T09 · Insecure Skill Coding Practices
Error
- Location
scripts/server.py:62- Finding
Flask Development Debugger Exposed on All Network Interfaces
- Content
View full analysis
- Remediation
View remediation
Security audit
auto-customer-support
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent customer-support scaffold, but its runnable server is exposed with debug mode and unauthenticated webhook/escalation routes, so it needs review before use.
Install only for development or a controlled internal environment unless you first disable Flask debug mode, bind to localhost or a protected interface, add authentication/signature validation and rate limits to the endpoints, and pin dependencies. Do not connect it to real customer channels or ticket systems until those controls are in place.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/server.py:36- Finding
Webhook and Escalation Endpoints Lack Authentication
- Content
View full analysis
= threshold: reply = item['answer'] return jsonify({'reply': reply, 'confidence': score, 'escalate': False}) else: # low confidence -> escalate return jsonify({'reply':'抱歉，我不确定如何回答。我们会尽快将您的问题转人工处理。', 'confidence': score, 'escalate': True}) @app.route('/escalate', methods=['POST']) def escalate(): data = request.get_json() or {} # stub: in real integration, create ticket in Zendesk/Feishu/etc. return jsonify({'status':'escalated','data':data}) ``` ### Technical Analysis Neither endpoint validates the caller through a provider signature, API token, mutual TLS certificate, timestamp, nonce, or other authentication mechanism. The service also binds to all network interfaces, making these routes available to any network-reachable client unless protected by external controls. The `sender` value is accepted but not authenticated, allowing callers to claim arbitrary sender identities. The `/escalate` route currently only echoes input and does not create an external ticket, which limits its immediate effect. Nevertheless, it reports a successful escalation to every caller and establishes an insecure access-control pattern that would become more serious if the documented ticket-system integration were implemented without adding authorization. No replay protection, request throttling, or request body-size controls are implemented in the application. ### Attack Path 1. An ...[truncated 1300 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:27- Finding
Flask Dependency Is Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill describes capabilities that rely on environment-based secrets and external integrations, but it declares no explicit tool scope or permission boundaries. In an agent ecosystem, missing scope metadata can cause the skill to be invoked with broader access than intended, increasing the chance of unauthorized secret access or unsafe execution assumptions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad, natural-language requests that could match ordinary user conversations and unintentionally activate the skill. In a customer-support automation context, accidental invocation could expose webhook behavior, initiate message handling flows, or cause unintended outbound integrations/escalations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md 2) 启动服务（开发）： uv run python skills/auto-customer-support/scripts/server.py --port 5005 3) 测试请求： curl -X POST http://localhost:5005/webhook -H "Content-Type: application/json" -d '{"message":"如何退款","sender":"user-123"}' 输出（示例） - 成功匹配时返回：{ "reply": "...", "confidence": 0.95, "escalate": false }
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The entire auto-reply template is written in Chinese and provides no indication that recipients can choose another language or that the template is intended only for a Chinese-language audience. This can violate a language/locale policy when the skill is used in broader contexts without explicit user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The FAQ entries and responses are entirely in Chinese, which implies the skill is designed to interact in a fixed language. There is no indication in this file that users can choose another language or that the Chinese-only scope is explicitly justified as a region-specific skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
All user and bot utterances are written in Chinese, and the example gives no indication that other languages are supported or that the language requirement is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The phrase '任何能 POST JSON 的平台' defines the integration scope extremely broadly without constraints or examples of what should not be connected. For a markdown guide, this creates an ambiguous trigger/invocation boundary and could encourage unintended integrations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The fallback reply is always returned in Chinese, regardless of the user's input language or any stated locale setting. This creates a natural-language policy issue because the skill enforces a language without opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file presents all operational guidance exclusively in Chinese, which can amount to a language-policy issue when no user language choice or justification is provided. The content does not indicate that the skill is region-specific or intentionally limited to Chinese-speaking users.
- Content