Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a coherent IoT data-query tool, but it handles API credentials in ways that could expose them if the API endpoint or command arguments are influenced.
Install only if you trust the publisher and can control the runtime environment. Do not set INSENTEK_API_BASE or --api-base to anything other than the official HTTPS API unless you intentionally want credentials sent there, avoid passing tokens on the command line, and treat ~/.config/insentek/credentials.json as sensitive even though it is encrypted.
scripts/insentek_cli.py:39Credential and bearer-token exfiltration through an unrestricted API base URL override
packages/insentek-skill-cli/lib/core/credentials.js:22Credential files are created before restrictive permissions are applied and use a predictable machine-derived key
scripts/export_excel.py:247Sensitive API bearer tokens can be supplied through command-line arguments
The request URL is derived from API_BASE_URL, which can be overridden via an environment variable and again via the --api-base CLI argument, then used directly in urllib.request.urlopen. Because the script also attaches the Authorization token to every request, an attacker who can influence the base URL can redirect traffic to an attacker-controlled host and exfiltrate credentials or sensitive device data; in an agent/skill context, user-controlled parameters make this more dangerous than a normal local admin-only script.
for k, v in headers.items():
req.add_header(k, v)
try:
with urllib.request.urlopen(req, timeout=30) as resp:
return json.loads(resp.read().decode("utf-8"))
except urllib.error.HTTPError as e:
body = e.read().decode("utf-8")
The request target is derived from INSENTEK_API_BASE and then used directly in urllib.request.urlopen, allowing an attacker who can influence the environment or CLI --api-base to redirect authenticated API traffic to an arbitrary host. Because this client sends tokens and may fetch fresh credentials-derived tokens, the behavior creates an SSRF/exfiltration risk rather than a mere configurability feature.
req.data = json.dumps(data).encode("utf-8")
try:
with urllib.request.urlopen(req, timeout=30) as resp:
return json.loads(resp.read().decode("utf-8"))
except urllib.error.HTTPError as e:
# 认证失败，尝试刷新 token 后重试一次
The environment check accepts a caller-controlled api_base and performs a network request to it, which can be abused for SSRF or internal network probing if an attacker can influence the argument or environment. This specific path does not include authentication material, so the impact is lower than the main request path, but it still extends network reach beyond the declared data-query purpose.
# 7. API 可达性（不带认证，只检查服务是否在线）
try:
req = urllib.request.Request(f"{api_base}/v3/token", method="GET")
with urllib.request.urlopen(req, timeout=10) as resp:
# 400 是正常的（缺少参数），说明服务在线
results["api_reachable"] = {
"ok": True,
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Added
-----
- **`latest` 子命令**：`scripts/insentek_cli.py` 新增 `latest --sn SN`，统一走加密凭据 + 自动刷新 token，取代 SKILL.md 之前不可执行的 `curl /v3/device/{sn}/latest` 示例（Agent 无法从加密凭据中拿到明文 token）
- **统一错误信封 `normalize_error`**：`cmd_data` / `get_latest` 现在把内部 `_validation_error` / `_http_error` / `authentication_required` 统一转换为 `{success: false, error: <kind>, message: ...}`，并对上游 WAF HTML 错误页截断到 500 字符
Fixed
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Added
-----
- **`latest` 子命令**:`scripts/insentek_cli.py` 新增 `latest --sn SN`,统一走加密凭据 + 自动刷新 token,取代 SKILL.md 之前不可执行的 `curl /v3/device/{sn}/latest` 示例(Agent 无法从加密凭据中拿到明文 token)
- **统一错误信封 `normalize_error`**:`cmd_data` / `get_latest` 现在把内部 `_validation_error` / `_http_error` / `authentication_required` 统一转换为 `{success: false, error: <kind>, message: ...}`,并对上游 WAF HTML 错误页截断到 500 字符
Fixed
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# insentek-api-skills
This is a GSD-managed project. Use `/gsd-progress` to check status and next steps.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
The documented behavior materially exceeds the declared purpose: besides IoT data querying, the skill performs package installation, runtime discovery, environment checks, credential storage, token handling, and local file generation. This mismatch is dangerous because users and policy systems may grant trust based on a benign description while the skill exercises far broader local and network capabilities.
Detected: suspicious.dangerous_exec, suspicious.potential_exfiltration