Security audit

金蝶云星空二次开发

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Kingdee ERP development guide, but it includes risky production-facing ERP credential, authentication, and destructive WebAPI examples without enough safety guardrails.

Review and harden the examples before relying on this skill in real ERP work. Replace HTTP with HTTPS, avoid putting tokens in URLs, keep credentials in environment variables or a secret manager, rotate any default/admin passwords, and require explicit human confirmation plus backups or rollback plans before delete, submit, audit, unaudit, database recovery, or production deployment actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The document explicitly publishes default administrator passwords for accessing an ERP management center. In the context of a broad development skill for Kingdee/K3 Cloud, this materially lowers the barrier to unauthorized access against misconfigured or freshly deployed environments, especially because no warning is given to rotate credentials immediately or avoid their use outside isolated lab setups.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill’s trigger scope is extremely broad, matching almost any Kingdee-related development term. This can cause the skill to activate in contexts where it is not the best fit, increasing the chance that users are steered into overly specialized ERP/plugin guidance, including sensitive areas like database access, WebAPI, deployment, and permissions, without sufficient intent validation. In a security context, overbroad activation expands the attack surface for prompt hijacking or unsafe operational advice because the skill may engage on loosely related requests.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The document includes a concrete database configuration example with plaintext username and password in `application.yml` but does not warn readers not to hardcode real credentials or commit secrets to source control. In a developer skill focused on ERP customization, users may copy this pattern directly into production-like configs, increasing the risk of credential exposure through repositories, logs, backups, or shared documentation.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The single sign-on example places an authentication token directly in the URL query string, which is unsafe because URLs are commonly logged by browsers, reverse proxies, web servers, monitoring tools, and Referer headers. In an enterprise SSO context, token leakage can enable session hijacking or unauthorized access to ERP resources if the token is bearer-style or otherwise reusable.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The guide includes default administrator credentials without any caution about changing them, not using them in production, or restricting access. For an ERP platform, this can lead directly to compromise of administrative functions, business data, workflow controls, and downstream integrations if operators follow the documentation verbatim.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document describes state-changing and destructive WebAPI operations such as Delete, Submit, Audit, and UnAudit without any caution about business impact, approval workflow consequences, rollback difficulty, or the need for authorization checks. In an ERP integration skill, this increases the chance that users or downstream agents will invoke high-impact operations directly in production, causing data loss or improper workflow transitions.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The authentication examples use plain HTTP for username/password submission and do not warn that credentials and session data may be exposed to interception or man-in-the-middle attacks. Because this skill targets ERP systems containing sensitive business data and administrative workflows, insecure transport materially increases the risk of account compromise and unauthorized system access.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The SDK examples demonstrate authenticated requests using usernames and passwords but omit basic secret-handling and transport-security guidance such as storing secrets outside source code, using HTTPS, validating certificates, and handling tokens/sessions safely. In a developer skill, such examples are likely to be copied verbatim, leading to hardcoded secrets, insecure deployments, or credential leakage through logs and repositories.

Hidden Instructions

High

Category: Prompt Injection
Content: # 金蝶二次开发常见模式 + 社区FAQ ## 目录 - [常见开发模式](#常见开发模式)
Confidence: 18% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

Category: Prompt Injection
Content: # 金蝶云星空数据库参考 ## 目录 - [表命名规则](#表命名规则)
Confidence: 18% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

Category: Prompt Injection
Content: # 金蝶云星空 BOS IDE 操作手册 ## 目录 - [环境准备](#环境准备)
Confidence: 18% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

Category: Prompt Injection
Content: # 金蝶云星空插件开发指南 ## 目录 - [概述](#概述)
Confidence: 18% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

Category: Prompt Injection
Content: # 金蝶云星空 WebAPI 接口开发 ## 目录 - [概述](#概述)
Confidence: 18% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.