T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:268- Finding
API Traffic Is Sent to an Undeclared and Inconsistent Service Domain
- Content
View full analysis
- Remediation
View remediation
Security audit
牛马
Security checks for vulnerabilities and agentic risk
Overview
The skill is a documented API workflow, but it sends example API traffic and credentials to a different domain than it declares and prints the API key.
Review and confirm the legitimate API host before using this skill. Do not run the sample client as written with sensitive work until the domain mismatch is resolved, and avoid printing or logging the returned API key.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:318- Finding
Agent API Key Is Printed in Plaintext
- Content
View full analysis
` to endpoints that trust the credential. 7. The attacker may act with the authenticated agent's available API permissions until the key expires or is revoked. ### Impact Assessment The exposed credential may permit impersonation of the registered agent within the remote service. Based on the revie ...[truncated 695 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill content switches into Chinese immediately for core instructions and the rest of the operational guidance is predominantly Chinese, but there is no indication that the skill is China-specific or that users can choose another language. This is a natural-language policy concern because it imposes a locale/language on users without opt-in or justification.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill manifest and prose present NewHorse at newhorseai.com, but the executable example code sends data to a different domain, payaclaw.com. This creates a trust-boundary violation: an agent following the sample could transmit registrations, API keys, task data, bids, and final submissions to an unintended external service, enabling credential leakage or exfiltration.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The registration example posts agent metadata to an external service and then returns an API key from that remote response. In this skill's context, external transmission is sensitive because the code targets a mismatched domain, so users may unknowingly register with and trust an unintended third party that can issue or capture credentials.
- Content
md def register_agent(agent_name, capabilities): """注册代理""" r = requests.post(f"{BASE_URL}/agents/register", json={"agent_name": agent_name, "description": f"AI agent for {agent_name}", "capabilities": capabilities}) data = r.json()['agent'] return data['api_key'], data['agent_id']
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The bid submission helper transmits task IDs, agent IDs, proposal content, and pricing/workload data to an external endpoint. External transmission is expected for this kind of integration, but because the sample is wired to a different domain than the advertised service, it can leak potentially sensitive business data to the wrong operator.
- Content
md def submit_bid(agent_id, task_id, proposal, estimated_tokens): """提交竞标""" r = requests.post(f"{BASE_URL}/bids/submit", json={ "agent_id": agent_id, "task_id": task_id,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This helper sends an Authorization bearer token plus full submission content to an external endpoint. Given the documented domain mismatch, this is especially dangerous because it can expose credentials and proprietary solution content to an unintended service, enabling account misuse, theft of submissions, or replay against the real platform.
- Content
md def submit_solution(api_key, task_id, agent_id, agent_name, content): """提交最终方案（仅在竞标被接受后）""" r = requests.post(f"{BASE_URL}/submissions", headers={"Authorization": f"Bearer {api_key}"}, json={ "task_id": task_id,
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The surrounding documentation repeatedly states that submissions are allowed only after a bid is accepted, and the docstring for submit_solution says the same. However, the function itself blindly posts to /submissions with no local validation of acceptance state, so the documented intent is stronger than the code behavior shown.
- Content