T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:9- Finding
Remote Backends May Receive API Keys and Private Content over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
LocalMiniDrama短剧助手
Security checks for vulnerabilities and agentic risk
Overview
The skill appears purpose-aligned, but it can send API keys and private project content to a configured backend over plain HTTP and lacks clear confirmation rules for powerful actions.
Review this skill before installing. Use it only with a backend you control, prefer HTTPS for any non-local backend, avoid entering high-value API keys over plain HTTP, and confirm the exact project before delete, import/export, upload, bulk generation, or key-update actions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md --- name: local-mini-drama version: 1.1.0 description: LocalMiniDrama 本地短剧助手 — 通过自然语言控制短剧项目全流程：创建剧本、生成角色/场景/道具、生成分镜、批量出图、出视频、合成完整剧集、支持小说导入和工程导入导出
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README advertises many broad natural-language triggers such as ordinary conversational requests, but does not document strict activation boundaries, confirmation steps, or exclusions. In an agent setting, this can cause unintended invocation of powerful actions like project creation, export, import, or media generation from casual chat, increasing the risk of accidental side effects or prompt-driven misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README highlights engineering export/import and AI configuration features, including API key-related setup, but provides no user-facing warning about sensitive data handling, external network transmission, or the contents of exported archives. In practice, users may unknowingly expose credentials, private project data, or untrusted imported files when using these capabilities through an agent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest trigger list contains very broad phrases such as requests to write a script, generate images, or configure keys, which are likely to collide with normal conversation outside this specific tool. Because the skill exposes extensive HTTP-powered state changes, accidental invocation could route user content or commands into a local/backend service and perform unintended operations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger guidance is overly broad, causing the skill to activate for generic conversation about writing, images, video, or configuration. In a skill with many state-changing HTTP actions, ambiguous activation increases the chance of unintended project creation, modification, imports, exports, or generation jobs without sufficiently explicit user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill documents destructive operations such as deleting projects without clear warning or mandatory confirmation semantics. In an agentic setting, that omission makes accidental or socially engineered data loss more likely, especially when combined with broad triggers and natural-language control over HTTP endpoints.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill handles highly sensitive material including API keys, uploaded ZIPs, novels, videos, subtitles, and bulk key updates, but provides no privacy or secrecy safeguards. This creates a real risk of credential exposure, unsafe forwarding of private content to backend services, and accidental persistence or display of secrets in conversation or logs.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The '标准工作流（正确顺序）' section says scene extraction uses POST /api/v1/images/episode/{episode_id}/backgrounds/extract and prop extraction uses POST /api/v1/episodes/{episode_id}/props/extract, but earlier endpoint documentation defines these operations as POST /api/v1/episodes/{episode_id}/extract-backgrounds and POST /api/v1/episodes/{episode_id}/extract-props. This is an active contradiction in the skill's own documentation about what the code/API should do.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger list is unusually broad and includes many generic conversational phrases such as asking for help writing a script, generating images/videos, or viewing/configuring projects. This can cause unintended invocation during ordinary chat, leading the agent to activate HTTP-capable functionality against a local backend without sufficiently clear user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This manifest text forces a specific language/locale in the skill’s natural-language descriptions. Under the stated policy, language constraints should either offer user choice or be clearly justified as region-specific, which is not present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README states in Chinese that users control the system through natural language, and all documented usage examples are Chinese-only, with no indication that other languages are supported or that Chinese is an opt-in requirement. This appears to impose a language/locale constraint without user choice or explicit justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The skill description is presented entirely in Chinese and indicates a localized assistant experience, but the file does not state that the skill is China/Chinese-specific or offer any language choice. Under the language/locale policy, forcing a specific language without opt-in can be a policy concern unless the locale restriction is explicitly documented and justified.
- Content