T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:623- Finding
Unrestricted API base URL can redirect credentials and sensitive business data
- Content
View full analysis
- Remediation
View remediation
Security audit
Workopilot Service Builder
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent WorkoPilot integration guide, but it gives agents broad credential and configuration handling instructions that users should review before installing.
Install only if you are comfortable with an agent helping configure WorkoPilot credentials and resources. Prefer a dedicated .env.workopilot file or a secret manager, avoid command-line API keys, verify the resolved WorkoPilot host before authenticated requests, and do not let the agent modify unrelated project config files without explicit confirmation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:706- Finding
API keys can be exposed through command-line arguments
- Content
View full analysis
# API 基础 URL --api-key # API 密钥 --env-file # 自定义环境文件路径 --config # 配置 JSON 文件 ``` ### Technical Analysis Command-line arguments are not an appropriate default channel for long-lived secrets. Depending on the operating system and execution environment, arguments may be exposed through: - Shell history - Process inspection utilities - CI/CD command logs - Terminal session recording - Debugging and monitoring tools - Wrapper scripts or job metadata Although the example uses a placeholder rather than a real embedded key, users are instructed to replace it when invoking the script. This creates a foreseeable credential-disclosure path. The Skill separately recommends environment variables and secret managers, but it still presents `--api-key` as the highest-priority configuration mechanism and documents it without a warning about process and history exposure. ### Attack Path 1. A user follows the documented example and replaces `your_api_key_here` with a real API key. 2. The shell records the complete command in its history, or the process arguments are captured by a local monitoring or CI system. 3. Another local user, administrator, log reader, or CI operator accesses the recorded argument. 4. The exposed key is used to authenticate to WorkoPilot. 5. The attacker's access is bounded by the permissions and lifetime of the compromised key. ### Impact Assessment Exploitation may compromise ...[truncated 266 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger description is extremely broad, including short generic phrases like '创建 AI 服务', '测试接口', and '对接流程', plus an instruction to trigger even on brief mentions. That can cause the skill to activate during unrelated development conversations, leading the agent to prematurely steer users into WorkoPilot-specific workflows, including credential setup and configuration actions they did not intend.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### 4. 调用脚本创建 运行对应的 Python 脚本。脚本会: - 自动从环境变量或 .env 文件读取鉴权配置 - **自动查询可用模型并根据场景智能选择** - 检查资源是否已存在(根据 code 查询) - 如果存在则复用,不存在则创建
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
该技能的名称、描述与全文指令均以中文表述，并围绕中文模型优先级和中文文档场景展开，但没有说明应根据用户偏好切换输出语言。对于多语言用户环境，这会形成默认强制中文响应的策略倾向，缺少语言选择或 opt-in 机制。
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly tells the agent to inspect current-project configuration locations such as .env, appsettings.json, and generic config files and place API keys there. That expands credential handling beyond the dedicated WorkoPilot env file and can cause the agent to read or modify unrelated application configs, increasing the chance of secret exposure, accidental overwrites, or cross-system credential misuse.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction to search the project for existing config files and place API keys there semantically directs the agent to discover and handle sensitive credentials in arbitrary local files. In an agent setting, this is dangerous because it broadens access to secrets beyond the minimum needed, can lead to reading unrelated confidential data, and normalizes modifying high-risk files without tight scope control.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
L706-L710 shows an example using
--api-key your_api_key_here, while L771-L773 emphasizes avoiding unsafe API key handling and recommends safer storage practices. Command-line secrets are often exposed through shell history and process inspection, so the guidance conflicts with the stated security intent of protecting API keys.- Content