Security audit

contextloader

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a documented Context Loader API guide, but it can trigger backend knowledge-network rebuild jobs and forwards an account identifier to a configurable HTTP service without enough scoping or safeguards.

Install only in an environment where administrators control CONTEXT_LOADER_BASE_URL and APP_USER_ID, preferably with HTTPS or trusted internal networking. Treat full knowledge-network rebuilds as privileged actions: require explicit user confirmation and appropriate backend authorization before allowing the agent to create build jobs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:102
Finding: Unvalidated Service URL Can Expose the Application Account Credential
Content: View full analysis
. - Always send x-account-type: app. - Do not send an Authorization header. - If APP_USER_ID is missing, stop and ask the user to supply the environment variable. ``` The same behavior is repeated in `references/api-calling.md`, lines 5-24. The OpenAPI definition in `references/openapi/get_action_info.yaml`, lines 157-165, identifies `x-account-id` as an API-key authentication mechanism: ```yaml securitySchemes: AccountAuth: type: apiKey in: header name: x-account-id description: Account ID authentication security: - AccountAuth: [] ``` ### Technical Analysis The skill obtains its destination entirely from `CONTEXT_LOADER_BASE_URL` and instructs the agent to attach `APP_USER_ID` as the `x-account-id` authentication header. It imposes no HTTPS requirement, hostname allowlist, origin validation, or protection against redirects. Consequently, a deployment mistake or an attacker who can influence this environment variable can direct authenticated requests to an attacker-controlled server. The documented example also explicitly permits plain HTTP. On an untrusted network, this allows an on-path party t ...[truncated 2251 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file is written entirely in Chinese and explicitly points readers to a Chinese end-to-end examples file, but it does not state that the skill is region-specific or provide an opt-in/choice of language. That creates a natural-language locale policy concern because the skill appears to assume a single language by default.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is presented as a context-loading and retrieval capability, but the documentation also exposes a state-changing operation that creates full ontology build tasks. This violates least surprise and can enable unintended write actions by downstream agents or users who assume the skill is read-only, potentially triggering expensive, disruptive, or unauthorized backend jobs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instruction "输出保持结构化且简洁" appears within an otherwise fully Chinese skill guide and, more importantly, the document as a whole presents the skill behavior exclusively in Chinese without offering any user language or locale choice. Under the policy, skills should not force a specific language unless the locale constraint is explicitly documented and justified or the user is given an opt-in choice.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The example file expands the skill from read-oriented context loading and status querying into a state-changing administrative operation: triggering a full knowledge-network rebuild. That broadens the effective capability surface of the skill and can cause unintended operational impact if an agent follows the example without strict authorization, especially because rebuild actions are not framed as privileged or risky.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented purpose says the skill is for loading business knowledge-network context and querying build status, but the example also instructs the agent to initiate a rebuild. This mismatch can mislead reviewers and downstream agents about the real privilege level of the skill, increasing the chance that a seemingly low-risk retrieval tool is used to perform administrative mutations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: A destructive or disruptive rebuild operation is documented as a straightforward call flow without warning text, confirmation steps, rollback considerations, or checks for operator intent. In agentic contexts, that omission is dangerous because users may phrase requests casually and the agent may execute an expensive or service-impacting rebuild without adequate safeguards.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This OpenAPI document presents the title, descriptions, parameter explanations, and examples entirely in Chinese, with no indication that the skill is region-specific or that another language is supported. Under the policy for natural-language constraints, forcing a specific language without opt-in or justification is a locale/language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The title, summary, and operational descriptions are presented only in Chinese, with no indication that other languages are supported or that the API is intentionally limited to a Chinese-speaking environment. Under the policy, a skill should not force a specific language or locale without user opt-in or a clearly documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This OpenAPI manifest contains user-facing titles, descriptions, and field documentation entirely in Chinese, including the API title, endpoint descriptions, parameter descriptions, and schema documentation. Under the policy rule, forcing a specific language without opt-in or an explicit documented regional justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The API requires forwarding x-account-id and x-account-type to a backend service, but the spec provides no indication of consent, minimization, or handling expectations for that account context. In an agent setting, this can lead to silent propagation of user/account identifiers to downstream services, increasing privacy and cross-tenant context leakage risk if the integration is misused or over-broad.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill metadata describes a context-loading/query capability, but this API exposes a state-changing operation that creates full knowledge-network build jobs. That mismatch expands the skill's authority beyond user-expected read/query behavior and can enable unauthorized or surprising backend modifications, resource consumption, or workflow triggering if the agent invokes it based on untrusted prompts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This manifest-style OpenAPI file uses Chinese exclusively for the API title and endpoint description, and there is no indication that the skill is region-specific or that users can opt into a language/locale. Under the policy, forcing a specific language without user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: 该 schema 名称为 OperatorProperty，描述为“算子属性”，但 property_type 的枚举却只有 metric，mapping_source_id 说明也写成“映射的指标模型id”。这表明文档/模型很可能从指标属性复制而来未改全，导致接口意图与实际声明相互冲突。
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: ObjectDataResponse 在 required 中声明了 groups、type、datas、search_after 为必填字段，但其 properties 仅定义了 object_type、datas、total_count、search_after，并没有 groups 或 type。这不是简单的文档不完整，而是 schema 自身对返回意图的主动矛盾描述，会误导调用方对接口实际返回内容的理解。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Natural-language fields such as the title and descriptions are entirely in Chinese, which can effectively force a specific language for users or integrators. The file does not indicate that the locale is optional, user-selectable, or justified as a region-specific tool.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This manifest describes the interface as supporting '完整的问题或一个或多个关键词' for intelligent retrieval, which is a very broad invocation description in a manifest file. It does not provide limiting context, explicit trigger phrases, or exclusion conditions to clarify when this skill should or should not be selected by an agent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The human-readable title, descriptions, and examples are written entirely in Chinese throughout the OpenAPI document. Because this manifest-like file contains natural-language interface documentation and does not indicate that the API is region-specific or offer an alternative locale, it may conflict with language/locale policy expectations requiring user choice or documented justification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: PageTurnQueryWithSearchAfter 名称、必填字段 search_after 以及字段说明都表明它用于后续翻页查询，但描述文本仍写成“分页查询的第一次查询请求”。这会直接误导技能或调用方对该接口用途的理解，属于文档意图与实际语义不一致。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.