T09 · Insecure Skill Coding Practices
Error
- Location
scripts/redmine.py:16- Finding
Redmine API key may be exposed through insecure transport or cross-origin redirects
- Content
View full analysis
- Remediation
View remediation
Security audit
Redmine Pilot
Security checks for vulnerabilities and agentic risk
Overview
This Redmine skill appears purpose-built, but it needs review because it can use an API key to read and change project data without tight request safeguards.
Install only if you trust the Redmine server URL and can use a least-privilege API key. Configure an HTTPS Redmine URL, avoid broad production credentials, and manually review any create or update action before letting the agent run it.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Tainted flow: 'req' from os.environ.get (line 37, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python req = Request(full_url, data=body, headers=headers, method=method) try: with urlopen(req) as resp: if resp.status == 204: return None return json.loads(resp.read().decode())
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill uses environment-provided credentials and makes network requests to an external Redmine instance, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates an authorization ambiguity where the skill may be invoked with broader capabilities than users expect, increasing the chance of unintended credential use or outbound access.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger description includes broad terms like project, issue, 任务, and 工单, which are common in many unrelated conversations. This can cause the skill to activate unintentionally and perform sensitive Redmine lookups or state-changing actions in contexts where the user did not clearly request Redmine access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation instructs users to configure an API key and demonstrates create/update operations, but it does not warn that these credentials are sensitive or that the skill can modify remote project data. In practice, this increases the risk of accidental disclosure of the API key and unintended changes to production issue-tracking systems.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
3. 创建 Issue
bash curl -s -X POST -H "X-Redmine-API-Key: $REDMINE_API_KEY" \ -H "Content-Type: application/json" \ "$REDMINE_URL/issues.json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
4. 更新 Issue
bash curl -s -X PUT -H "X-Redmine-API-Key: $REDMINE_API_KEY" \ -H "Content-Type: application/json" \ "$REDMINE_URL/issues/ISSUE_ID.json" \ -d '{
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Natural-language strings such as the module description, help text, and error messages are consistently presented only in Chinese. This forces a specific language experience without offering opt-in, fallback, or documenting that the tool is intentionally limited to a Chinese-speaking context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code performs state-changing API calls to create and update issues, which can alter shared project data. Although the commands are named for their purpose, the file provides no confirmation prompt or explicit caution that these actions will modify remote records before execution.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill reference content is written in Chinese and does not indicate that other languages are supported or that Chinese is optional. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content