T09 · Insecure Skill Coding Practices
Error
- Location
pipeline/01_parse.py:185- Finding
User-selected input is ignored, causing unauthorized processing of bundled chat records
- Content
View full analysis
- Remediation
View remediation
Security audit
伐木累分析大师
Security checks for vulnerabilities and agentic risk
Overview
This skill has a legitimate chat-analysis purpose, but it has serious review issues around processing the wrong chat file, bundling private chat data, exposed API credentials, and under-disclosed external AI calls.
Review carefully before installing. Do not run this on real family, group, or third-party chat exports unless all participants have consented and you understand that content may be sent to external model providers. The publisher should remove the bundled chat export, bind the parser to the user-selected file, remove and rotate the hard-coded Kimi key, document every external provider, and require review before any generated soul/persona file is installed as an agent prompt.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
pipeline/03_extract_kimi_openclaw.py:20- Finding
Hard-coded Kimi API credential is exposed in multiple executable scripts
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
pipeline/03_extract_kimi_openclaw.py:72- Finding
Alternate scripts transmit private chat data to an undisclosed Kimi endpoint
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
pipeline/03_extract.py:38- Finding
Untrusted chat content can poison generated agent system prompts
- Content
View full analysis
dict: text = chunk["text"] chunk_id = chunk["chunk_id"] time_range = f"{chunk['start_time']} ~ {chunk['end_time']}" prompt = ( prompt_template .replace("{{CHAT_TEXT}}", text) .replace("{{CHUNK_ID}}", str(chunk_id)) .replace("{{TIME_RANGE}}", time_range) ) return { "custom_id": f"chunk-{chunk_id}", "params": { "model": EXTRACT_MODEL, "max_tokens": 4096, "messages": [{"role": "user", "content": prompt}], }, } ``` From `prompts/extract_patterns.md:5-7`: ```markdown 以下是一段家庭群聊记录片段： {{CHAT_TEXT}} ``` From `pipeline/04_synthesize.py:293-313`: ```python soul_prompt_template = (PROMPTS_DIR / "synthesize_soul.md").read_text(encoding="utf-8") time_span = compute_time_span(all_obs) obs_text = observations_to_text(all_obs) soul_prompt = ( soul_prompt_template .replace("{{OBSERVATION_COUNT}}", str(len(all_obs))) .replace("{{TIME_SPAN}}", time_span) .replace("{{OBSERVATIONS_TEXT}}", obs_text) ) soul_content = stream_synthesis(client, soul_prompt, "soul.md（集体人格）") # 注入版本元数据（首次为 v1.0） today = datetime.now().strftime("%Y-%m-%d") version_header = f"\n" soul_content = version_header + soul_content save_text(soul_content, OUTPUTS_DIR / "soul.md") # 同时保存带版本号的备份 save_text(soul_content, OUTPUTS_DIR / "soul_v1.0.md") ``` The intended persistent use is documented in `SKILL.md:75-84`: ```markdown soul-f ...[truncated 2722 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (65)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Even from the English summary, the problem is the same: the skill claims family-chat persona derivation but appears to rely on a remote LLM with a hardcoded key and incomplete output behavior. Because the content being analyzed is exceptionally sensitive and may include minors or non-consenting participants, any hidden third-party transfer is especially dangerous in this context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Even from the English summary, the problem is the same: the skill claims family-chat persona derivation but appears to rely on a remote LLM with a hardcoded key and incomplete output behavior. Because the content being analyzed is exceptionally sensitive and may include minors or non-consenting participants, any hidden third-party transfer is especially dangerous in this context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Even from the English summary, the problem is the same: the skill claims family-chat persona derivation but appears to rely on a remote LLM with a hardcoded key and incomplete output behavior. Because the content being analyzed is exceptionally sensitive and may include minors or non-consenting participants, any hidden third-party transfer is especially dangerous in this context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Even from the English summary, the problem is the same: the skill claims family-chat persona derivation but appears to rely on a remote LLM with a hardcoded key and incomplete output behavior. Because the content being analyzed is exceptionally sensitive and may include minors or non-consenting participants, any hidden third-party transfer is especially dangerous in this context.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill handles highly sensitive family chat records yet does not prominently warn that contents may be uploaded to an external model service for analysis. This is a significant privacy vulnerability because users may assume local processing while actually disclosing intimate multi-party communications to a third party.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script processes family group chat records and transmits derived prompt content containing chat chunks to the external Moonshot/Kimi API. Because this skill handles highly sensitive interpersonal data and the manifest description does not clearly disclose third-party data transfer, users may unknowingly expose private family conversations, relationships, and behavioral traits to an external provider.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file embeds a live-looking Kimi API key directly in source as a fallback credential. This exposes an account-bound secret to anyone with repository access and allows unauthorized use of the external paid service; in this skill’s context, it is especially dangerous because the same script also sends private family chat content to that provider.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Using a hard-coded API credential fallback without explicit disclosure causes the script to silently authenticate to a third-party service even when the user has not configured one. That undermines informed consent, hides external dependency and billing/privacy implications, and can result in unauthorized use of the embedded account.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
A hard-coded API key is embedded directly in source code, which exposes the credential to anyone with repository or package access and enables unauthorized use of the external service. Because this skill handles private chat data, compromise of the credential can also facilitate uncontrolled third-party processing under the developer account.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code uses a hard-coded credential without any user-facing disclosure, indicating both insecure secret handling and lack of transparency about dependency on a remote paid/account-bound service. If the key is abused or revoked, users may face silent failures while the owner incurs cost or service misuse.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
