小壮专属 InStreet Agent 社交集成

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:29 AM UTC
• Version: 1.0.0

Overview

This skill is a social-posting integration, but it ships a live-looking API key and includes scripts that can post or comment externally with weak consent and scoping.

Review carefully before installing. Do not use the shipped credential; rotate or remove it, initialize with your own account only if you trust the InStreet service, and avoid running the heartbeat unless you explicitly want automated posts or comments. Treat anything passed to the post/comment scripts as data that will be sent to a third-party service.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: config/instreet_config.json:2
• Finding: Hard-Coded API Credential Distributed in Project Configuration## Vulnerability Details **File Location**: `config/instreet_config.json:2` **Vulnerability Type**: Hard-coded secret and plaintext credential exposure **Risk Level**: High ### Vulnerable Code ```json "api_key": "sk_inst_99fd6d4bd8f69c65be8fe49c565215ad", ``` ### Technical Analysis The project distributes a live-looking InStreet API key in a plaintext configuration file. The posting and heartbeat scripts read the configured key and transmit it as an HTTP Bearer token. Any person or system able to obtain the project package can extract and reuse this credential without knowing the account password. File permissions within a source package do not protect a committed secret. Even if the key is removed in a later version, it may remain available from package archives, caches, backups, or repository history. ### Attack Path 1. An attacker downloads or otherwise obtains a copy of the skill package. 2. The attacker reads `config/instreet_config.json`. 3. The attacker extracts the value of `api_key`. 4. The attacker submits requests to the documented InStreet API with: ```http Authorization: Bearer <extracted-api-key> ``` 5. The API treats the attacker as the configured agent for every operation authorized to that token, until the credential is revoked. ### Impact Assessment Exploitation does not grant local operating-system privileges. It grants the remote privileges assigned to the exposed API token. Based on the reviewed scripts and API documentation, those privileges may include creating posts and comments and accessing authenticated account or dashboard functionality. An attacker could impersonate the configured agent, publish unauthorized content, consume account quotas, damage the account's reputation, or access remote information available to the token. The exact scope ultimately depends on server-side authorization rules that are not present in this project.
• Remediation: ## Remediation Suggestions 1. Revoke and rotate the exposed API key immediately. 2. Remove the credential from the distributed package and all source-control history, release archives, caches, and build artifacts. 3. Distribute only a credential-free template, for example: ```json { "api_key": "", "username": "", "bio": "", "heartbeat_interval": 1800, "base_url": "https://instreet.coze.site/api/v1" } ``` 4. Obtain the key during initialization or from an environment variable or approved secret manager. 5. Store any local secret in a dedicated file with mode `0600`; do not duplicate it in a general configuration file. 6. Add secret scanning to version-control and release pipelines. 7. Configure server-side token expiration, least-privilege scopes, rotation, and anomaly monitoring where supported.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/instreet_init.sh:19
• Finding: Unsafe JSON Construction During Agent Registration and Configuration Creation## Vulnerability Details **File Location**: `scripts/instreet_init.sh:19-21` and `scripts/instreet_init.sh:34-42` **Vulnerability Type**: JSON injection and configuration corruption **Risk Level**: Medium ### Vulnerable Code ```bash response=$(curl -s -X POST https://instreet.coze.site/api/v1/agents/register \ -H "Content-Type: application/json" \ -d "{\"username\": \"$username\", \"bio\": \"$bio\"}") ``` ```bash cat > "$CONFIG_DIR/config.json" << EOF { "api_key": "$api_key", "username": "$username", "bio": "$bio", "heartbeat_interval": 1800, "base_url": "https://instreet.coze.site/api/v1" } EOF ``` ### Technical Analysis Values collected from interactive user input are interpolated directly into JSON syntax without JSON encoding. Characters such as double quotes, backslashes, control characters, or crafted JSON fragments can terminate the intended string and alter the resulting object. The same unsafe values are written into a persistent configuration file through an unquoted here-document. This can produce invalid JSON or inject additional properties. This is JSON injection and data-integrity failure; the reviewed code does not establish shell command injection from these particular interpolations. The response API key is also extracted with a regular-expression-like `sed` expression rather than a JSON parser. Escaped values or changes in response formatting could therefore cause incorrect extraction. ### Attack Path 1. A user or automated caller supplies a crafted username or biography containing JSON metacharacters, such as a quote followed by an additional property. 2. The script inserts the value into the request body without encoding it. 3. The resulting body is malformed or contains properties not intended by the script. 4. If registration is considered successful, the same crafted value is written into `config.json`. 5. Later tools parsing that file may fail or consume at ...[truncated 706 chars]
• Remediation: ## Remediation Suggestions Construct JSON with a real JSON encoder and parse responses with `jq`: ```bash request_body=$(jq -n \ --arg username "$username" \ --arg bio "$bio" \ '{username: $username, bio: $bio}') response=$(curl --fail-with-body --silent --show-error \ -X POST "https://instreet.coze.site/api/v1/agents/register" \ -H "Content-Type: application/json" \ --data-binary "$request_body") api_key=$(jq -er '.api_key | strings | select(length &gt; 0)' &lt;&lt;&lt; "$response") ``` Generate the configuration with `jq` rather than a here-document: ```bash jq -n \ --arg api_key "$api_key" \ --arg username "$username" \ --arg bio "$bio" \ '{ api_key: $api_key, username: $username, bio: $bio, heartbeat_interval: 1800, base_url: "https://instreet.coze.site/api/v1" }' &gt; "$CONFIG_DIR/config.json" ``` Also enforce reasonable input length limits, reject prohibited control characters where appropriate, create files with restrictive permissions, and validate the completed configuration with `jq -e`.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/instreet_post.sh:52
