T09 · Insecure Skill Coding Practices
Error
- Location
blog-mini-ljt.py:55- Finding
Administrator credentials and session tokens are transmitted over plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
blog-mini-ljt
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed blog API manager, but it can modify, upload, and permanently delete remote content through a default plaintext HTTP service with weak credential handling and limited safeguards.
Install only if you control and trust the target blog API. Prefer configuring an HTTPS base URL you own, rotate or disable any admin/admin default account, avoid passing real passwords or tokens on command lines, require manual confirmation before deletes or uploads, and do not let the agent upload arbitrary local paths.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
blog-mini-ljt.py:298- Finding
Unrestricted local file paths can be uploaded to a remote server
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:37- Finding
Known default administrator credentials are published and used in operational examples
- Content
View full analysis
--ids 1 2 3 # 3. 退出登录 python3 scripts/blog-mini-ljt.py admin-logout --token ``` ``` ### Technical Analysis The Skill explicitly publishes `admin/admin` as the remote service's default administrator credentials and includes those credentials in executable examples and tests. Calling them “not credentials” does not change their security function: they authenticate a principal to an administrative interface and produce a privileged session token. If the target deployment retains this default, anyone with network access to the endpoint can attempt authentication using publicly known values. This risk is amplified by the built-in remote base URL and the administrator endpoint's ability to perform irreversible bulk deletion. ### Attack Path 1. An attacker obtains the Skill package or documentation and learns that the default credentials are `admin/admin`. 2. The attacker connects to the documented administrator login endpoint. 3. If the deployment has not rotated or disabled the default account, the server returns an administrator session token. 4. The attacker supplies that token to `/admin/api/delet ...[truncated 487 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Third-party dependency is not reproducibly pinned
- Content
View full analysis
=2.20.0 ``` ### Technical Analysis The dependency declaration accepts any `requests` release from version 2.20.0 onward. It provides no exact version, upper bound, lockfile, or package hash. As a result, separate installations can resolve different dependency versions, including future releases that were not reviewed with this Skill. This is not evidence that the current `requests` package is malicious. The security issue is the non-reproducible supply-chain policy: the effective third-party code can change during installation without any corresponding change to the audited project. ### Attack Path 1. The Skill is installed in a new or rebuilt environment. 2. The package installer resolves the broad version constraint at installation time. 3. A newer, incompatible, compromised, or otherwise unreviewed release is selected. 4. The selected package executes in the Skill's Python process when imported. 5. It consequently receives access to request payloads, administrator credentials, tokens, uploaded file contents, and the process's network privileges. ### Impact Assessment A compromised dependency would execute with the same privileges as the Skill and could access all data handled by the process, including credentials, tokens, local files selected for upload, environment variables, and network traffic. Less severe version incompatibilities could cause availability failures or unexpected security behavior. The finding represents supply-chain exposure rather than proof of an existing malicious package. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (28)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 91% confidence
- Finding
This endpoint exposes a destructive delete action over a no-auth public API, allowing article removal by supplying only an article ID and an optional hard-delete flag. In the skill's context, an agent can be induced to delete arbitrary content with minimal friction, making parameter abuse and unauthorized destructive operations highly plausible.
- Content
md **Body 字段**：`title`(str,可选), `content`(str,可选), `lid`(int,可选), `img`(str,可选), `heat`(int,可选)。至少传一个字段。 **响应**：`{"code":200,"message":"文章更新成功"}` ### 1.6 DELETE /api/articles/{id} — 删除文章 | 项 | 值 | |---|---|
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 89% confidence
- Finding
The comment deletion endpoint allows destructive state changes based solely on a comment ID and appears to be part of the unauthenticated public API. This makes it easy for an agent or attacker to remove user-generated content without ownership checks or operator awareness.
- Content
md **响应**：`{"code":200,"data":[{"id":1,"uid":1,"aid":3,"content":"...","deleted":0,"createtime":"...","uname":"admin","img":"img/moren.jpg"}]}` ### 2.3 DELETE /api/comments/{id} — 删除评论（软删除） | 项 | 值 | |---|---|
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 89% confidence
- Finding
The message deletion endpoint performs a destructive action using only a message ID and is described within the public API surface. In an agent setting, this is susceptible to prompt-driven abuse or accidental moderation actions against arbitrary messages.
- Content
md **Body 字段**：`uid`(int,必填), `mid`(int,必填,被回复的留言 ID), `content`(str,必填) **响应**：`{"code":200,"data":{"id":1}}` ### 4.4 DELETE /api/messages/{id} — 删除留言（软删除） | 项 | 值 | |---|---|
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The mood deletion endpoint is explicitly irreversible, yet the documentation provides no strong caution or procedural safeguard. For agent-driven use, undocumented or weakly signaled irreversible actions materially raise the risk of permanent data loss from mistakes or malicious prompting.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 93% confidence
- Finding
This endpoint hard-deletes mood entries irreversibly by ID, with no indication of authentication or guardrails on the public API. The combination of irreversible deletion and low-friction invocation makes this a dangerous primitive for agent misuse or external abuse.
- Content
md **Body 字段**：`content`(str,必填), `title`(str,默认""), `src`(str,默认"") **响应**：`{"code":200,"data":{"id":1}}` ### 5.3 DELETE /api/moods/{id} — 删除说说 | 项 | 值 | |---|---|
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 94% confidence
- Finding
Deleting uploaded files by filename is a high-risk operation because files are shared assets that may be referenced by posts or pages, and the documented API appears unauthenticated. In an agent workflow, a simple filename parameter can be abused to remove important assets and disrupt site integrity.
