaction filters to application and infrastructure logging. 5. Add tests that reject log output matching known credential patterns. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: integrations/telegram/bot.py:38
• Finding: Configured Telegram Administrator Boundary Is Not Enforced<![CDATA[ ## Vulnerability Details **File Location**: `integrations/telegram/bot.py:38-85`; representative user handling at `integrations/telegram/handlers.py:47-70,152-222` **Vulnerability Type**: Missing authorization for bot commands and message handlers **Risk Level**: Medium ### Vulnerable Code ```python print(f"👤 Admin Chat ID: {config.telegram.admin_chat_id}") ``` ```python # Register command handlers application.add_handler(CommandHandler("start", handlers.start_command)) application.add_handler(CommandHandler("help", handlers.help_command)) application.add_handler(CommandHandler("status", handlers.status_command)) application.add_handler(CommandHandler("memory", handlers.memory_command)) application.add_handler(CommandHandler("tasks", handlers.tasks_command)) # Register message handlers application.add_handler( MessageHandler(filters.TEXT & ~filters.COMMAND, handlers.handle_text_message) ) application.add_handler(MessageHandler(filters.PHOTO, handlers.handle_photo)) application.add_handler(MessageHandler(filters.Document.ALL, handlers.handle_document)) application.add_error_handler(handlers.error_handler) application.run_polling(allowed_updates=Update.ALL_TYPES) ``` The handler audit found user IDs derived from `update.effective_user.id`, but no check against `config.telegram.admin_chat_id` or another allowlist before processing. ### Technical Analysis The application requires and prints an administrator chat ID, implying that access is intended to be restricted. However, all commands and message types are registered globally. No central authorization filter or per-handler check enforces the configured administrator identity. Any Telegram user who can discover or contact the bot can therefore invoke its AI, memory, and task-management features. ### Attack Path 1. An unauthorized Telegram user discovers the bot username. 2. The user sends a command, text message, photo, or document. 3. A globally registered handler receives the update. ...[truncated 545 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add a central authorization filter applied before every command and message handler. 2. Compare both the effective user ID and chat ID against an explicit allowlist. 3. Reject unauthorized updates before file access or AI invocation. 4. Support multiple authorized identities through a validated configuration list if required. 5. Rate-limit rejected and accepted users independently. 6. Avoid printing administrator identifiers unless operationally necessary. 7. Add automated tests proving that unauthorized users cannot invoke text, command, photo, or document handlers. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (195)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The declared description presents a broad workflow template with features like triple-judgment logic, automatic updates, WBS/task decomposition, exemption thresholds, and memory-management best practices. The supplied code chunk does something narrower and materially different: it analyzes stored conversation history to compute a health score, derives a strategy from that score, and adjusts context/system prompt behavior. While 'Context 优化' loosely overlaps with applying a strategy to context, the main implemented functionality is conversation-quality monitoring and adaptive prompt/context tuning, not the described workflow-template features. No dangerous extra permissions are evident, but the primary purpose is mismatched.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a workflow/template artifact about agent operating norms and optimization practices. In contrast, the supplied code is specifically an operational Feishu bot integration: it opens a network listener, verifies Feishu webhook signatures/tokens, handles chat message events, creates an AI adapter, and sends outbound messages through Feishu APIs. This is a materially different primary purpose and includes undeclared external network/chat integration capabilities. While the description mentions memory management and smart-agent context, this code chunk itself is not implementing the described workflow best-practice template; it is implementing messaging infrastructure for Feishu.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents this as a workflow/template for Smart Agent best practices (decision logic, WBS/task规范, context optimization, memory management). However, the supplied code is not a generic workflow template; it is concrete integration code for a Feishu bot runtime. Its primary purpose is to run a messaging bot over Feishu long connections, process incoming IM events, invoke an AI backend, persist chat memory, and send replies. While memory and task parsing are related to the declared agent concepts, the dominant behavior—external bot integration, event handling, token retrieval, and message delivery—is undeclared and materially different from the stated template-oriented purpose. The SSL-verification disabling is also an undeclared security-relevant behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description presents a high-level smart-agent workflow template with decision mechanisms, execution规范, WBS/task decomposition, memory management, and context optimization. However, the supplied code chunk does not implement any workflow logic, decision framework, auto-update behavior, context optimization, or memory features. Instead, it is a configuration module for Feishu bot credentials and AI engine settings. This is a materially different primary purpose, so the description does not accurately represent the code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents a generic smart-agent workflow template focused on process design and best practices such as triple-decision logic, automatic updates, context optimization, WBS/task execution rules, thresholds, and memory management. The supplied code instead is specifically an operational Feishu integration handler: it receives Feishu events, extracts sender/message data, handles commands, invokes an AI adapter for responses, persists chat memory, tracks tasks, and reports status. While memory management and task-related behavior partially align with the template theme, the primary purpose is materially different and significantly more specific: a live chat bot integration for Feishu. This is an undeclared capability and trigger surface compared with the description, so it should be flagged as a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a generic workflow/template skill for agent execution logic and best practices, but the actual code chunk is specifically an operational launcher for a Feishu integration. Its primary purpose is to initialize configuration and start a Feishu bot, which is materially different from the described workflow-template functionality. This is not just a supporting implementation detail of the declared purpose; it introduces a concrete external integration and process-launching behavior not reflected in the description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a workflow/process template for smart-agent task management and execution best practices. The supplied code does not implement workflow logic, WBS decomposition, memory management, context optimization, or auto-update mechanisms. Instead, it is an integration startup script whose main purpose is to patch the websockets library so SSL certificate verification is disabled, then start a Feishu bot. Disabling SSL verification is a significant operational/security-affecting capability that is not reflected in the description. Therefore, the code’s actual behavior is materially different from the declared purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents a workflow/process template for a smart agent, with planning and context-management best practices. The supplied code instead performs operational integration tasks for a Feishu bot: validating environment variables, reading credentials, patching the lark-oapi SDK, weakening SSL verification, and launching bot_longconn.py. These are materially different from the declared purpose and introduce undeclared capabilities involving external integration, local configuration access, code modification, and network-security behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The description presents a comprehensive workflow template covering decision mechanisms, automatic updates, context optimization, task execution standards, WBS splitting, exemption thresholds, and memory management. However, this code chunk only implements the memory-management portion: local history/memory file storage, periodic AI-based summarization, optional OpenClaw-backed semantic search, prompt assembly, and conversation processing. While '自动更新' and 'Context 优化' are partially consistent with the summarization and prompt-building behavior, the broader declared functionality is not represented in this code. Additionally, the module can call an external executable via subprocess for memory search, which is a meaningful capability absent from the declaration. Therefore the description does not accurately represent what this specific code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The declared description presents a comprehensive smart-agent workflow template with multiple advanced governance/workflow features. However, the supplied code is narrowly focused on message parsing and response-quality checking. It does not implement automatic updating, memory management, WBS decomposition, exemption thresholds, or a distinct three-stage decision mechanism. While there is some limited context handling and prompt optimization, the primary behavior is materially different and substantially narrower than the declared purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents this skill as a workflow/template and best-practice framework for agent execution, decision mechanisms, context optimization, WBS, and memory management. The supplied code instead implements a concrete task-tracking integration with filesystem persistence and task CRUD behavior. Its primary purpose is materially different: it manages numbered tasks and stores them in local JSON files, which is not described in the declared purpose. This is more than a supporting detail; it is the core behavior of the code. No evidence in the code supports the advertised triple-judgment mechanism, automatic update workflow logic, context optimization, WBS decomposition, exemption thresholds, or memory management.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description presents a workflow/process template with decision mechanisms, auto-update behavior, WBS/task-planning guidance, exemption thresholds, and memory-management best practices. The supplied code does not implement that workflow logic. Instead, it is an integration layer for AI engines: it constructs message payloads from recent chat history and memory, builds system prompts, and calls OpenAI/Anthropic/DeepSeek/Ollama APIs or compatible endpoints. While there is a loose connection to 'context optimization' and memory usage, the primary purpose is materially different and includes undeclared network/model-integration capabilities. Therefore the description does not accurately represent the code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The declared description presents this as a workflow/template specification emphasizing internal agent-process best practices such as triage logic, auto-update behavior, context optimization, WBS/task management, and memory strategy. The supplied code chunk instead implements a concrete Telegram integration: it starts a bot, validates Telegram-related environment configuration, creates an AI backend adapter, registers command and content handlers, and listens for incoming Telegram updates. This is a materially different primary purpose and introduces undeclared external communication capabilities and triggers through Telegram. While memory/task commands may loosely relate to the template theme, the main behavior of this code is bot operation rather than workflow-template logic.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The description presents a generic Smart Agent workflow/template focused on internal decision mechanisms, auto-update behavior, context optimization, WBS/task-execution norms, and memory best practices. The supplied code is specifically a Telegram integration layer that receives platform messages, exposes bot commands, sends replies, tracks per-user tasks, reports system/memory status, and handles media/file events. While some described themes partially overlap with the code (context optimization, memory management, task parsing), the primary purpose and major capabilities are materially different: this chunk is a Telegram bot handler implementation, not just a workflow template. The declared triggers are empty, but the code clearly reacts to Telegram commands and incoming messages. Therefore the description does not accurately represent what this code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a workflow/agent template for task management and context optimization, but the supplied code is a simple log archival shell script. Its primary purpose is filesystem maintenance: locating old .md files under a logs directory and moving them into an archive folder. This is materially different from the declared smart-agent workflow functionality and introduces undeclared file-management behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared description presents this skill as a general workflow/template for agent execution practices and memory management best practices. However, the supplied code is a concrete filesystem maintenance script focused narrowly on compressing a specific markdown memory file when it exceeds 100 lines. It performs backup, filtering, and in-place edits to hot.md, which is much more specific operational behavior than the description suggests. While 'memory management' is mentioned in the description, the code's primary purpose is file cleanup/compression rather than implementing the broader workflow, decision mechanism, WBS, or context optimization claims. Therefore the code chunk does not accurately represent the declared purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a workflow/template for agent behavior and process best practices, but the code is a concrete reporting utility that processes local metrics data and writes a weekly performance report. Its primary purpose is materially different from the declared workflow/template description. Although the code does not request dangerous permissions, it does access local log and report files and performs reporting/analytics capabilities that are not reflected in the description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The description promises a broad smart-agent workflow template with decision logic, automatic updating, context optimization, and best-practice execution features. However, this code chunk only implements a repository/template health check: it inspects specific files/directories and enforces a size threshold for memory/hot.md. That is materially different from the declared primary purpose. While health checks could be a supporting utility within such a template, the supplied chunk itself does not exhibit the described workflow, update, or task-management capabilities, so the description does not accurately represent what this code actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的是一个面向智能体流程设计的工作流模板与方法论集合，而提供的代码片段只实现了本地性能指标记录功能。两者主目的明显不同：声明强调流程机制、自动更新、上下文优化和记忆管理最佳实践；代码则只是把传入的运行数据写入日志文件。该日志记录能力并未在声明中体现，且代码没有展现声明中提到的三重判断、WBS 拆分、流程阈值或自动更新等核心行为。因此这是明显的描述与实际行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a high-level agent workflow/process template, not a file-manipulation utility. The actual code’s primary purpose is safe file writing with locking semantics. That is a materially different behavior from workflow orchestration, context optimization, WBS/task-planning, or memory-management guidance. No triggers or permissions are declared, yet the code performs direct file system modification, which is an undeclared capability. This is therefore a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a workflow/template for smart-agent task orchestration and best practices, but the provided code is a simple log-search utility. Its primary purpose is materially different: it performs recursive grep operations over a specific logs directory rather than implementing workflow logic, auto-update behavior, context optimization, WBS decomposition, or memory management. No triggers or permissions are declared, yet the code accesses filesystem log data. This is a clear description-behavior mismatch.

