T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_gold-price.py:76- Finding
API Credential Exposed in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
Gold Price - 黄金价格行情
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its stated purpose of querying TianAPI precious-metal prices, but users should handle the TianAPI API key carefully.
Install only if you are comfortable giving the skill a TianAPI API key and making HTTPS requests to TianAPI. Prefer setting TIANAPI_GOLD_KEY in your environment, avoid passing keys on the command line, do not commit scripts/.env, and rotate the key if it may have appeared in shell history, logs, or shared screenshots.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:43- Finding
Documentation Encourages Passing API Credentials on the Command Line
- Content
View full analysis
``` The implemented optional command-line credential parameter is: ```python parser.add_argument("--key", help="API Key (可选，优先使用环境变量)") ``` ### Technical Analysis The documentation directs users to include the API key directly in the command line. Command-line arguments can be retained in shell history and may be visible through process inspection, execution telemetry, terminal logging, or automation logs. This creates avoidable local exposure because the project already supports the `TIANAPI_GOLD_KEY` environment variable and a `.env` file. The documented positional invocation at `SKILL.md:43` is also inconsistent with the implemented `--key` and `--kinds` options. It would fail under the current `argparse` configuration, but users may still replace the placeholders with a real credential before discovering the mismatch. Other documentation in the file also demonstrates the implemented `--key` form, which has the same command-line disclosure risk. ### Attack Path 1. A user follows the documentation and places a real TianAPI key in the command line. 2. The shell stores the command in its history, or process-monitoring and execution-telemetry software records the argument. 3. Another local user, administrator, support operator, or party with access to collected telemetry reads the recorded command. 4. The party extracts the TianAPI key. 5. The key is reused to consume quota or access TianAPI services enabled for that credential. ### Impact Assessment The exposed privilege is limited to the permissions and quota assigned to the TianAPI key. This issue does not grant additional operating-system privileges by itself. Exposure scope d ...[truncated 149 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The documentation recommends writing the API key into scripts/.env, which creates a plaintext credential file inside the project tree. This increases the risk of accidental exposure through source control commits, backups, logs, or broader file read access by other tools in the environment.
- Content
md # 方式一：环境变量（推荐，一次配置永久生效） export TIANAPI_GOLD_KEY=你的APIKey # 方式二：.env 文件（在脚本目录创建） echo "TIANAPI_GOLD_KEY=你的APIKey" > scripts/.env # 方式三：每次命令行传入
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
Passing the API key directly on the command line can expose the secret via shell history, process listings, terminal recording, or job control logs. In multi-user or monitored environments, this is a common and avoidable credential leakage path.
- Content
md export TIANAPI_GOLD_KEY=你的APIKey # 方式二：.env 文件（在脚本目录创建） echo "TIANAPI_GOLD_KEY=你的APIKey" > scripts/.env # 方式三：每次命令行传入 python3 scripts/fetch_gold-price.py --key 你的APIKey --kinds au9999
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python Env Config: export TIANAPI_GOLD_KEY=your_api_key # 或在脚本同级目录创建 .env 文件: TIANAPI_GOLD_KEY=your_api_key """ import os
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python Env Config: export TIANAPI_GOLD_KEY=your_api_key # 或在脚本同级目录创建 .env 文件: TIANAPI_GOLD_KEY=your_api_key """ import os
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python Env Config: export TIANAPI_GOLD_KEY=your_api_key # 或在脚本同级目录创建 .env 文件: TIANAPI_GOLD_KEY=your_api_key """ import os
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python Env Config: export TIANAPI_GOLD_KEY=your_api_key # 或在脚本同级目录创建 .env 文件: TIANAPI_GOLD_KEY=your_api_key """ import os
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python if env_val: return env_val # 2. .env 文件 env_file = Path(__file__).parent / ".env" if env_file.exists(): try: content = env_file.read_text(encoding="utf-8")
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises executable behavior that uses environment variables, local files, and outbound network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. That gap can cause the agent runtime or reviewer to underestimate what the skill can access, increasing the chance of unintended secret exposure or network use when the skill is invoked.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script sends the API key as a URL query parameter in a GET request. Even though the endpoint uses HTTPS, query-string credentials are more likely to be exposed through logs, proxies, browser/history equivalents, monitoring systems, or upstream infrastructure than credentials sent in headers or POST bodies.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
L043 将脚本用法写为
python3 scripts/fetch_gold-price.py <API_KEY> <KINDS>，而前文 L031 又写成--key选项形式，后文 L079 也仅笼统描述“传入API Key和种类代码”。这属于文档层面的主动矛盾，会误导调用者对脚本真实接口的理解。- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill instructs users to send their API key and requested symbols to a third-party API but does not clearly warn that these values leave the local environment. Even though the data involved is limited, lack of disclosure can lead to unintentional sharing of credentials and query metadata with an external service.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill’s descriptive and user-facing text is written in Chinese, including usage guidance and configuration hints, with no indication that users may opt into another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content