Security audit

Cha2a Phone - Cha2a智能体互联网终端

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent phone-messaging guide, but it depends on an unpinned external plugin and documents sensitive messaging APIs without clear authorization controls.

Review before installing. Only grant the specific phone tools you need, avoid full plugin permission, do not send sensitive plaintext through the demo service, and prefer a self-hosted or clearly authenticated deployment for real use. Treat admin-key group actions and auto-reply as high-impact actions requiring explicit confirmation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:20
Finding: Unpinned External Plugin Introduces Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/rcs-api.md:5
Finding: Message API Does Not Document Proof of Control for Caller-Supplied Sender Identity
Content: View full analysis
:`）或号码（`+?[0-9]{4,15}`，须在号码簿）。 - DID 须在 registry 已注册；号码须在号码簿。 - 附件上传/群管理（member/leave/disband/announcement）要求 DID 已注册。 - admin 端点需 `X-Admin-Key` header（服务端未配 ADMIN_KEY 时返回 503；配了且不匹配返回 401）。 ## 消息 ### POST /api/v1/phone/message —— 发短信/单聊 ```json { "from": "did:cha2a:agent:main", // 必填：DID 或号码（校验注册/号码簿） "fromNumber": "+8613800138000", // 可选：agent 对应的号码（与 from 号码身份一致，否则 403 IDENTITY_MISMATCH） "to": "+8613900139000", // 必填：对端号码（须在号码簿，否则 404） "text": "你好", // 可选（≤GROUP_TEXT_MAX） "attachment": { // 可选 "fileId": "<16位hex>", "name": "a.png", "size": 1234, "hash": "", "kind": "binary", "chars": 0 }, "kind": "text", // 可选：text|card|...（card 必须带 payload） "payload": {}, // 可选：结构化消息 "agent": { "did": "...", "name": "...", "level": 0 } // 可选：发送方展示信息 } ``` → `201 {ok, id, to}`；错误 `400 invalid from/to`、`409 from not registered`、`403 IDENTITY_MISMATCH`、`404 number not in directory`。 ``` ### Technical Analysis The documented message endpoint accepts the sender identity through the caller-controlled `from` field. The stated validation confirms that a DID is registered or that a number is present in the directory. The optional `fromNumber` is checked for consistency with `from`, but consistency between two identity values does not prove that the HTTP caller controls either identity. The reference documents an `X-Admin-Key` requirement only for administrative endpoints. It does not document an authorization header, authenticated session, request signature, DID proof, challenge-response mechanism, or server-side binding between an authenticated pri ...[truncated 1782 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/rcs-api.md:37
Finding: Sensitive Message, Attachment, and Group Read Endpoints Lack Documented Authorization
Content: View full analysis
&since=` → `200 {did, count, messages:[...]}`（按 did 隔离；since 增量拉取）。 ## 附件 ### POST /api/v1/phone/attachment —— 上传（≤10MB，413 超限） ```json { "did": "did:cha2a:agent:main", "name": "qr.png", "mime": "image/png", "data": "" } ``` → `201 {ok, fileId, name, mime, size, hash}`（`hash`=服务端 SHA-256，防篡改标记）。did 未注册 → 409。 ### GET /api/v1/phone/attachment/:id —— 下载 → 文件字节流；`404 attachment not found`（fileId 须 16 位 hex）。 ## 群组 | 端点 | 方法 | 说明 | Admin? | |---|---|---|---| | `/api/v1/phone/group` | POST | 建群 `{name, creator, members[]}`（成员须注册/在簿，≤100）→ `{ok, groupId, conversationId}` | 否 | | `/api/v1/phone/group/list?did=` | GET | 群列表 `{groups:[{groupId,name,memberCount}]}` | 否 | | `/api/v1/phone/group/:id` | GET | 群详情 `{ok,groupId,name,members[],conversationId,announcement}` | 否 | | `/api/v1/phone/group/:id/members-detail` | GET | 成员 `{member,nickname,type:phone\|agent,level}` | 否 | | `/api/v1/phone/group/:id/audit` | GET | 群审计事件 | 否 | | `/api/v1/phone/group/:id/messages` | GET | 群消息 `?since=` | 否 | | `/api/v1/phone/group/message` | POST | 群消息广播（body 同 `/phone/message`，但 `to`→`groupId`） | 否 | | `/api/v1/phone/group/member` | POST | 加成员 `{groupId, member, actor}` | **是** | | `/api/v1/phone/group/member` | DELETE | 移除成员 | **是** | | `/api/v1/phone/group/leave` | POST | 退群 | **是** | | `/api/v1/phone/group/disband` | POST | 解散 | **是** | | `/api/v1/phone/group/announcement` | POST | 群公告 `{groupId, text≤500, actor}` | **是** | ``` ### Technical Analysis The API reference describes access to inbox messages using a caller-supplied `did`, direct attachment downloads using a file identifier, and group details, membership information, audit events, and messages using a group identifier. It does ...[truncated 2533 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file describes admin-only operations for adding/removing members, leaving, disbanding groups, and posting announcements, including destructive actions like group disbandment. The description lists the endpoints and auth requirement but does not warn users about the impact on group state or recommend confirmation/safeguards before invoking them.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.