T09 · Insecure Skill Coding Practices
Error
- Location
tools/upload_book_source.py:247- Finding
Default Third-Party Upload Can Expose Complete Book-Source Configurations
- Content
View full analysis
- Remediation
View remediation
Security audit
Legado Book Source Developer
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a Legado book-source toolkit, but it needs review because it can publish complete source configs to a public third-party host and includes under-scoped credential/session and anti-bot guidance.
Install only if you are comfortable reviewing each network and upload action. Do not upload sources that contain real cookies, Authorization headers, passwords, session IDs, private endpoints, or proprietary rules. Use it only on websites you own or are authorized to test, and avoid the anti-bot bypass materials unless you have explicit permission.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
tools/analyze_url.py:25- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (78)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented upload capability sends book source data to a third-party public host and returns shareable links, which is materially different from local development/debugging assistance. This creates a clear disclosure and exfiltration risk because source definitions may contain target URLs, request headers, cookies, tokens, or other sensitive operational details that users may not expect to leave their environment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented upload capability sends book source data to a third-party public host and returns shareable links, which is materially different from local development/debugging assistance. This creates a clear disclosure and exfiltration risk because source definitions may contain target URLs, request headers, cookies, tokens, or other sensitive operational details that users may not expect to leave their environment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The documented upload capability sends book source data to a third-party public host and returns shareable links, which is materially different from local development/debugging assistance. This creates a clear disclosure and exfiltration risk because source definitions may contain target URLs, request headers, cookies, tokens, or other sensitive operational details that users may not expect to leave their environment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented upload capability sends book source data to a third-party public host and returns shareable links, which is materially different from local development/debugging assistance. This creates a clear disclosure and exfiltration risk because source definitions may contain target URLs, request headers, cookies, tokens, or other sensitive operational details that users may not expect to leave their environment.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This file implements broad website account, login, registration, profile, bookshelf, bookmark, voting, and reporting features that are unrelated to the stated Legado book source development purpose. In this skill context, bundling a full web application interaction layer greatly expands attack surface and enables credential/session handling and user-state manipulation beyond what a book source authoring skill should need.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code explicitly detects Cloudflare interstitials and slider challenges, then attempts to bypass them using WebView execution, repeated requests, crafted cookies, and generated interaction traces. This goes beyond book-source debugging and automates circumvention of anti-bot and access-control mechanisms, which can enable unauthorized scraping and abuse of third-party sites.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
importScript(path) allows importing and executing JavaScript from network or local paths, which is effectively remote code execution within the skill environment. Because the documentation normalizes this capability without trust boundaries, signature checks, or origin restrictions, a user or downstream agent could load attacker-controlled code that performs network access, file operations, or data exfiltration.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Documenting access to the Android device ID without a privacy warning is dangerous because it exposes a stable identifier that can be used for tracking or linking user activity across requests. In combination with the documented network and script-execution features, the skill context makes this materially more dangerous than a generic utility API.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This section explicitly asks users to provide login accounts and cURL data, which commonly contain passwords, authorization headers, cookies, and session tokens. Collecting such secrets in a support/debugging workflow without a clear warning to redact them creates a real risk of credential exposure and account/session compromise.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <div id="search-result"> <!-- 内容为空，需要JavaScript加载 --> </div> <script> // 动态加载内容的JavaScript代码
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <div id="search-result"> <!-- 内容为空,需要JavaScript加载 --> </div> <script> // 动态加载内容的JavaScript代码
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The anti-bot section encourages users to provide login information and discusses obtaining valid cookies/session tokens to continue analysis. In the context of a skill that assists with scraping/configuring website access, this materially increases the chance of users disclosing secrets that could be reused to impersonate them or bypass access controls.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill advertises and documents network, file, and shell-capable tooling but does not declare any explicit tool scope or permission boundaries. In an agent setting, this increases the risk of overbroad access and unintended use of powerful capabilities beyond the user's expected task, especially when the skill can fetch remote content, read/write files, and invoke scripts.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Including an upload tool to a public image host is suspiciously outside the core purpose of creating and debugging Legado rules. Because book source files can embed sensitive metadata or request material, publishing them to a public host can leak private information or enable unauthorized reuse of scraping configurations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation describes public upload behavior but does not provide a clear warning that uploaded data may become accessible to third parties or persist outside the user's control. In a security-sensitive workflow involving source rules and HTTP request details, omitting that warning materially increases the chance of accidental data disclosure.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The document explicitly teaches use of executable JavaScript via constructs like @js and later snippets for extraction and request generation. In a skill meant for source/rule development, this expands capability from passive selector authoring into active code execution, which can enable unsafe automation, exfiltration of fetched content, or generation of opaque logic that is harder to audit.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest describes the skill as focused on creating and debugging Legado sources for novel/manga websites and configuring search, TOC, content, and book-info rules. However, the document explicitly defines source types for audio, files, and video, and later states the analyzed source set covers '影视、有声书、直播', which introduces capabilities outside the stated book/novel/manga context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example hard-codes the
Accept-Languageheader tozh-CN,zh;q=0.9, which imposes a specific locale preference. This can violate language/locale policy when used as guidance for skill behavior without offering user choice or documenting a justified regional constraint.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guide goes beyond neutral parsing/debugging and explicitly documents login flows, cookie persistence, custom authenticated headers, VIP-content access, anti-bot workarounds, request throttling, and browser/header simulation. Even if framed as legitimate configuration guidance, these capabilities materially enable bypass of site access controls and scraping restrictions when used on unauthorized targets, which creates abuse risk within the skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document provides direct examples for embedding sensitive request material such as Cookie and Authorization headers, while also recommending persistent cookie storage, but does not give strong warnings about credential leakage, accidental sharing, or reuse of live session tokens. In a reusable skill/reference, this can lead users to paste real secrets into configs, logs, or exported book sources, exposing accounts or authenticated sessions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code attempts to modify browser homepage settings and add favorites/bookmarks, behavior that is unjustified for a Legado book source development skill. Such functionality is invasive, legacy, and can be abused for browser hijacking or unwanted persistence, especially when included in a package whose declared purpose does not require browser configuration changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The login flow stores returned user_info, including a token, in client-side browser storage via store.set('user_info', json.data). Tokens in local/browser storage are accessible to any script running in the page context, so an XSS elsewhere on the site would enable session theft and account compromise.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The registration flow also stores server-returned user_info in browser storage immediately after account creation, carrying the same session exposure risk as the login flow. In the context of a skill that should not manage website accounts at all, this makes the issue more concerning because it introduces unnecessary credential/session handling into an unrelated tool.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The knowledge index exposes capabilities such as opening an internal browser, jumping to external links/apps, opening a video player, obtaining Android ID, and getting user-entered verification codes. While some network and selector guidance is expected for Legado rule authoring, these app/device interaction capabilities exceed the stated purpose of creating and debugging novel/manga book sources and analyzing website HTML structure.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest scopes this skill to developing Legado book sources for novel/manga websites, but the indexed materials and sample source names include movie/video and live-sports sources such as '看看影院', '无插件 - 赛事直播', and media-app sources like '网易云音乐' and '哔哩哔哩'. Those capabilities are not justified by a skill intended for novel/manga book-source creation and broaden the skill into general media-source development.
- Content
Static analysis
No suspicious patterns detected.