T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:85- Finding
API Credentials Exposed in Query Results and In-Memory Cache
- Content
View full analysis
- Remediation
View remediation
Security audit
美国市场政策查询Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill looks like a U.S. policy-query scaffold, but it overstates live AI analysis and can expose configured API keys in ordinary query results.
Review this before installing as a demo or scaffold, not as a trustworthy source for regulatory or investment decisions. Do not pass real API keys or sensitive endpoint strings through dataSources until the skill separates credentials from source names and stops returning or caching secret values.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README shows invocation phrases such as '查询美国最新的投资政策' and '如何在美国开展业务？' that are broad, natural-language requests rather than narrowly namespaced commands. In an agent platform, such generic triggers can cause the skill to activate on ordinary user queries unintentionally, expanding the skill’s reach and increasing the chance of inappropriate data access, unexpected tool use, or policy/business advice being produced when the user did not explicitly intend to invoke this specific skill.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The top-level description claims intelligent querying and analysis of U.S. market policies, but the implementation only emits canned placeholder responses. This discrepancy is dangerous because users may rely on the skill for regulatory or investment decisions under the false assumption that it performs live or substantive analysis.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code sets the default language to 'zh-CN' when the user does not provide a language, which imposes a specific locale automatically. Under the policy, forcing a language without user opt-in is a natural-language policy violation unless the locale constraint is clearly justified or optional.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The function advertises fetching policy data from a configured data source, but it actually returns hardcoded mock content with placeholder values such as ${name}. In a policy-analysis skill, this can mislead downstream users or agents into treating fabricated regulatory information as authoritative, creating integrity and decision-making risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The package description is written only in Chinese while the skill advertises "多语言支持" elsewhere, which creates a mismatch and may impose a language choice on users without consent. This is a natural-language policy concern because the user-facing metadata does not offer a language option or explain a locale restriction.
- Content