External Script Fetching

High

• Category: Supply Chain

Content

**Linux:**
```bash
curl -fsSL https://ollama.com/install.sh | sh
```

**Windows:**

• Confidence: 98% confidence
• Finding: The documentation instructs users to download and immediately execute a remote shell script via `curl ... | sh`, which bypasses inspection, integrity verification, and provenance checks. If the remote host, CDN path, or connection is compromised, users could execute arbitrary code on their systems with the privileges of the shell session.

Chaining Abuse

High

• Category: Tool Misuse

Content

**Linux:**
```bash
curl -fsSL https://ollama.com/install.sh | sh
```

**Windows:**

• Confidence: 97% confidence
• Finding: The `| sh` construct chains remote content retrieval directly into shell execution, eliminating the user's chance to review or validate what will run. In a setup guide, this is particularly dangerous because readers tend to copy-paste installation commands, amplifying the chance of arbitrary code execution if the upstream script is modified or intercepted.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# 清理缓存重试
rm -rf ~/.ollama/models
ollama pull llama2
```

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# 清理缓存重试
rm -rf ~/.ollama/models
ollama pull llama2
```

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: integrations/feishu/bot_longconn.py:166

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: integrations/feishu/bot.py:148

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: integrations/telegram/bot.py:55

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: process-standards/core/SECURITY_CHECK.md:55

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: integrations/feishu/start_bot.py:19

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: integrations/feishu/start_longconn.sh:24