T09 · Insecure Skill Coding Practices
Error
- Location
scripts/humanize.py:41- Finding
Unrestricted API endpoint can expose the bearer token and submitted documents
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai-Deodorizer
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it advertises, but it sends user text and an API key to a configurable external endpoint without enough safeguards or disclosure.
Review before installing. Do not use this skill on confidential, regulated, or private drafts unless you are comfortable sending the text to a remote LLM service. Keep API_BASE unset or restrict it to the intended MiniMax HTTPS endpoint, use a revocable API key, and be aware that the rewriting instructions may add voice or opinions not present in the source.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
scripts/requirements.txt:1- Finding
Open-ended and unhashed dependency installation is not reproducible
- Content
View full analysis
=2.28.0 ``` The documented installation command in `README.md`, line 43, consumes this unconstrained requirement: ```bash pip install -r scripts/requirements.txt ``` ### Technical Analysis The requirement specifies only a minimum version of `requests`. It therefore permits pip to install any current or future release satisfying the constraint, along with transitive dependencies selected at installation time. No lock file or cryptographic hashes are provided. This makes installations non-reproducible: code installed by one user may differ from code installed by another user or by the same user at a later date. It also increases supply-chain exposure because future package and transitive dependency releases enter the environment without being reviewed as part of this Skill. The dependency name is legitimate and there is no evidence in the audited project of typosquatting or a currently malicious release. Exploitation therefore depends on a future upstream or package-index compromise, a malicious version satisfying the constraint, or an untrusted package source configured in the user's pip environment. ### Attack Path 1. A release of `requests` or one of its resolved transitive dependencies is compromised, or an attacker controls the package source used by pip. 2. The malicious release still satisfies `requests>=2.28.0`. 3. A user follows the documented installation command. 4. Pip resolves and downloads the unreviewed release because no exact version or package hash is required. 5. Malicious package installation or runtime code executes with the privileges of the user performing the installation or running the utility. ### Impact Assessment If the supply chain is compromised, malicious dependency code could execute with the installing or runtime user's ...[truncated 427 chars]- Remediation
View remediation
``` 2. Generate a lock file that also pins all transitive dependencies. 3. Record cryptographic hashes and install with hash verification, such as pip's `--require-hashes` mode. 4. Use only trusted package indexes and explicitly configure approved index URLs in controlled build environments. 5. Scan pinned packages for known vulnerabilities and update them through a reviewed dependency-update process. 6. Build and test releases in an isolated environment to verify that dependency resolution is reproducible. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (14)
Tainted flow: 'url' from os.environ.get (line 131, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 95% confidence
- Finding
The request destination is derived from the API_BASE environment variable and user text is sent to that URL with the Authorization bearer token. If API_BASE is changed to an attacker-controlled host, the script will exfiltrate both sensitive input text and the API credential, creating an SSRF-style outbound exfiltration path.
- Content
python } try: response = requests.post(url, headers=headers, json=payload, timeout=120) except requests.exceptions.Timeout: raise RuntimeError("API 请求超时（超过120秒），请检查网络连接后重试。") except requests.exceptions.ConnectionError:
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README instructs users to provide an API key and use a third-party MiniMax service to process input text, but it does not clearly warn that user-supplied content may be transmitted off-device to an external provider. Because this skill is specifically meant to process arbitrary user writing, that text may include sensitive drafts, business material, or personal data, creating a real privacy and compliance risk if users assume local-only handling.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The usage guidance lists broad 'use when' conditions but does not define when the skill should not be used, making accidental or overbroad activation more likely. Because this skill's purpose is to conceal AI-generation patterns, imprecise scoping increases the chance it is applied in contexts involving plagiarism, authorship misrepresentation, or policy evasion.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The invocation phrase 'Please humanize' is broad enough to match normal editing, polishing, or rewriting requests, so the skill may activate outside its intended scope. In context, this is risky because the skill is specifically designed to remove AI-detection signals, which can be applied to deception-oriented use cases without an explicit user acknowledgment.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file presents core operational instructions and the strength-mode table partly in Chinese while other sections are in English, and it advertises Chinese support without clarifying output-language behavior or asking for user preference. This can impose a language/locale assumption on users without opt-in.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The two embedded prompts conflict on a core safety/property-preservation rule: the first says not to add the model's own views or alter facts, while the second explicitly encourages adding opinions, first-person voice, and 'human messiness.' That inconsistency can cause the agent to drift from faithful editing into content fabrication or author-impersonation, especially when transforming sensitive or factual text.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The first-round prompt says to preserve the original tone and forbids adding the model's own views (L505-L510), but the second-round prompt explicitly instructs the model to add human voice, opinions, attitude, first person, and uncertainty (L526-L532). These directions conflict on the intended behavior of the skill and could cause output that departs from the source text despite earlier documentation promising preservation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file includes explicit language-specific operating guidance such as '中文场景特殊处理' and prescribes Chinese writing conventions for outputs, while only later adding English as a supplemental case. Because the document frames Chinese handling as the default methodology and does not state that language should follow user preference, it creates a natural-language locale policy concern.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python } try: response = requests.post(url, headers=headers, json=payload, timeout=120) except requests.exceptions.Timeout: raise RuntimeError("API 请求超时（超过120秒），请检查网络连接后重试。") except requests.exceptions.ConnectionError:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The tool transmits user-supplied text to an external LLM service but does not provide a clear runtime disclosure or consent mechanism. Users may pass confidential drafts, proprietary content, or personal data without realizing it leaves the local environment.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The script reads an API key from an environment variable to authenticate outbound requests. While this is a normal implementation pattern, the code provides no explicit user disclosure at runtime that credentials from the environment will be used for remote service access.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency is specified as
requests>=2.28.0, which allows any future version above that floor to be installed. This weakens reproducibility and can unintentionally pull in vulnerable or breaking releases during deployment, making supply-chain risk harder to control and audit.- Content
text requests>=2.28.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
Because
requestsis not pinned, it is impossible to verify from this manifest whether the installed version is affected by one of the known advisories for that package. The main risk is uncertainty: environments may resolve to different versions, including ones with disclosed security issues, which complicates assurance and incident response.- Content