A hard-coded API key in source code is a direct secret exposure. Anyone with repository or package access can reuse the credential, incur charges, access associated services, or pivot into broader account compromise depending on the provider's permissions.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code processes family chat logs, then sends prompts containing chat content to a third-party Kimi API. Because the skill handles highly sensitive interpersonal and behavioral data, undisclosed external transmission materially increases privacy, consent, and data-handling risk, especially if users expect local-only analysis from the skill description.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script sends synthesized family group-chat observations to an external LLM endpoint (
api.kimi.com) despite the skill being described as local chat/persona analysis. Because the input is derived from private family conversations, this creates a significant undisclosed data exfiltration and privacy risk, especially when users may reasonably expect purely local processing.- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
A hardcoded API credential is embedded directly in source code and used to access an external LLM service. This exposes the secret to anyone with repository or package access and combines credential leakage with transmission of sensitive family-derived data to a third party, increasing both abuse and privacy risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file contains a hardcoded API credential and initializes a remote LLM client without any user-facing warning that sensitive chat-derived content may be transmitted off-device. In the context of family persona extraction, users are likely to process highly personal conversations, so silent remote processing materially increases privacy and compliance risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The prompt explicitly instructs the model to derive behavioral patterns, values, relationship dynamics, and collective identity from real family chat logs, which are highly sensitive personal data. This creates a privacy and profiling risk because the skill operationalizes intimate conversation data into durable persona artifacts without any consent check, minimization guidance, warning, or safeguards against extracting sensitive inferences about household members, including potentially minors.
- Content
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 75% confidence
- Finding
The runner copies the entire parent process environment into child pipeline stages, which can unnecessarily expose secrets such as API keys, tokens, proxy credentials, or cloud credentials to every stage script. In a skill that processes sensitive family chat exports and invokes multiple subprocessed stages, broad environment inheritance increases the blast radius if any stage is compromised, logs its environment, or behaves unexpectedly.
- Content
python emit(f"STAGE:{stage_num}:START", label) env = os.environ.copy() env["SOUL_FORGE_SOURCE"] = str(source_file) env["SOUL_FORGE_OUTPUT"] = str(OUTPUT_DIR) env["PYTHONPATH"] = str(PIPELINE_DIR)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly promotes analysis of family group chat exports, which are highly privacy-sensitive and likely contain intimate personal data, but provides no warning about minimization, consent, retention, redaction, or safe handling. In the context of generating AI personas from private family conversations, this omission materially increases the risk of inappropriate collection and misuse of sensitive data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README requires both an ANTHROPIC_API_KEY and a chat export, strongly implying that private conversation data will be sent to an external model provider, yet it never discloses that transfer. For a tool processing family chats to build persistent digital personas, failing to warn users about third-party transmission and provider handling is a serious privacy and consent issue.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to read user-supplied files, write outputs, access environment variables, invoke shell commands, and contact external APIs, but it declares no explicit tool scope or permissions. This weakens sandboxing and informed-consent controls, especially because the input is highly sensitive family chat data and the workflow includes exfiltration to third-party model services.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad enough to match ordinary requests like 'help me analyze chat logs' or 'generate persona,' which increases the chance of accidental activation. In this skill, accidental activation is more serious than usual because it may lead to processing and potentially transmitting sensitive family chat data without a deliberately scoped request.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill encourages installing generated soul/persona files as the current agent's behavioral foundation without clearly warning that this can materially alter future agent behavior. That is risky because users may unknowingly change system behavior, tone, or decision tendencies based on automatically synthesized content derived from potentially noisy or manipulated chat data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The chat explicitly discusses feeding other people's face data into an AI video/image generation workflow without any mention of consent, authorization, or legal basis. In a skill whose purpose is to derive personas and digital identities from private family chat logs, this normalizes non-consensual biometric/likeness use and could enable impersonation, deepfakes, or privacy violations if surfaced as guidance or examples.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file contains natural-language content exclusively in Chinese, and there is no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy criterion, forcing a specific language without opt-in can be a policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code file contains natural-language instructions and status text exclusively in Chinese, including the module description and later console messages. Under the policy for natural-language violations, forcing a specific language without user opt-in is a locale policy issue unless the constraint is explicitly justified as region-specific.
- Content
Static analysis
No suspicious patterns detected.