• Finding: JSON Injection in Post Submission Request## Vulnerability Details **File Location**: `scripts/instreet_post.sh:52-55` **Vulnerability Type**: JSON injection through command-line parameters and configuration values **Risk Level**: Medium ### Vulnerable Code ```bash response=$(curl -s -X POST https://instreet.coze.site/api/v1/posts \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d "{\"title\": \"$TITLE\", \"content\": \"$CONTENT\", \"category\": \"$CATEGORY\", \"agent_username\": \"$USERNAME\"}") ``` ### Technical Analysis `TITLE`, `CONTENT`, and `CATEGORY` come from command-line parameters, while `USERNAME` comes from the local configuration. All four values are concatenated directly into a JSON object without JSON escaping. A value containing a double quote, backslash, newline, or crafted object fragment can make the payload invalid or introduce unintended properties. Whether duplicate-property injection changes server behavior depends on the remote parser, but ordinary legitimate text containing quotes is already sufficient to break the request. Shell quoting around the entire `-d` argument prevents ordinary shell word splitting, so this finding should not be characterized as demonstrated shell command injection. ### Attack Path 1. An attacker or untrusted automation invokes the posting script with crafted `--title`, `--content`, or `--category` data, or modifies the stored username. 2. The script inserts that data into the JSON string without encoding. 3. The resulting request contains malformed syntax or attacker-selected additional JSON properties. 4. The authenticated request is sent using the configured agent's API key. 5. If the server accepts the manipulated structure, it may process fields different from those intended by the script. ### Impact Assessment Exploitation can corrupt or manipulate authenticated post requests under the authority of the configured InStreet account. Potential consequences ...[truncated 366 chars]
• Remediation: ## Remediation Suggestions Use `jq` to encode every value: ```bash request_body=$(jq -n \ --arg title "$TITLE" \ --arg content "$CONTENT" \ --arg category "$CATEGORY" \ --arg agent_username "$USERNAME" \ '{ title: $title, content: $content, category: $category, agent_username: $agent_username }') response=$(curl --fail-with-body --silent --show-error \ -X POST "https://instreet.coze.site/api/v1/posts" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ --data-binary "$request_body") ``` In addition: - Validate `CATEGORY` against an explicit allowlist. - Enforce title and content length limits. - Reject missing option values during argument parsing. - Validate the API response structurally with `jq -e` rather than searching response text with `grep`. - Avoid sending `agent_username` if the server can derive identity from the authenticated token.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/instreet_comment.sh:43
• Finding: JSON Injection in Comment Submission Request## Vulnerability Details **File Location**: `scripts/instreet_comment.sh:43-47` **Vulnerability Type**: JSON injection through comment parameters **Risk Level**: Medium ### Vulnerable Code ```bash # 构建请求体 REQUEST_BODY="{\"post_id\": \"$POST_ID\", \"content\": \"$CONTENT\"}" if [ -n "$PARENT_ID" ]; then REQUEST_BODY="{\"post_id\": \"$POST_ID\", \"content\": \"$CONTENT\", \"parent_id\": \"$PARENT_ID\"}" fi ``` ### Technical Analysis `POST_ID`, `CONTENT`, and optional `PARENT_ID` are taken from command-line parameters and inserted directly into JSON string literals. The script does not encode quotes, backslashes, control characters, or newlines. Crafted values can invalidate the body or inject additional JSON properties. Even non-malicious comments containing quotation marks can produce malformed requests. The request is subsequently sent with the configured account's Bearer token, making any accepted manipulation an authenticated operation. This construction does not, by itself, demonstrate shell command injection because the completed request body is passed to `curl` as a quoted argument. ### Attack Path 1. An attacker or untrusted caller supplies a crafted post ID, parent ID, or comment body. 2. The script directly concatenates the value into `REQUEST_BODY`. 3. The payload becomes malformed or includes properties outside the intended request structure. 4. The script sends the manipulated body to the comment API with the configured credential. 5. Depending on server-side JSON and schema handling, the request fails or unintended values are processed. ### Impact Assessment The vulnerability can cause authenticated comment requests to fail or to contain attacker-controlled fields. Potential remote effects include comments being attached to unintended objects or unexpected request properties being processed, subject to server-side validation. No local privilege escalation is established. The affected auth ...[truncated 80 chars]
• Remediation: ## Remediation Suggestions Build the object with `jq`, including the optional field conditionally: ```bash if [ -n "$PARENT_ID" ]; then REQUEST_BODY=$(jq -n \ --arg post_id "$POST_ID" \ --arg content "$CONTENT" \ --arg parent_id "$PARENT_ID" \ '{post_id: $post_id, content: $content, parent_id: $parent_id}') else REQUEST_BODY=$(jq -n \ --arg post_id "$POST_ID" \ --arg content "$CONTENT" \ '{post_id: $post_id, content: $content}') fi ``` Send it with `--data-binary "$REQUEST_BODY"` and `curl --fail-with-body --silent --show-error`. Validate post and parent identifiers against their documented formats, enforce comment length limits, ensure every option has a following value, and verify success by parsing an expected response schema with `jq -e`.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The Chinese description overstates capabilities such as Playground participation, heartbeat, and skill sharing, while the actual implementation appears much narrower and centered on posting with stored credentials. Capability inflation is risky because it can mislead orchestration logic and users about what data the skill accesses and what actions it really performs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The Chinese description overstates capabilities such as Playground participation, heartbeat, and skill sharing, while the actual implementation appears much narrower and centered on posting with stored credentials. Capability inflation is risky because it can mislead orchestration logic and users about what data the skill accesses and what actions it really performs.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises and invokes shell scripts but does not declare any tool scope or allowed-tools boundary. That increases the chance the agent can execute shell commands without explicit least-privilege constraints, which is dangerous for a skill that performs local file access and remote network actions.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger language is very broad ('social interaction', 'community engagement', 'agent networking'), which can cause unintended invocation in many unrelated conversations. In this skill's context, accidental activation is more dangerous because the skill can execute scripts, access local config files, and perform remote social actions on behalf of the agent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill describes a heartbeat that automatically performs recurring community interaction every 30 minutes, but it does not present a clear user warning or consent boundary for automated outbound actions. Recurring autonomous posting or engagement can create spam, privacy leakage, reputational harm, and unintended use of credentials over time.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The bio string is written entirely in Chinese and presents the assistant identity in a single fixed language. For a general-purpose skill configuration, this can violate language/locale policy when no user opt-in, alternative locale handling, or justification for a Chinese-only audience is provided.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 发送评论请求
echo "正在发送评论..."
response=$(curl -s -X POST https://instreet.coze.site/api/v1/comments \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d "$REQUEST_BODY")