- Content
md **响应**：`{"code":200,"data":[{"filename":"xxx.png","url":"/uploads/xxx.png","type":"image","size":12345}]}` ### 6.4 DELETE /api/uploads/{filename} — 删除已上传文件 | 项 | 值 | |---|---|
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The admin bulk hard-delete endpoint enables irreversible deletion of multiple articles, yet the documentation lacks strong warning language or operational safeguards. In an agent-integrated skill, this creates a high-risk primitive that could be abused or triggered mistakenly for large-scale destructive impact.
- Content
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python # 1. 项目知识优先 creds.update(_load_from_project_knowledge()) # 2. 环境变量回退 for k, v in os.environ.items(): u = k.upper() if u.startswith(_CRED_PREFIX) and 'BASE_URL' in u: creds.setdefault('base_url', v)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill exposes capabilities that can read project files, access environment-derived configuration, and make network requests, but it does not declare any explicit tool scope such as allowed-tools or permissions. That mismatch weakens enforcement boundaries and can let an agent use broader capabilities than a reviewer or runtime policy expects, especially because the skill also instructs reading
.project-info/and contacting a default remote API.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This section presents deletion and file-upload capabilities as routine operations without requiring user confirmation, safety checks, or a warning about side effects. In an agent setting, that increases the chance of accidental destructive actions or unintended exfiltration of local files when a prompt ambiguously asks the agent to 'clean up' or 'upload' content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documents hard-delete behavior for moods, uploads, and admin bulk deletion, but does not prominently warn that these actions are irreversible or require confirmation. Because the skill is designed for full lifecycle management and includes bulk admin deletion, an agent could permanently remove substantial content with a single misunderstood instruction.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation presents the skill as a no-auth public API while also exposing authenticated admin functionality, including login and token handling. This mismatch can cause an agent or operator to treat privileged operations as broadly safe and automatic, increasing the chance of unauthorized or unsafe administrative actions, especially given the documented default admin/admin credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill documents article deletion, including optional hard delete behavior, without requiring any warning, confirmation, or safety guidance. In an agent context, this makes destructive actions easy to invoke accidentally or through prompt manipulation, leading to avoidable content loss.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Uploaded-file deletion permanently removes stored assets and may break linked content, but the docs do not warn about those consequences. In a content-management skill, file deletion can have cascading operational impact when an agent acts on incomplete context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Natural-language descriptions, help text, error messages, and rendered Markdown are consistently hard-coded in Chinese throughout the skill. There is no indication that the user can opt into another language or locale, which can violate language/locale choice policies.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill presents itself as an unauthenticated public API tool while also exposing privileged admin login/logout and token-based deletion functions. This mismatch can cause an agent or operator to invoke sensitive administrative actions under a false assumption of low risk, increasing the chance of credential submission and destructive operations against a remote system.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code advertises auth_type as 'none' even though it contains token-based admin authentication flows and administrative delete operations. Misstating the authentication model is dangerous because downstream agents may treat the tool as safe for autonomous use, leading to accidental credential handling or unauthorized destructive requests.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
This POST path transmits user-supplied content to an external server, including article text, comments, messages, credentials in some flows, or file uploads depending on the command. External transmission is expected for an API client, but in this skill it is materially risky because it targets a remote default host and includes sensitive/destructive operations without strong guardrails.
- Content
python if method == 'GET': resp = requests.get(url, params=params, timeout=30, **auth_kwargs) elif method == 'POST': resp = requests.post(url, json=payload, files=files, timeout=30, **auth_kwargs) elif method == 'PUT': resp = requests.put(url, json=payload, files=files, timeout=30, **auth_kwargs) elif method == 'PATCH':
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 81% confidence
- Finding
This PUT path sends update payloads to an external server, enabling remote modification of blog content and potentially disclosing sensitive text entered locally. Although outbound API calls are normal for this type of tool, the combination of silent transmission and privileged content-management actions makes the behavior security-relevant in an autonomous-agent context.
- Content
python elif method == 'POST': resp = requests.post(url, json=payload, files=files, timeout=30, **auth_kwargs) elif method == 'PUT': resp = requests.put(url, json=payload, files=files, timeout=30, **auth_kwargs) elif method == 'PATCH': resp = requests.patch(url, json=payload, timeout=30, **auth_kwargs) elif method == 'DELETE':
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The upload commands read arbitrary local file paths and transmit file contents to a remote server without any explicit disclosure warning, confirmation step, or path restrictions. In an agent setting, this creates a clear risk of unintended exfiltration of sensitive local workspace files if prompted by untrusted content or user ambiguity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The admin-login command sends administrator credentials to a remote server and harvests a session token from cookies without any explicit consent checkpoint or trust validation for the destination. This is especially risky because the base URL may come from environment or project files, so an agent could be tricked into posting credentials to an attacker-controlled endpoint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents a
UserCreatepayload includingpwd,phone, andemail, but it does not warn users that they are supplying sensitive personal data and credentials to the skill/API. Under the markdown-specific SQP-2 criteria, descriptions that involve privacy-impacting behavior should disclose that such data will be transmitted or handled.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This JSON manifest embeds user-facing descriptions and notes entirely in Chinese, including test case descriptions and operational notes, without indicating that language selection is optional. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless clearly justified as region-specific.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The metadata explicitly states the API is public/unauthenticated while also advertising an administrative login with default credentials (admin/admin). This creates a clear insecure-defaults condition: agents or users may access privileged functions without proper secret management, and exposed default admin credentials are commonly abused for takeover of content, users, and backend settings.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The prescribed issue/PR comment format and quoted reply template are written as fixed Chinese output strings, and the document does not offer the user a language or locale choice. This can violate language/locale policy when used with users expecting another language.
- Content
Static analysis
Detected: suspicious.secret_argv_exposure
Instructions pass high-value credentials through process argv.
Critical
- Code
- suspicious.secret_argv_exposure
- Location
- SKILL.md:269