Security audit

金蝶云星空二次开发

Security checks for vulnerabilities and agentic risk

Overview

This Kingdee ERP development skill is mostly coherent documentation, but it includes unsafe credential, authentication, and database-operation examples that users should review before installing.

Install only if you specifically need Chinese Kingdee K3 Cloud/Cosmic development help. Treat its WebAPI, admin-login, SSO, database restore, and production-operations snippets as drafts: require HTTPS, secret management, password rotation, least-privilege accounts, authorization checks, backups, and testing outside production before applying them.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: references/xingkong-webapi.md:19
Finding: Plaintext HTTP Used for Password-Based ERP Authentication
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/cangqiong-dev.md:485
Finding: Weak MD5-Based API Request Signature
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/cangqiong-dev.md:559
Finding: Bearer Token Exposed in Single Sign-On URL Query String
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/cangqiong-dev.md:281
Finding: Custom API Template Omits Explicit Authorization and Leaks Internal Details
Content: View full analysis
doCustomService( CustomApiServiceContext context, Map params ) { Map result = new HashMap<>(); try { String action = (String) params.get("action"); String materialNumber = (String) params.get("materialNumber"); if ("query".equals(action)) { DynamicObject material = BusinessDataServiceHelper.loadSingle( "bd_material", new QFilter("number", "=", materialNumber) ); result.put("success", true); result.put("data", material != null ? material.toMap() : null); } else { result.put("success", false); result.put("message", "Unknown operation type"); } } catch (Exception ex) { result.put("success", false); result.put("message", ex.getMessage()); } return result; } } ``` A related C# template in `references/plugin-templates.md`, lines 537-565, also dispatches a caller-controlled action and returns the raw exception message: ```csharp [ServiceDescriptor("MyCustomApi")] public class MyCustomApiService : AbstractServiceHandler { public override InvokeResult DoAction(InvokeContext context) { ...[truncated 3275 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/deployment-ops.md (reported line 257)May include surrounding context.
xml
<configuration> <system.web>  <httpRuntime maxRequestLength="102400" executionTimeout="3600" />  <sessionState timeout="60" />

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/deployment-ops.md (reported line 257)May include surrounding context.
xml
<configuration> <system.web>  <httpRuntime maxRequestLength="102400" executionTimeout="3600" />  <sessionState timeout="60" />

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This is a direct exposure of default administrator credentials without an immediate warning to rotate them, which can facilitate compromise if copied into test, staging, or production deployments. Because the skill is specifically about Kingdee development and administration workflows, readers may treat the credentials as endorsed operational guidance.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/common-patterns.md (reported line 1)May include surrounding context.
md
# 金蝶云星空 WebAPI 接口开发 ## 目录 - [概述](#概述)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/database-reference.md (reported line 1)May include surrounding context.
md
# 金蝶云星空 WebAPI 接口开发 ## 目录 - [概述](#概述)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/xingkong-bos-ide.md (reported line 1)May include surrounding context.
md
# 金蝶云星空 WebAPI 接口开发 ## 目录 - [概述](#概述)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/xingkong-plugin-dev.md (reported line 1)May include surrounding context.
md
# 金蝶云星空 WebAPI 接口开发 ## 目录 - [概述](#概述)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/xingkong-webapi.md (reported line 1)May include surrounding context.
md
# 金蝶云星空 WebAPI 接口开发 ## 目录 - [概述](#概述)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill’s trigger scope is extremely broad, matching essentially any Kingdee-related development mention. In an agent system, this can cause unintended invocation and over-delegation, increasing the chance that unrelated requests are routed into this skill and that its instructions dominate safer or more appropriate behaviors.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The guidance states that fields involving Chinese names must use the _L table with FLOCALEID=2052, which hard-codes a specific locale in natural-language instructions. The file does not indicate user opt-in, alternatives for other locales, or a documented justification that this skill is intentionally restricted to a China-specific environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The authentication examples include app secrets, bearer tokens, signature headers, and even a login URL carrying a token, but do not warn readers against exposing these values in source control, logs, browser history, referrers, or monitoring systems. In an ERP development skill, readers may copy these patterns directly into production integrations, increasing the chance of credential leakage and account compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The integration section normalizes direct database access and bulk synchronization between ERP systems without emphasizing change control, backups, idempotency, validation, transactional safety, or production impact. In a Kingdee/Cosmic enterprise integration context, such examples can lead to accidental corruption, inconsistent cross-system state, or high-impact outages if applied directly in live environments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document states that all fields involving Chinese names must use FLOCALEID=2052 (Simplified Chinese), which is a natural-language locale requirement. Because the file does not offer a language choice or explain that the skill is intentionally limited to a China-specific environment, this creates a language/locale policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file includes SQL restore commands with REPLACE, which can overwrite an existing database, but this section does not explicitly warn the reader about the destructive effect at the point of use. While the document discusses backups elsewhere, it does not clearly disclose that these commands may irreversibly replace target databases if run against the wrong instance or name.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document tells users to run KILL 55 to terminate a blocking session. Although it says '谨慎使用', it does not clearly warn that killing a session can roll back in-flight work, disrupt users, or cause data loss for uncommitted transactions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The cross-organization pricing example fetches target-organization price data using a supplied targetOrg ID but does not demonstrate any permission, organization-membership, or data-scope validation before performing the read. In a Kingdee multi-org environment, this can normalize insecure implementation patterns and lead developers to expose pricing or commercial data across organizations if the operation is reachable by users lacking access to the target organization.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The SQL example explicitly requires FLOCALEID = 2052, which forces Simplified Chinese locale behavior in natural-language guidance. Under the policy, locale-specific behavior should either be optional for the user or clearly justified as region-specific; this file provides neither.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all skill guidance in Chinese from the title onward, which effectively forces a specific language for users consuming the template library. The policy allows fixed locale behavior only when the file offers user choice or clearly documents a justified regional constraint, neither of which appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The entire skill is written as Chinese-only operational guidance, including field naming and UI instructions, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-language environment. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless clearly justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document presents default administrator credentials as a normal login option during environment setup, which normalizes insecure access practices. In a developer skill for ERP customization, this can lead users to retain or reuse well-known credentials in real environments, increasing the chance of unauthorized administrative access.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Including default administrator credentials in plain language creates a reusable secret pattern that may be copied into active environments or searched by attackers familiar with vendor defaults. Even if these are vendor-known defaults, documenting them without hardening guidance lowers the barrier to misuse and weakens secure setup practices.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document presents username/password authentication over an http:// endpoint and does not warn that credentials must be protected in transit and at rest. This can normalize insecure integration patterns, leading users to transmit ERP credentials unencrypted or embed them directly into scripts, exposing high-value enterprise accounts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file describes operations that can change business records and includes a delete endpoint, but it does not warn users that these actions may alter workflow state or permanently remove data. Under the markdown-specific warning criterion, behaviors affecting user data or system integrity should be accompanied by explicit cautionary language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The title and entire document are written in Chinese, and there is no indication that users may choose another language or that the content is intentionally limited to a Chinese-only audience. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.