Security audit

testskill-0410repo123

Security checks for vulnerabilities and agentic risk

Overview

This QQ group-admin skill is plausible, but it exposes a much broader bot-control channel than its stated purpose clearly scopes.

Review before installing. Use only with a trusted local OneBot/NapCat endpoint, remove or rotate the embedded token, restrict the helper to the specific group-admin actions you intend to allow, avoid @/file inputs for sensitive paths, and require explicit approval for kicks, bans, admin changes, message deletion, announcements, and other privileged actions.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill exposes environment-driven capabilities (`ONEBOT_WS_URL`, `ONEBOT_WS_TOKEN`) but does not declare permissions or clearly scope what external connectivity and secret use are required. This weakens review and consent boundaries, making it easier for the skill to use sensitive configuration or connect to unintended services without operators realizing it.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented purpose is narrow group administration, but the underlying interface appears able to invoke arbitrary OneBot actions, including non-group operations, and to load parameter values from local files for transmission. That creates a significant capability gap: a user or upstream agent may trust the skill for routine admin tasks while it can actually perform broader actions or exfiltrate local data through the OneBot service.

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The manifest omits implemented operations such as message deletion, avatar changes, and information retrieval. Incomplete disclosure is a security issue because reviewers and invoking agents may authorize the skill under an inaccurate model of its behavior, enabling unintended moderation or data-access actions.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Allowing arbitrary HTTP URLs as the `file` source for group avatar updates introduces external fetch behavior that is broader than ordinary group admin actions. Depending on the OneBot implementation, this can be abused for server-side request forgery, network probing, or pulling attacker-controlled content into a privileged service context.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The script is explicitly designed to call arbitrary OneBot actions via `node onebot-action.js <action> ...`, which exceeds the skill's declared purpose of limited QQ group administration. In an agent setting, this creates a capability mismatch: any caller able to invoke the script can reach sensitive or undocumented OneBot APIs beyond the intended admin operations, enabling privilege expansion and abuse of the connected bot account.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: This code implements a generic remote API invoker over WebSocket, forwarding arbitrary `action` and `params` directly to OneBot with no policy enforcement. In the context of a narrowly scoped group-admin skill, that broad transport primitive is dangerous because it allows an agent or attacker to use the bot as a general control channel rather than a constrained administrative tool.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The `@/path/to/file` feature allows arbitrary local file contents to be loaded into API parameters and then transmitted to the remote OneBot service. That is not required for normal group administration and creates a local file disclosure path, which is especially risky in an agent environment where prompts or tool inputs may be attacker-influenced.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The script embeds a fallback WebSocket token in source code, meaning anyone with code access can recover a usable credential for the OneBot connection. Hardcoded secrets are commonly leaked through repositories, logs, backups, or packaged artifacts, and in this case would grant direct access to the bot control interface.

Static analysis

No suspicious patterns detected.