T09 · Insecure Skill Coding Practices
Error
- Location
config.json:2- Finding
Hardcoded DeBox API Credential in Distributed Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
DeBox Community
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly matches its DeBox community purpose, but it ships a real-looking API key and has unsafe profile-image network and file handling that should be reviewed before use.
Review and remove the bundled config.json API key before installing, use your own key through a safer secret mechanism, avoid running this CLI with elevated privileges, and be careful using profile/image features on other people's user IDs or wallets because they send identifiers to DeBox and may write files locally.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/debox-community.js:715- Finding
Unrestricted Remote Avatar Retrieval Enables Blind HTTPS Requests and Resource Exhaustion
- Content
View full analysis
{ https.get(avatarUrl, (res) => { if (res.statusCode !== 200) { reject(new Error('Failed to download avatar')); return; } const fileStream = fs.createWriteStream(tempAvatarPath); res.pipe(fileStream); fileStream.on('finish', () => { fileStream.close(); resolve(); }); }).on('error', reject); }); ``` ### Technical Analysis The avatar URL originates from profile data returned by the DeBox API and is passed directly to `https.get`. The code does not validate: - The destination hostname. - Whether the destination resolves to a private, loopback, link-local, or other sensitive address. - Whether the response is an image. - The response size. - The response duration. - Whether the connection stalls. - Whether the downloaded data is safe and reasonable for image processing. This creates a server-side request forgery-like primitive when an attacker can influence the avatar URL returned for a queried profile or compromise an upstream response. The primitive is limited to HTTPS requests because the implementation uses `https.get`, and the DeBox API key is not attached to the avatar request. Nevertheless, the process can be induced to connect to unintended HTTPS services reachable from the machine. The absence of a maximum response size allows a remote endpoint to continuously stream data into `temp-avatar.png`, potentially exhausting disk space. The absence of request and inactivity timeouts also allows a slow or non-terminating response to keep the ...[truncated 1968 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/debox-community.js:721- Finding
Predictable Project-Local Temporary File Permits Symlink Overwrite and Concurrent-Run Corruption
- Content
View full analysis
{ https.get(avatarUrl, (res) => { if (res.statusCode !== 200) { reject(new Error('Failed to download avatar')); return; } const fileStream = fs.createWriteStream(tempAvatarPath); res.pipe(fileStream); fileStream.on('finish', () => { fileStream.close(); resolve(); }); }).on('error', reject); }); // 处理头像为圆形 const circleMask = ` `; avatarCircle = await sharp(tempAvatarPath) .resize(80, 80) .composite([{ input: Buffer.from(circleMask), blend: 'dest-in' }]) .png() .toBuffer(); // 删除临时文件 fs.unlinkSync(tempAvatarPath); ``` ### Technical Analysis The program always uses the fixed path `temp-avatar.png` in the project root. `fs.createWriteStream` opens this path using normal write behavior and does not request exclusive creation or protection against symbolic links. If another local actor can create entries in the project directory, that actor can place a symbolic link at `temp-avatar.png`. When a more privileged user runs the image-generation command, Node.js follows the symbolic link and truncates or overwrites the linked target with downloaded avatar data. The final `unlinkSync` removes the symbolic link itself rather than restoring the overwritten target. The fixed filename also creates a race between concurrent runs. Multiple CLI processes can write to, process, or delete the same file, resulting in corrupted output, processing of another user's data, or failed operations. Cleanup is not placed in a `finally` block. Failures during download or image processing can therefore leave stale attacker-influenced con ...[truncated 1800 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (30)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented purpose is community verification and analytics, but the detected behavior includes downloading arbitrary external images, reading local files, and writing generated output files. This broader IO surface materially changes the trust model: external fetches can enable SSRF-style abuse or tracking, and local file read/write capabilities can expose or alter user data beyond what the description suggests.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/debox-community.js profile --user-id "abc123"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/debox-community.js profile --user-id "abc123"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/debox-community.js profile --user-id "abc123"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/debox-community.js profile --user-id "abc123"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/debox-community.js profile --user-id "abc123"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/debox-community.js profile --user-id "abc123"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/debox-community.js profile --user-id "abc123"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/debox-community.js profile --user-id "abc123"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/debox-community.js profile --user-id "abc123"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/debox-community.js profile --user-id "abc123"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/debox-community.js profile --user-id "abc123"
Known Vulnerable Dependency: sharp==0.34.5 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The lockfile pins sharp to 0.34.5, and the static analysis indicates known upstream vulnerabilities in bundled/native image-processing components such as libvips/libheif. Image parsing libraries are a common attack surface: if this skill ever processes untrusted images, an attacker could trigger crashes, denial of service, or potentially memory-corruption paths in native code.