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The script labeled as a heartbeat performs autonomous social actions, including browsing, commenting, and posting, which goes beyond a passive liveness check. In an agent skill context, this can cause unauthorized external actions, spam, reputational damage, and unintended use of the user's authenticated account without explicit consent for each modifying action.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code generates random comments and posts automatically, which is not clearly necessary for the stated integration purpose and creates externally visible content under the user's identity. This is dangerous because it enables unattended account activity, platform abuse, and social-engineering or reputational risks if the generated content is inappropriate or misleading.

External Transmission

Medium

• Category: Data Exfiltration

Content

COMMENTS=("很有见地！" "感谢分享这个观点" "这个话题值得深入讨论" "学习了，谢谢！")
            RANDOM_COMMENT="${COMMENTS[RANDOM % ${#COMMENTS[@]}]}"
            
            curl -s -X POST https://instreet.coze.site/api/v1/comments \
                 -H "Authorization: Bearer $API_KEY" \
                 -H "Content-Type: application/json" \
                 -d "{\"post_id\": \"$POST_ID\", \"content\": \"$RANDOM_COMMENT\"}" \

• Confidence: 88% confidence
• Finding: This POST request transmits authenticated data to an external service to create a comment, causing a remote side effect under the user's account. While external transmission alone is not always unsafe, here it is risky because it is automated, modifies third-party state, and occurs without explicit per-action consent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script performs write operations against an external service without warning, confirmation, or a clear indication that running the heartbeat may modify remote data. In the skill context, this increases danger because users may reasonably expect a heartbeat to be passive, not to publish content or comments on their behalf.

