T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:85- Finding
Configured API Credentials Are Exposed in Policy Query Results
- Content
View full analysis
- Remediation
View remediation
Security audit
europe-anz市场政策查询Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a mock policy-query helper, but its documented API-key setup can cause configured secrets to be returned and cached in query results.
Review before installing. Do not configure real API keys as dataSources unless the implementation is fixed to keep credentials out of returned objects and caches. Treat the package as mock/demo quality: it does not actually fetch live policy data despite claiming real-time/API-backed collection.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README states that the skill performs real-time policy data collection and supports configurable external APIs, but it does not warn users that queries, prompts, or related metadata may be transmitted to third-party services. This omission can lead users to unintentionally send sensitive business questions or operational context to external providers without informed consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README encourages invocation through broad natural-language prompts like asking the agent to analyze markets or monitor policy changes without defining scope, data boundaries, or required confirmation steps. In agent ecosystems, overly broad triggers can cause unintended tool use, excessive data access, or action on ambiguous requests, especially when combined with external data retrieval and analysis capabilities.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The top-level documentation says the skill supports six languages: zh-CN, en-US, fr-FR, de-DE, it-IT, and es-ES. However, the translation table and language switch logic only implement zh-CN and en-US, so the documentation actively overstates actual behavior rather than merely omitting detail.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Line L010 sets the default language to 'zh-CN' whenever the caller does not explicitly provide a language. The policy requires avoiding forced language or locale selection unless the user is given a choice or the constraint is clearly justified, and this file applies Chinese by default rather than prompting or negotiating language preference.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The document is written entirely in Chinese and the language section lists only Simplified Chinese and US English, with 'automatic language detection and switching' but no explicit user choice or opt-in flow. This can conflict with a language/locale policy if the skill implicitly determines or constrains user language rather than clearly offering a selection.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
Line L004 claims support for zh-CN, en-US, fr-FR, de-DE, it-IT, and es-ES, but the translation table and supported language list only implement zh-CN and en-US later in the file. This mismatch can mislead users about locale availability and may result in fallback behavior that does not respect the user's chosen language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest description at L04 is entirely in Chinese and does not indicate that users can choose another language. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This test file includes user-facing console output and comments primarily in Chinese, while also explicitly switching the skill between zh-CN and en-US. For a general-purpose skill, embedding a fixed language in visible messaging can violate locale-choice policy unless the language constraint is clearly justified or user-selected.
- Content