- Content
Known Vulnerable Dependency: sharp==0.34.5 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The package explicitly depends on sharp 0.34.5, which is flagged as inheriting vulnerabilities from native image-processing libraries such as libvips and libheif. In a skill that may process community-related media or user-supplied images, vulnerable native parsers can expose the runtime to crafted-file attacks such as crashes, memory corruption, or potentially code execution/denial of service.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documentation instructs use of an environment variable for an API key, but the manifest declares no explicit tool scope or permissions despite relying on environment access. In an agent ecosystem, undeclared capability requirements reduce transparency and can cause the skill to receive broader runtime access than users expect, increasing the chance of secret exposure or misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The setup instructions recommend exporting the API key directly in the shell and storing it in a local config file, but provide no warning about shell history, file permissions, or secret leakage from checked-in config files. This can lead to accidental credential disclosure and unauthorized API use if users follow the documentation naively.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill advertises personal data reporting and profile lookup, including nickname, wallet address, level, and praise data, without any privacy warning, consent guidance, or data-handling limitations. In the DAO/NFT context, these identifiers can be correlated across on-chain and platform activity, creating deanonymization and profiling risk even if the data is obtainable via the API.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The tutorial instructs users to place the DeBox API key in a plaintext config.json file without any warning about local credential exposure, accidental commits, or insecure file permissions. If that file is read by other local users, included in backups, or committed to source control, the API key can be stolen and abused to access the DeBox API under the victim’s account.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The tutorial promotes a personal social data report and image-generation feature that goes beyond the declared community-management and eligibility-verification scope. This kind of scope expansion increases privacy risk because operators may collect, process, or share user profile and engagement data for purposes users and integrators would not reasonably expect from the skill metadata alone.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The
/group/is_joindocumentation enables wallet-address-based membership checks without any warning about privacy, user consent, or disclosure obligations. Because wallet addresses can be linked to DAO/NFT participation and identity, this capability can be used to deanonymize or profile users' community affiliations.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documented
/user/infoendpoint exposes user profile data, including wallet linkage, that is not reflected in the skill's stated capabilities. This creates a scope mismatch that can enable unexpected collection or enrichment of user identity data, increasing privacy and misuse risk because downstream users may not realize the skill can perform profile lookups.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The per-moment like inspection endpoints reveal interaction-level social activity that is not described in the manifest. Undisclosed social-graph and engagement inspection can be abused for profiling, surveillance, or eligibility decisions beyond the user's reasonable expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Multiple commands send wallet addresses, user IDs, and group identifiers to the DeBox API over the network. The file documents command purposes, but it does not clearly disclose to users that invoking these commands shares personal or account-linked data with an external service.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest frames the skill as a DeBox community/DAO/NFT membership verification and analytics tool, covering group info, membership checks, voting/lottery stats, praise data, and eligibility validation. The
profilecommand adds a separate capability to render a personal report image and save it to an arbitrary local path, which goes beyond the stated verification/query scope.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code downloads a remote avatar URL from API-controlled user data and fetches it server-side with https.get, then writes it to a local temporary file for image processing. This creates an SSRF-style/network pivot risk and unnecessary local processing surface because a remote endpoint can influence what host is contacted and what content is fetched.
- Content