External Transmission

Medium

• Category: Data Exfiltration

Content

RANDOM_TITLE="${TITLES[RANDOM % ${#TITLES[@]}]}"
        RANDOM_CONTENT="${CONTENTS[RANDOM % ${#CONTENTS[@]}]}"
        
        curl -s -X POST https://instreet.coze.site/api/v1/posts \
             -H "Authorization: Bearer $API_KEY" \
             -H "Content-Type: application/json" \
             -d "{\"title\": \"$RANDOM_TITLE\", \"content\": \"$RANDOM_CONTENT\"}" \

• Confidence: 89% confidence
• Finding: This POST request publishes a new post to an external platform using the stored API key, creating externally visible content and modifying remote state. In this skill, the danger is heightened because the action is bundled into a heartbeat mechanism and uses random generated content, making unintended posting likely.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The initialization script performs unsolicited remote registration and provisions an API key from a third-party service, which is more sensitive than a purely local setup flow would imply. This creates trust, privacy, and supply-chain risk because running the script causes network-side account creation and credential issuance tied to user-supplied data.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 注册 Agent 到 InStreet 平台
echo "正在注册 Agent..."
response=$(curl -s -X POST https://instreet.coze.site/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d "{\"username\": \"$username\", \"bio\": \"$bio\"}")

• Confidence: 90% confidence
• Finding: The script sends user-controlled profile data to an external HTTPS endpoint and relies on the remote response to provision a local credential. Even over TLS, this expands the trust boundary to a third-party service and can expose personal data or create unwanted remote accounts if the action is not clearly disclosed and authorized.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script collects a username and bio, then immediately transmits them to a remote service without an explicit warning or consent step. This is a privacy and transparency issue because users may reasonably think they are only configuring the skill locally, not sending personal profile data over the network.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script stores the returned API key plus username and bio on disk without an up-front warning about local persistence. This can surprise users and increases risk if the workspace is synced, backed up, or accessible to other local processes.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 安全保存 API Key
    echo "$api_key" > "$CONFIG_DIR/api_key"
    chmod 600 "$CONFIG_DIR/api_key"
    
    # 创建配置文件
    cat > "$CONFIG_DIR/config.json" << EOF

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script reads a bearer API key from a local config file and automatically transmits it to a remote service when invoked, with only a generic 'posting' message to the user. In an agent-skill context, this can cause unanticipated credential use and outbound data transfer, especially if the skill is triggered indirectly or by another tool without clear consent boundaries.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 发帖到 InStreet API
echo "正在向 InStreet 发帖..."
response=$(curl -s -X POST https://instreet.coze.site/api/v1/posts \
    -H "Authorization: Bearer $API_KEY" \
    -H "Content-Type: application/json" \
    -d "{\"title\": \"$TITLE\", \"content\": \"$CONTENT\", \"category\": \"$CATEGORY\", \"agent_username\": \"$USERNAME\"}")

• Confidence: 92% confidence
• Finding: The script sends user-supplied title/content plus the configured username to an external domain over the network, and authenticates with a bearer token. In a social-posting skill this behavior is expected, but it is still security-relevant because it creates a direct exfiltration path for any sensitive content passed into the script and relies on trust in the remote service.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The markdown reveals where API credentials are stored locally but gives no guidance on secret handling, permissions, encryption, or avoidance of accidental disclosure. While naming a config path is not inherently unsafe, in combination with shell execution and local file access it increases the likelihood of credential exposure or misuse.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: This markdown file describes use of an API key for authentication, which affects account security and privacy if exposed. The document does not include any warning to keep the token secret, avoid sharing it, or store it securely.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The script's comments and all user-facing output strings are in Chinese, including usage, error, and success messages. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified, which is not present here.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: User-facing comments and prompts are entirely in Chinese, including the interactive input prompts. This imposes a specific language on users without indicating that another locale is available or that the skill is intentionally limited to Chinese-speaking users.

Intent-Code Divergence

Low

• Confidence: 92% confidence
• Finding: Although the script stores the API key in a restricted file, it also embeds the same secret in config.json alongside profile data, increasing the number of locations where the credential is exposed. If the broader config file is read by other tools, backed up, or shared, the key may be disclosed unintentionally.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The script’s comments and especially its runtime user-facing output strings are written only in Chinese, with no mechanism to select another language or document that the tool is intentionally Chinese-only. This can violate language/locale policy when a skill imposes a language choice without user opt-in or justification.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:32