T09 · Insecure Skill Coding Practices
Error
- Location
api_client.js:35- Finding
Plaintext Credential Persistence in Project Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
Rrbdagent
Security checks for vulnerabilities and agentic risk
Overview
The skill targets a real RRBD admin backend but stores passwords in plaintext and ships runnable scripts with hardcoded account credentials.
Review before installing. Do not use a real RRBD account with this package unless password persistence is removed, hardcoded credentials are deleted and rotated, runtime history files are excluded from releases, and invocation is narrowed to explicit RRBD tasks. Treat any shipped media URLs and exposed test account credentials as already disclosed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/create_another_video.js:11- Finding
Hardcoded Account Credentials in Executable Scripts and Documentation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:182- Finding
Unencrypted Cross-Session Storage of User Video Activity and Direct Media URLs
- Content
View full analysis
10) { this.memory.recentVideos = this.memory.recentVideos.slice(-10); } this.saveMemory(); ``` The storage method is: ```js saveMemory() { const memoryFile = path.join(__dirname, 'memory.json'); try { fs.writeFileSync( memoryFile, JSON.stringify(this.memory, null, 2), 'utf8' ); } catch (error) { console.log(`Failed to save memory: ${error.message}`); } } ``` The committed `memory.json` contains populated records of this form: ```json { "id": "69ba50fa30eca00030937ce3", "title": "一物一码让信任更简单_修复版", "createdAt": "2026-03-18T07:16:25.937Z", "videoUrl": "https://rrbd20ims.oss-cn-shenzhen.aliyuncs.com/1962755608750927873/20260318/db53e8268c9a4459a9f1280890962099.mp4" } ``` It also contains a persisted `lastLogin` timestamp. ### Technical Analysis The Skill stores video IDs, titles, creation timestamps, direct object-storage URLs, and login activity in a package-global plaintext file. The state is not separated by operating-system user, RRBD account, or session. No explicit file-permission hardening, encryption, consent, URL redaction, or secure deletion is implemented. The package already contains populated state, demonstrating that runtime user data was included in the distributed project. This is not classified as Agent Memory Poisoning because the stored data does not contain attacker-controlled instructions that alter future Agent behavior. It is an insecure data-storage issue. ### At ...[truncated 982 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
package-lock.json:14- Finding
Dependency Artifacts Resolved Through a Third-Party Registry Mirror
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (105)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The skill is described broadly, but the underlying workflow appears to include fixed authenticated API retrieval tasks rather than a true general NL-driven interface. In security terms, that mismatch increases the likelihood of over-permissioning and accidental use of a production account in testing or automation contexts.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation explicitly says the system will prompt for a phone number and password and automatically save them to a configuration file. Persisting user passwords in local config creates a clear secret-retention and leakage risk, especially if the file is plaintext, shared, backed up, or accessible to other tools and users on the system.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Instructing the collection and storage of user-provided login credentials in a config file creates a direct confidentiality risk and expands the attack surface to local files, logs, backups, and future tool reads. In this skill context, the danger is elevated because the credentials unlock a real admin/backend account with access to user, media, and possibly financial operations.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger conditions are so broad that they could capture general user requests for system operations, troubleshooting, or automation unrelated to the RRBD domain. In context, this is dangerous because the skill can authenticate to a real backend and handle local config, so over-triggering may lead to inappropriate invocation, data access, or remote actions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code transmits a phone number and password for login without any user warning, consent prompt, or indication of how the credentials are protected. In an automation skill, silent credential use is dangerous because users may trigger account actions unknowingly, and any code, log, or repository exposure compromises a real account.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code contains hardcoded login credentials, including a phone number and password, which are directly usable to access the backend. Embedded secrets are easily leaked through source control, logs, package distribution, or reverse engineering, enabling unauthorized access to administrative or sensitive video data.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
A network authentication call is made with fixed credentials and no disclosure or user mediation, meaning anyone with access to the code can replay the login behavior. This creates a direct account-compromise path and makes accidental credential exposure especially dangerous in an automation skill context.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- api_client.js:44
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- create_video_different_template.js:14
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- create_video_laozeng_shuai.js:14
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- create_video_laozeng_shuai2_final.js:13
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- create_video_laozeng_shuai2.js:15
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- create_video_using_skill.js:14
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/create_laozeng_video.js:10
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/generate_new_video.js:13
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/get_videos_now.js:13
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/just_get_videos.js:11
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/laozeng_video.js:13
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/login_and_check.js:11
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/make_video_now.js:13
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/quick_check.js:11
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/show_me_videos.js:12
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/test_fixed_code.js:14
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/test_szr_api.js:14
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/videos_please.js:13